{
  "generated": "2026-10-19",
  "criteria": {
    "pillars": [
      {
        "id": "C",
        "name": "Censorship Resistance",
        "question": "Who can block valid use, and can users route around them?"
      },
      {
        "id": "O",
        "name": "Open",
        "question": "Is the whole stack visible?"
      },
      {
        "id": "F",
        "name": "Free",
        "question": "Does the license actually let a third party fork, modify, and run it?"
      },
      {
        "id": "P",
        "name": "Privacy",
        "question": "What can an observer learn, and did the user knowingly choose it?"
      },
      {
        "id": "S",
        "name": "Security",
        "question": "Who can cause loss, lock users in, or change the rules?"
      }
    ],
    "criteria": [
      {
        "id": "C1",
        "pillar": "C",
        "title": "Admin pause, freeze, or blacklist over the payment path",
        "short": "Admin pause or freeze powers",
        "question": "Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained?",
        "why_it_matters": "A pause or blacklist key is a single point at which a third party can halt your receivables or single out your counterparties. The question for a risk committee is not whether such a key exists but who holds it, how many signers it takes, and how much notice you get before it is used.",
        "anchors": {
          "0": "Role is EOA-held or undisclosed, or can target individual addresses with no notice.",
          "1": "Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.",
          "2": "Such a role exists and is held by a Safe of at least 2-of-3 with disclosed signers, no enabled module or guard that bypasses the threshold, behind a timelock at least as long as the documented user exit, with its scope documented in code or NatSpec.",
          "3": "No pause, freeze, blacklist, or relayer/allowlist role that can stop settlement exists in the settlement contracts."
        },
        "verify_with": [
          {
            "artifact": "Role holders read onchain (owner(), AccessControl role members, pauser/guardian storage)",
            "tier": "verified"
          },
          {
            "artifact": "Safe threshold and owners read onchain",
            "tier": "verified"
          },
          {
            "artifact": "Timelock contract and its delay read onchain",
            "tier": "verified"
          },
          {
            "artifact": "Source at a pinned commit showing what the role can reach",
            "tier": "verified"
          },
          {
            "artifact": "Safe modules (getModulesPaginated) and guard (storage slot 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8) read onchain",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Pauser is a single EOA described as \"the team\".",
          "Multisig threshold is 1-of-N, which is an EOA with extra steps.",
          "Blacklist inherited from a token is mistaken for a provider role (score that under C5)."
        ],
        "provenance": "contract"
      },
      {
        "id": "C2",
        "pillar": "C",
        "title": "Direct settlement path",
        "short": "Settle without the provider",
        "question": "Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer?",
        "why_it_matters": "If settlement only works through the provider's servers, the provider can refuse service to anyone and an outage stops your cash flow. A documented direct path means the contracts, not the company, are the rail.",
        "anchors": {
          "0": "Settlement requires the provider's API, signer, or relayer.",
          "1": "Partial (for example settle but not refund or withdraw), or documented only.",
          "2": "Possible but undocumented; reconstructable from verified source.",
          "3": "A payer or payee can complete settlement by calling the public contract directly, with the ABI and addresses documented."
        },
        "verify_with": [
          {
            "artifact": "Contract entrypoints and modifiers at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "A reproduced direct call with written steps",
            "tier": "documented (trace)"
          }
        ],
        "common_failures": [
          "Entry point is public but checks a provider signature, so it is not really direct.",
          "Refund path is owner-only."
        ],
        "provenance": "contract"
      },
      {
        "id": "C3",
        "pillar": "C",
        "title": "Hosted intermediary dependence",
        "short": "Reliance on hosted services",
        "question": "Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs?",
        "why_it_matters": "Every required hosted service is a place where access can be withdrawn. Self-hostable code plus a default fallback turns a vendor outage or refusal into an inconvenience rather than a stoppage.",
        "anchors": {
          "0": "Required, closed, single-vendor.",
          "1": "Intermediaries required, only documented, no public code.",
          "2": "Required intermediaries exist and their self-host code is public, but no fallback is configured by default.",
          "3": "No required relayer, paymaster, bundler, or API; or each has a documented self-host path with code in the repo and a fallback provider."
        },
        "verify_with": [
          {
            "artifact": "SDK source at a pinned commit showing hardcoded endpoints",
            "tier": "verified"
          },
          {
            "artifact": "Repository containing the intermediary's code",
            "tier": "verified"
          },
          {
            "artifact": "Config files showing configurable endpoints",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Relayer code is public but the SDK hardcodes the vendor URL with no override."
        ]
      },
      {
        "id": "C4",
        "pillar": "C",
        "title": "Settlement-layer neutrality and disclosed edge filtering",
        "short": "Neutral settlement, disclosed filtering",
        "question": "Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable?",
        "why_it_matters": "Regulated providers often must screen sanctions lists, and an institution should expect them to. What matters is where the screening sits: filtering at the edge, disclosed, with a neutral settlement layer underneath, leaves the rail usable by anyone the law allows. Filtering hidden in the settlement contracts, or undisclosed anywhere, does not.",
        "anchors": {
          "0": "Undisclosed filtering anywhere, or filtering in the settlement contracts without disclosure (also lowers C1).",
          "1": "Edge filtering is disclosed in docs only, or the neutrality of the settlement layer cannot be shown from code.",
          "2": "Settlement contracts are neutral and edge filtering is disclosed, but it cannot be bypassed (C2 below 2).",
          "3": "Settlement contracts contain no address or geographic filtering, and any filtering in the SDK, frontend, or backend is disclosed in code or a versioned repo document, names its list source, and is bypassed by the direct settlement path (C2 at least 2). Requires every required component in the request path to be public, or a trace."
        },
        "verify_with": [
          {
            "artifact": "Search of SDK and frontend at a pinned commit for sanctions lists, IP geolocation calls, country gates",
            "tier": "verified"
          },
          {
            "artifact": "Network trace from a running instance",
            "tier": "documented (trace)"
          }
        ],
        "common_failures": [
          "Screening happens in a closed backend the SDK calls, so the code search finds nothing (score unknown, not 3)."
        ],
        "provenance": "client",
        "absence": true
      },
      {
        "id": "C5",
        "pillar": "C",
        "title": "Inherited freeze exposure disclosed",
        "short": "Token and chain freeze risks disclosed",
        "question": "Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees?",
        "why_it_matters": "A censorship-resistant contract settling in a freezable stablecoin on a centralized sequencer inherits both of those controls. Payees should be told which ones they are accepting.",
        "anchors": {
          "0": "Not enumerated, or misstated.",
          "1": "Enumerated in docs only.",
          "2": "Enumerated in code, assumptions not stated.",
          "3": "Supported tokens and chains enumerated in code and docs, with issuer freeze/blacklist powers and sequencer or forced-inclusion assumptions stated to payees."
        },
        "verify_with": [
          {
            "artifact": "Token allowlist in contracts or SDK config at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "L2BEAT entry for the primary chain (sequencer assumptions)",
            "tier": "documented"
          }
        ],
        "common_failures": [
          "Token list lives only in a hosted API response."
        ]
      },
      {
        "id": "O1",
        "pillar": "O",
        "title": "Contracts verified and matching",
        "short": "Contracts verified onchain",
        "question": "Does the deployed bytecode match public source, and can a third party rebuild it?",
        "why_it_matters": "Unverified bytecode means every other onchain finding is a guess. A full Sourcify match plus a build script lets an auditor confirm that what was reviewed is what is running.",
        "anchors": {
          "0": "Unverified. Incumbents are unknown unless they have contracts.",
          "1": "Some contracts verified.",
          "2": "Verified on an explorer only, or partial match.",
          "3": "All settlement contracts verified on Sourcify (full match) and on an explorer, and the repo contains a build script reproducing the deployed bytecode from a pinned commit."
        },
        "verify_with": [
          {
            "artifact": "Sourcify API response for each address",
            "tier": "verified"
          },
          {
            "artifact": "Explorer verification page",
            "tier": "verified"
          },
          {
            "artifact": "Build script at a pinned commit",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Implementation verified but proxy not, or the reverse."
        ]
      },
      {
        "id": "O2",
        "pillar": "O",
        "title": "Full stack public",
        "short": "Whole stack published",
        "question": "Are the SDK, frontend, backend or API, indexer, and deploy scripts all public?",
        "why_it_matters": "Open contracts with a closed backend still leave you trusting the backend. The public share of the stack is the share you can inspect, fork, or run without asking.",
        "anchors": {
          "0": "Nothing, or a client shell that cannot run without private services.",
          "1": "SDK or contracts only.",
          "2": "Everything except the backend, with the API schema published.",
          "3": "SDK, frontend/widget, backend or API, indexer, and deploy scripts all public."
        },
        "verify_with": [
          {
            "artifact": "The provider's repos list with roles; absence is the finding",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Archived or stale repos counted as the live stack."
        ]
      },
      {
        "id": "O3",
        "pillar": "O",
        "title": "Reproducible self-host",
        "short": "Can be self-hosted",
        "question": "Can a stranger reach a working deployment from the README?",
        "why_it_matters": "Code you cannot run is documentation. A recorded self-host attempt is the only evidence that the walkaway option exists in practice.",
        "anchors": {
          "0": "No path.",
          "1": "Docs exist; reproduction not attempted, or failed with blockers listed.",
          "2": "Reproducible with minor undocumented steps, recorded.",
          "3": "A stranger can reach a working deployment from the README (build steps, env vars, ABIs, addresses, schemas), shown either by a recorded attempt (trace) or by a deploy script in the repo that completes a test payment and has a recorded successful run."
        },
        "verify_with": [
          {
            "artifact": "The reproduction attempt with steps",
            "tier": "documented (trace)"
          },
          {
            "artifact": "README at a pinned commit, for presence of each required element",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Scoring 3 from a README without attempting it. Without a recorded attempt the cap is 1."
        ]
      },
      {
        "id": "O4",
        "pillar": "O",
        "title": "Documented interfaces and export",
        "short": "Interfaces and data export",
        "question": "Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo?",
        "why_it_matters": "Interfaces and exports are what let you integrate without the vendor's SDK and leave with your records intact.",
        "anchors": {
          "0": "None.",
          "1": "Documented only.",
          "2": "ABIs and API schema; export absent or proprietary.",
          "3": "ABIs, event schemas, API schema (OpenAPI or equivalent), and a payee data export in a non-proprietary format, all in the repo."
        },
        "verify_with": [
          {
            "artifact": "Files at a pinned commit",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "API reference only on a hosted docs site, not versioned with the code."
        ]
      },
      {
        "id": "F1",
        "pillar": "F",
        "title": "License of every repo needed to run the product",
        "short": "Open-source licences",
        "question": "Does every repository needed to run the product carry an OSI-approved license?",
        "why_it_matters": "Visible code without a license is not legally forkable. Source-available licenses (BUSL, SSPL, ELv2, Commons Clause) keep the vendor's permission in the loop for exactly the scenario where you need to run without them.",
        "anchors": {
          "0": "No license, or terms requiring provider permission to run a fork.",
          "1": "Source-available (BUSL, SSPL, ELv2, Commons Clause, custom) on a critical repo.",
          "2": "OSI-approved on contracts and SDK; one non-critical repo missing a license or source-available.",
          "3": "OSI-approved license on every repo in repos."
        },
        "verify_with": [
          {
            "artifact": "LICENSE file at a pinned commit, per repo",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "README says \"open source\" with no LICENSE file. That is a claim."
        ]
      },
      {
        "id": "F2",
        "pillar": "F",
        "title": "Relicensing risk and license stability",
        "short": "Protection against relicensing",
        "question": "Can the provider unilaterally relicense future versions, and has it committed not to?",
        "why_it_matters": "A permissive license today can become source-available tomorrow if a CLA assigns the rights. Past relicensing events are the best predictor.",
        "anchors": {
          "0": "CLA permits relicensing with no commitment, or a prior relicense event.",
          "1": "CLA permits relicensing; commitment exists in docs.",
          "2": "No CLA, no commitment.",
          "3": "No CLA, or a CLA that does not permit unilateral relicensing, plus a written license-stability commitment in the repo."
        },
        "verify_with": [
          {
            "artifact": "CLA file and CONTRIBUTING at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "Git history of the LICENSE file",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "CLA enforced by a bot configured outside the repo."
        ]
      },
      {
        "id": "F3",
        "pillar": "F",
        "title": "Open-core dependence",
        "short": "No proprietary dependencies",
        "question": "Does a production deployment need a proprietary plugin or hosted-only service?",
        "why_it_matters": "Open core with a closed production path means the license on the open part does not buy the freedom to run the product.",
        "anchors": {
          "0": "Core cannot run without proprietary components.",
          "1": "Documented that production needs a hosted service with no open alternative.",
          "2": "Optional proprietary components; core works without them.",
          "3": "A production deployment needs no proprietary plugin or hosted-only service."
        },
        "verify_with": [
          {
            "artifact": "Dependency manifests and config at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "The O3 reproduction attempt",
            "tier": "documented (trace)"
          }
        ],
        "common_failures": [
          "Hosted API key required at runtime for a \"self-hosted\" deployment."
        ]
      },
      {
        "id": "P1",
        "pillar": "P",
        "title": "Telemetry, analytics, and error-reporting SDKs",
        "short": "Tracking and analytics",
        "question": "Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting?",
        "why_it_matters": "Analytics in a payment widget sends your customers' browsing and payment behaviour to a third party you have no contract with. It is also an undisclosed data-processing relationship for most compliance regimes.",
        "anchors": {
          "0": "Present and undisclosed, or fingerprinting libraries present.",
          "1": "Present, on by default, disclosed in docs.",
          "2": "Present, off by default, opt-in visible in code.",
          "3": "None in SDK, widget, or frontend manifests and lockfiles, confirmed by trace."
        },
        "verify_with": [
          {
            "artifact": "package.json, lockfile, and initialization code at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "Network trace from a running instance",
            "tier": "documented (trace)"
          }
        ],
        "common_failures": [
          "Sentry or PostHog initialised in the hosted frontend but not in the SDK; score covers both."
        ],
        "provenance": "client",
        "absence": true
      },
      {
        "id": "P2",
        "pillar": "P",
        "title": "Data collected beyond settlement needs",
        "short": "Data collected beyond payment",
        "question": "Does the flow collect anything beyond addresses, amounts, token, and chain?",
        "why_it_matters": "Every extra field collected is a field that can leak, be subpoenaed, or be sold. Settlement needs very little. Regulated rails must collect identity data; the rubric credits collection limited to the legal requirement and disclosed with its basis, and marks down anything beyond it.",
        "anchors": {
          "0": "Undisclosed collection, or collection beyond the stated legal requirement.",
          "1": "Collection beyond settlement needs, disclosed in a policy only.",
          "2": "Additional fields are either optional and clearly optional in code, or legally required, limited to that requirement, and disclosed with their legal basis in code or a versioned repo document.",
          "3": "Only what settlement requires (addresses, amounts, token, chain)."
        },
        "verify_with": [
          {
            "artifact": "API schema and form code at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "Privacy policy (may only lower the score)",
            "tier": "documented"
          }
        ],
        "common_failures": [
          "Treating a regulated card or mobile-money flow's KYC as undisclosed when the policy discloses it."
        ]
      },
      {
        "id": "P3",
        "pillar": "P",
        "title": "Onchain linkability",
        "short": "Payments linkable onchain",
        "question": "What do calldata and events reveal about who paid whom for what?",
        "why_it_matters": "Public chains are permanent. Invoice IDs or payee tags in events let anyone reconstruct a merchant's revenue and customer list.",
        "anchors": {
          "0": "Plaintext metadata (emails, order contents) onchain, or undisclosed linkage.",
          "1": "Invoice IDs or payee tags in events, disclosed.",
          "2": "Minimal linkage, documented.",
          "3": "No payee identifiers, invoice metadata, or payer-payee linkage in calldata or events beyond what settlement needs; fresh addresses or stealth/privacy patterns available."
        },
        "verify_with": [
          {
            "artifact": "Event definitions and calldata encoding at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "Sample transactions on an explorer",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Treating a direct transfer as private; the transfer itself links payer and payee."
        ]
      },
      {
        "id": "P4",
        "pillar": "P",
        "title": "Third-party calls in the payment flow",
        "short": "Third parties in the payment flow",
        "question": "Which third parties see a request during a payment, and can they be swapped out?",
        "why_it_matters": "Indexers, price oracles, and risk vendors in the critical path each see payer addresses and amounts. They are data processors whether or not anyone calls them that.",
        "anchors": {
          "0": "Undisclosed third parties in the flow.",
          "1": "Present, disclosed in docs only.",
          "2": "Third parties present, named in code, swappable by config.",
          "3": "Only the configured RPC; no third-party indexer, risk-scoring, or pricing vendor in the critical path."
        },
        "verify_with": [
          {
            "artifact": "SDK source for endpoints at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "Network trace",
            "tier": "documented (trace)"
          }
        ],
        "common_failures": [
          "Wallet-connect relays and RPC providers forgotten in the inventory."
        ],
        "provenance": "client",
        "absence": true
      },
      {
        "id": "P5",
        "pillar": "P",
        "title": "Configurable endpoints and self-hostable data layer",
        "short": "Endpoints can be changed",
        "question": "Can RPC and indexer URLs be changed, and is the indexer code public?",
        "why_it_matters": "A hardcoded endpoint is both a privacy leak and a censorship point. Configurable endpoints plus public indexer code let an institution keep payment data inside its own perimeter.",
        "anchors": {
          "0": "Hardcoded.",
          "1": "Documented workaround.",
          "2": "Configurable via code or env only.",
          "3": "RPC and indexer URLs configurable in the UI or SDK, and indexer code public."
        },
        "verify_with": [
          {
            "artifact": "Config surface at a pinned commit",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "RPC configurable but indexer hardcoded."
        ]
      },
      {
        "id": "S1",
        "pillar": "S",
        "title": "Custody of funds in flight",
        "short": "Who holds funds in transit",
        "question": "Who holds funds between payer and payee, and can the provider redirect them?",
        "why_it_matters": "Custody in flight is where counterparty risk lives. A direct transfer has none; a provider wallet has all of it.",
        "anchors": {
          "0": "Provider-held, undisclosed, or the provider can redirect funds.",
          "1": "Provider-held wallet or upgradeable escrow, disclosed.",
          "2": "Escrow contract with a provider role bounded by a timelock and a documented exit.",
          "3": "Direct payer-to-payee transfer, or payee-controlled non-upgradeable escrow."
        },
        "verify_with": [
          {
            "artifact": "Fund flow in verified source at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "Balances and roles read onchain",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Bridged or swapped flows where an intermediate contract briefly holds funds and has a sweep function."
        ],
        "provenance": "contract"
      },
      {
        "id": "S2",
        "pillar": "S",
        "title": "Upgrade authority",
        "short": "Who can upgrade the code",
        "question": "Who can change the contract code, and with how much notice?",
        "why_it_matters": "An upgrade key can replace every other guarantee on this page in one transaction. Its holder and delay are the ceiling on how much the rest can be trusted.",
        "anchors": {
          "0": "EOA admin, or undisclosed proxy admin.",
          "1": "Multisig admin, no timelock.",
          "2": "Multisig admin with a timelock, but the timelock is shorter than the user exit, signers are undisclosed, or no notice channel is named.",
          "3": "Non-upgradeable; or the upgrade admin is a Safe of at least 2-of-3 with disclosed signers and no threshold-bypassing module or guard, behind a timelock at least as long as the documented user exit, with a user notice channel named in the repo."
        },
        "verify_with": [
          {
            "artifact": "EIP-1967 admin and implementation slots read onchain",
            "tier": "verified"
          },
          {
            "artifact": "Safe threshold read onchain",
            "tier": "verified"
          },
          {
            "artifact": "Timelock contract read onchain",
            "tier": "verified"
          },
          {
            "artifact": "Safe modules and guard of the admin Safe read onchain",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Checking the proxy admin contract but not who owns it."
        ],
        "provenance": "contract"
      },
      {
        "id": "S3",
        "pillar": "S",
        "title": "Token approval scope requested by the SDK",
        "short": "Token approval scope",
        "question": "How large an allowance does the SDK ask users to grant, and for how long?",
        "why_it_matters": "Unbounded approvals turn any future bug or key compromise in the spender into a drain of every approving wallet.",
        "anchors": {
          "0": "Unbounded, undisclosed.",
          "1": "Unbounded by default, disclosed.",
          "2": "A bounded allowance by default (capped or refilling, limited to one receiver), or exact-amount with an unbounded opt-in clearly labelled in code.",
          "3": "Exact-amount approvals, or Permit2/EIP-2612 with expiry, by default."
        },
        "verify_with": [
          {
            "artifact": "Approval call sites in the SDK at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "A sample approval transaction",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Flows that avoid approvals entirely (plain transfers to a deposit address) scored as unknown rather than assessed."
        ],
        "provenance": "client"
      },
      {
        "id": "S4",
        "pillar": "S",
        "title": "Walkaway test",
        "short": "Funds safe if provider disappears",
        "question": "If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling?",
        "why_it_matters": "This is the question a treasury actually needs answered. It is derived from custody, direct settlement, intermediary dependence, and self-hosting, so it repeats facts scored elsewhere; it is kept in the Security minimum because it is the single question institutions ask first.",
        "anchors": {
          "0": "Funds or access depend on provider liveness.",
          "1": "Funds retrievable only through a documented manual contract call.",
          "2": "Funds retained and retrievable by the user through a verified direct path without the provider; settlement stops.",
          "3": "If the provider disappears, payees retain funds and can keep settling via the C2 path with a public frontend build."
        },
        "verify_with": [
          {
            "artifact": "Derived from S1, C2, C3, O3 evidence; the chain of reasoning is stated in the finding",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Scoring above what the S1, C2, C3, and O3 evidence supports. A score of 2 needs funds provably retrievable without the provider even when settlement stops; state each step."
        ],
        "derived_from": [
          "S1",
          "C2",
          "C3",
          "O3"
        ]
      },
      {
        "id": "S5",
        "pillar": "S",
        "title": "Secret handling in the SDK",
        "short": "Secrets and webhook handling",
        "question": "Are secrets kept out of client bundles and are webhooks signed and verified?",
        "why_it_matters": "Browser-shipped API keys and unsigned webhooks let an attacker impersonate the merchant or forge payment confirmations.",
        "anchors": {
          "0": "API keys shipped to the browser, or unsigned webhooks.",
          "1": "Secrets in client with a disclosed mitigation.",
          "2": "Minor issues documented.",
          "3": "No secrets in client bundles, webhook signatures verified in reference code, keys scoped and rotatable."
        },
        "verify_with": [
          {
            "artifact": "SDK and example code at a pinned commit",
            "tier": "verified"
          },
          {
            "artifact": "Network trace",
            "tier": "documented (trace)"
          }
        ],
        "common_failures": [
          "Publishable \"app IDs\" mistaken for secrets; check what they authorise."
        ],
        "provenance": "client",
        "absence": true
      },
      {
        "id": "S6",
        "pillar": "S",
        "title": "Audits and bug bounty",
        "short": "Audits and bug bounty",
        "question": "Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty?",
        "why_it_matters": "An audit tells you what a competent reviewer found at one commit. Its value depends on whether the deployed code is that commit and whether findings were fixed.",
        "anchors": {
          "0": "None.",
          "1": "Audit report only (documented tier cap).",
          "2": "Audit pinned to a commit, resolutions not individually linked.",
          "3": "Audit report linked, audited commit pinned, each finding's resolution linked to a commit, live bounty program with scope in the repo."
        },
        "verify_with": [
          {
            "artifact": "Audit report PDF",
            "tier": "documented"
          },
          {
            "artifact": "Commit matching the audited hash",
            "tier": "verified"
          },
          {
            "artifact": "Fix commits",
            "tier": "verified"
          }
        ],
        "common_failures": [
          "Audit of a previous version presented as covering the deployed contracts."
        ]
      }
    ]
  },
  "providers": [
    {
      "slug": "aleo",
      "name": "Aleo (credits.aleo private transfers)",
      "type": "transfer",
      "website": "https://aleo.org",
      "primary_chain": {
        "name": "Aleo mainnet",
        "caip2": "aleo:0",
        "basis": "Aleo is its own proof-of-stake chain (BFT validator committee), so the unit is Aleo mainnet as defined by snarkVM v4.11.0 (MAINNET_V0_CONSENSUS_VERSION_HEIGHTS, consensus_heights.rs L165-L190) and the built-in credits.aleo program, whose transfer functions are the settlement path. CAIP-2 id aleo:0 from the registered aleo namespace (ChainAgnostic/namespaces aleo/caip2.md). Mainnet height read via the Provable API: 22,659,198 on 2026-10-09. Excluded: testnet and canary, other deployed programs (token_registry, stablecoins), bridges."
      },
      "repos": [
        {
          "url": "https://github.com/ProvableHQ/snarkOS",
          "role": "backend",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/ProvableHQ/snarkVM",
          "role": "contracts",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/ProvableHQ/sdk",
          "role": "sdk",
          "license": "GPL-3.0"
        },
        {
          "url": "https://github.com/ProvableHQ/leo",
          "role": "sdk",
          "license": "GPL-3.0"
        }
      ],
      "contracts": [],
      "components": [
        {
          "name": "Aleo mainnet consensus (BFT committee of bonded validators)",
          "role": "ledger",
          "public": true,
          "license": "Apache-2.0",
          "operator": "23 validators at 2026-10-09; bonding open at 10M credits",
          "required": true,
          "repo": "https://github.com/ProvableHQ/snarkOS"
        },
        {
          "name": "credits.aleo (built-in program; transfer and fee functions)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "none (changed only by consensus upgrades)",
          "required": true,
          "repo": "https://github.com/ProvableHQ/snarkVM"
        },
        {
          "name": "snarkVM (VM, consensus versions, restrictions list)",
          "role": "other",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Provable (maintainer); run inside every node and client",
          "required": true,
          "repo": "https://github.com/ProvableHQ/snarkVM"
        },
        {
          "name": "snarkOS node and developer CLI (transfer_private)",
          "role": "backend",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user, validators, or any node operator",
          "required": true,
          "repo": "https://github.com/ProvableHQ/snarkOS"
        },
        {
          "name": "Proving parameters (parameters.provable.com, S3 fallback; checksums in snarkVM)",
          "role": "other",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Provable (both download URLs)",
          "required": true,
          "repo": "https://github.com/ProvableHQ/snarkVM"
        },
        {
          "name": "Provable SDK (@provablehq/sdk)",
          "role": "sdk",
          "public": true,
          "license": "GPL-3.0",
          "operator": "user",
          "required": false,
          "repo": "https://github.com/ProvableHQ/sdk"
        },
        {
          "name": "Provable API (api.explorer.provable.com, edge.provable.com), default endpoint",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Provable",
          "required": false
        },
        {
          "name": "Provable delegated proving and record scanning services",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Provable",
          "required": false
        },
        {
          "name": "Consumer wallets (Shield, Leo Wallet, Puzzle); no public source found",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "wallet vendors",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/src/restrictions/mod.rs#L32-L60",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/src/restrictions/mod.rs",
              "detail": "snarkVM carries a consensus-level restrictions registry that can block whole programs, single functions, or specific public or constant argument values (for example an address passed to transfer_public) over block ranges; is_argument_restricted (L237-L290) matches only public and constant inputs and outputs.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/synthesizer/src/restrictions/mod.rs?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | sed -n 32,60p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/parameters/src/mainnet/resources/restrictions.json#L1-L6",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "parameters/src/mainnet/resources/restrictions.json",
              "detail": "The mainnet list is empty (no programs, functions or arguments) at v4.11.0; it has been empty since it was introduced in June 2024 (commits e8e59b7f and e579d0a9).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/parameters/src/mainnet/resources/restrictions.json?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "credits.aleo itself has no admin, pause or blacklist. But the node software has a built-in restrictions list that, once a release containing entries is adopted by the validator committee, makes the chain reject named programs, functions or public argument values such as a specific address, from a chosen block height. The list is empty today. Private transfers cannot be targeted by address because their arguments are encrypted, but the whole transfer_private function could be restricted. Provable maintains the only node implementation we found, and 23 validators decide whether to run a release. Judgment call: there is no key, but an address-level filter is designed into consensus and can be activated by one release with no enforced delay, so we score 1, not 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkOS/blob/493fca395c2c9a103f3f57f1f1aede0a9dae8949/cli/src/commands/developer/transfer_private.rs#L46-L90",
              "commit": "493fca395c2c9a103f3f57f1f1aede0a9dae8949",
              "path": "cli/src/commands/developer/transfer_private.rs",
              "detail": "The snarkOS CLI builds a credits.aleo/transfer_private transaction locally from the user's key, input record and fee record, and broadcasts it to any endpoint given with --endpoint or --broadcast.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkOS/contents/cli/src/commands/developer/transfer_private.rs?ref=493fca395c2c9a103f3f57f1f1aede0a9dae8949\" --jq .content | base64 -d | sed -n 46,90p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L842-L869",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/program/src/resources/credits.aleo",
              "detail": "transfer_private takes the sender's record, a private recipient and a private amount, and outputs a record for the recipient and a change record; no third-party signature is required.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer can build and prove a transfer locally and submit it to any Aleo node, with no Provable service in the path, using the public CLI or SDK. Judgment call: anchor 3 needs onchain evidence about the deployed program, which the dashboard cannot record for Aleo addresses and programs (the schema's address formats do not fit), so we take 2; the deployed credits.aleo matches source (see O1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/parameters/src/mainnet/mod.rs#L25-L42",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "parameters/src/mainnet/mod.rs",
              "detail": "Proving parameters above degree 15 are downloaded from https://parameters.provable.com/mainnet with https://s3.us-west-1.amazonaws.com/mainnet.parameters as fallback; both are Provable-controlled and checksums are in the repo.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/parameters/src/mainnet/mod.rs?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | sed -n 25,42p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/sdk/blob/9bbe5e63b29dcadc93fad29fe4631e8c186ce639/sdk/src/program-manager.ts#L597-L610",
              "commit": "9bbe5e63b29dcadc93fad29fe4631e8c186ce639",
              "path": "sdk/src/program-manager.ts",
              "detail": "The SDK defaults to the Provable API (https://edge.provable.com/api/v2) when no host is passed, and the snarkOS CLI defaults to https://api.explorer.provable.com/v2 (developer/mod.rs L80); both accept any node URL.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No relayer or paymaster is needed, and any snarkOS node can take the transaction. Two things are hosted by Provable by default: the API endpoint, which the user can replace with their own node, and the proving parameters, which every client downloads from Provable's two URLs on first use. The parameter files are checksummed in public code, so a mirror is possible, but none is configured. Scored 2: required intermediaries with public code, no independent fallback by default.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/parameters/src/mainnet/resources/restrictions.json#L1-L6",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "parameters/src/mainnet/resources/restrictions.json",
              "detail": "The consensus restrictions list is empty, so no program, function or argument is filtered at settlement today.",
              "checked_at": "2026-10-09",
              "recheck": "gh search code --repo ProvableHQ/snarkOS country --json path --jq '.[].path'; gh search code --repo ProvableHQ/sdk sanction --json path --jq '.[].path'",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkOS/blob/493fca395c2c9a103f3f57f1f1aede0a9dae8949/cli/src/commands/developer/transfer_private.rs#L46-L90",
              "commit": "493fca395c2c9a103f3f57f1f1aede0a9dae8949",
              "path": "cli/src/commands/developer/transfer_private.rs",
              "detail": "GitHub code search on 2026-10-09 for country and geoip in snarkOS, and country in the SDK, found no client-side gate (SDK hits are licence text and the demo website's terms).",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Settlement is neutral today: the consensus restrictions list is empty and credits.aleo has no address checks. Its existence is disclosed in code, and it would apply at the settlement layer, where no direct path could bypass it (scored under C1). We found no edge filtering in the node, CLI or SDK. The hosted Provable API and the closed consumer wallets may filter, and we could not inspect them. Judgment call: 2, not 3, because 3 needs a distributed-package or trace record and because the settlement layer carries a filtering mechanism, even if empty.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L842-L869",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/program/src/resources/credits.aleo",
              "detail": "The unit's asset is Aleo credits held as private records or public account balances in credits.aleo; there is no issuer freeze and no sequencer.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/synthesizer/program/src/resources/credits.aleo?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | grep -n '^function'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Native credits have no issuer freeze, and the chain has a validator committee rather than a sequencer. Other tokens on Aleo, including stablecoin programs that Provable publishes as compliant-stablecoin examples, are out of scope here and may carry freeze lists. Neither the CLI nor the SDK tells payees about the committee or restrictions-list assumptions. Scored 2: enumerated in code, assumptions not stated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L1-L60",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/program/src/resources/credits.aleo",
              "detail": "The credits.aleo program text served for mainnet by the Provable API on 2026-10-09 is token-for-token identical to this file once comments are removed (1,471 tokens each).",
              "checked_at": "2026-10-09",
              "recheck": "diff <(curl -s https://api.explorer.provable.com/v1/mainnet/program/credits.aleo | jq -r . | perl -0pe 's#/\\*.*?\\*/##sg;s#//[^\\n]*##g' | tr -s ' \\t\\n' '\\n' | grep .) <(gh api \"repos/ProvableHQ/snarkVM/contents/synthesizer/program/src/resources/credits.aleo?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | perl -0pe 's#/\\*.*?\\*/##sg;s#//[^\\n]*##g' | tr -s ' \\t\\n' '\\n' | grep .) && echo identical",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Aleo programs are stored onchain as Aleo instructions, so source and deployment can be compared directly; credits.aleo matches the snarkVM source. Sourcify does not cover Aleo, and we read the deployed program through Provable's hosted API rather than our own node. Judgment call: a full source match through an explorer-style API is anchor 2; anchor 3 is defined by Sourcify and a rebuild script, which do not apply.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkOS/tree/493fca395c2c9a103f3f57f1f1aede0a9dae8949/node/rest",
              "commit": "493fca395c2c9a103f3f57f1f1aede0a9dae8949",
              "path": "node/rest",
              "detail": "Node and REST API (snarkOS@493fca39, v4.11.0), VM and credits.aleo (snarkVM@29343ebb), and SDK (sdk@9bbe5e63, v0.12.0) are public; the hosted explorer API and the consumer wallets were not found in any public repository.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"orgs/ProvableHQ/repos?per_page=100\" --jq '.[]|[.name,(.license.spdx_id//\"none\"),.archived]|@tsv'"
            }
          ],
          "finding": "The node, VM, settlement program, CLI and SDK are public, and the node's REST API is in its source. The hosted indexer and explorer API that the SDK and CLI use by default, and every consumer wallet we know of, have no public source. Scored 2: everything a user strictly needs is public, but the default backend and the usual frontends are not.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkOS/blob/493fca395c2c9a103f3f57f1f1aede0a9dae8949/README.md#L43-L190",
              "commit": "493fca395c2c9a103f3f57f1f1aede0a9dae8949",
              "path": "README.md",
              "detail": "The snarkOS README covers requirements, installation, ports and running a client, validator or prover.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Build and run documentation exists for the node. Reproduction not attempted, so the score is capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L842-L940",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/program/src/resources/credits.aleo",
              "detail": "The settlement program's interface (functions, inputs, records, mappings, finalize logic) is in the repo; the node's REST routes are defined in snarkOS node/rest/src/lib.rs.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkOS/contents/node/rest/src/lib.rs?ref=493fca395c2c9a103f3f57f1f1aede0a9dae8949\" --jq .content | base64 -d | grep -n 'route('",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The program interface and the node API are versioned in the repos. We found no payee export format in the CLI or SDK. Scored 2: interfaces present, export absent.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/LICENSE.md",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "LICENSE.md",
              "detail": "snarkVM and snarkOS are Apache-2.0; the SDK and Leo are GPL-3.0.",
              "checked_at": "2026-10-09",
              "recheck": "for r in snarkOS snarkVM sdk leo; do echo $r $(gh api repos/ProvableHQ/$r --jq '.license.spdx_id'); done",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every listed repository, including all required ones (node, VM and settlement program), carries an OSI-approved licence. Closed components (hosted API, proving and scanning services, consumer wallets) are optional.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/LICENSE.md",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "LICENSE.md",
              "detail": "snarkVM's licence changed from GPL to Apache-2.0 in commit b8cd7cbc (2023-05-21) and snarkOS's in 2f449c59 the same day; no CLA appears in either repo's CONTRIBUTING or workflows.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/commits?path=LICENSE.md&per_page=10\" --jq '.[]|[.sha[0:8],.commit.author.date,.commit.message[0:60]]|@tsv'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no CLA and no written licence-stability commitment. The node and VM were relicensed from GPL to Apache-2.0 in May 2023, which widened rights but shows the maintainer can change the licence of future versions. Judgment call: anchor 0 names any prior relicense event; under the take-the-lower-anchor rule we score 0, though the change was permissive.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/parameters/src/mainnet/mod.rs#L25-L42",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "parameters/src/mainnet/mod.rs",
              "detail": "The only hosted dependency on the required path is the proving-parameter download, which is public, Apache-licensed data checked against hashes in the repo.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/parameters/src/mainnet/mod.rs?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | sed -n 25,42p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A production deployment (own node, CLI or SDK) needs no proprietary software. The proving parameters are fetched from Provable's hosts but are open data that can be mirrored. The hosted API, delegated proving and record scanning are optional. Judgment call: 2, since we made no O3 reproduction and the parameter hosting has no independent default.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/sdk/blob/9bbe5e63b29dcadc93fad29fe4631e8c186ce639/sdk/package.json#L1-L80",
              "commit": "9bbe5e63b29dcadc93fad29fe4631e8c186ce639",
              "path": "sdk/package.json",
              "detail": "The SDK's runtime dependencies are @provablehq/wasm, @scure/base, @serenity-kit/noble-sodium, comlink, core-js, mime and xmlhttprequest-ssl, with no analytics or error reporting; snarkOS validator telemetry is local metrics exposed on the node's own REST API.",
              "checked_at": "2026-10-09",
              "recheck": "npm view @provablehq/sdk@0.12.0 dependencies",
              "package": {
                "name": "@provablehq/sdk",
                "version": "0.12.0",
                "integrity": "sha512-xGOteR7nRF2Vx/6HUG8oB7tQ9myWLdINGC7dPfHgl/U1MQA4/eZTA+2+42700pxBo8UdFq5K1EdLoUpKlh9VIQ=="
              },
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "The SDK, CLI and node ship no third-party analytics. The SDK's demo website imports Amplitude, but its init call is commented out, and the website is not on the payment path. The closed consumer wallets were not inspected. Judgment call: absence shown in code and the published package, with no trace, is capped at 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L842-L869",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/program/src/resources/credits.aleo",
              "detail": "transfer_private takes only a record, a recipient and an amount; the fee functions add only the fee amount and an execution id.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/synthesizer/program/src/resources/credits.aleo?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | sed -n 842,869p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The protocol collects only what settlement needs. No required component holds account or identity data. Optional Provable services see more: the hosted API sees the submitting IP, and the record-scanning service, if used, needs the user's view key.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L842-L940",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/program/src/resources/credits.aleo",
              "detail": "transfer_private keeps sender, recipient and amount private (encrypted records); transfer_private_to_public and transfer_public_to_private reveal one side and the amount, as the program comments state.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/synthesizer/program/src/resources/credits.aleo?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | sed -n 842,940p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/sdk/blob/9bbe5e63b29dcadc93fad29fe4631e8c186ce639/sdk/src/program-manager.ts#L3266-L3315",
              "commit": "9bbe5e63b29dcadc93fad29fe4631e8c186ce639",
              "path": "sdk/src/program-manager.ts",
              "detail": "The SDK's transfer builder makes the caller choose the transfer type and whether to pay the fee from a private record or the public balance.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A transfer_private with a private fee reveals no payer, payee or amount onchain; the program and function name, timing and transaction size are visible. Paying the fee publicly (fee_public) reveals the payer's address, and public transfers are fully transparent; both are explicit choices in the SDK and CLI. The anonymity set depends on how much activity uses records, which we do not score. Judgment call: we score what the protocol offers for a private transfer, which is anchor 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/sdk/blob/9bbe5e63b29dcadc93fad29fe4631e8c186ce639/sdk/src/program-manager.ts#L597-L610",
              "commit": "9bbe5e63b29dcadc93fad29fe4631e8c186ce639",
              "path": "sdk/src/program-manager.ts",
              "detail": "The default host (edge.provable.com) is named in code and replaced by passing a host; the network client also takes optional prover and record-scanner URIs (network-client.ts L120-L124).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/sdk/contents/sdk/src/program-manager.ts?ref=9bbe5e63b29dcadc93fad29fe4631e8c186ce639\" --jq .content | base64 -d | sed -n 597,610p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "By default the SDK and CLI query and broadcast through Provable's API, which sees the user's IP, the records they look up and the transactions they submit; the parameter host sees downloads. All are named in code and swappable for a self-run node. Optional delegated proving and record scanning send more (an authorization or a view key) to Provable. Scored 2: third parties present, named in code, swappable by config.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkOS/blob/493fca395c2c9a103f3f57f1f1aede0a9dae8949/cli/src/commands/developer/transfer_private.rs#L60-L80",
              "commit": "493fca395c2c9a103f3f57f1f1aede0a9dae8949",
              "path": "cli/src/commands/developer/transfer_private.rs",
              "detail": "The CLI takes --endpoint for queries and --broadcast for submission; the SDK takes a host argument; the node that serves both is public (snarkOS node/rest).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkOS/contents/cli/src/commands/developer/transfer_private.rs?ref=493fca395c2c9a103f3f57f1f1aede0a9dae8949\" --jq .content | base64 -d | sed -n 60,80p"
            }
          ],
          "finding": "The RPC and data endpoint is configurable in the SDK and CLI, and the node that provides it is public. Scored 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L842-L869",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/program/src/resources/credits.aleo",
              "detail": "transfer_private consumes the sender's record and creates a record owned by the recipient in the same transition; no escrow or third party holds funds.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/synthesizer/program/src/resources/credits.aleo?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | sed -n 842,869p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Value moves directly from the payer's record to a record the payee owns. No one holds funds in flight. Judgment call: anchor 3 in substance, but 3 needs onchain evidence the schema cannot carry for Aleo, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/console/network/src/consensus_heights.rs#L165-L190",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "console/network/src/consensus_heights.rs",
              "detail": "Mainnet has had 21 consensus versions since launch, the latest (V21) at height 22,437,000 with a comment giving its target time (2026-10-01 21:00 UTC); V22 is reserved. The Provable API reported height 22,659,198 on 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/console/network/src/consensus_heights.rs?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | sed -n 165,190p; curl -s https://api.explorer.provable.com/v1/mainnet/block/height/latest"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L230-L245",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/program/src/resources/credits.aleo",
              "detail": "Joining the committee needs at least 10M credits delegated (L242); the committee read through the Provable API on 2026-10-09 had 23 members, 21 open to delegation, about 1.05 billion credits bonded.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "credits.aleo and the consensus rules change only through snarkVM releases with fixed activation heights, which the 23 validators must run. Provable maintains the only implementation we found, and it has shipped 21 consensus versions in about two years, each activated at a block height fixed in the release; we did not check how far ahead each release shipped. There is no enforced delay or user-exit window. Judgment call: notice exists through heights fixed in releases (V21 carried a target date in code), so we take 2, as for other own-chain protocols; 3 would also need onchain evidence the schema cannot carry. The restrictions list is scored under C1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L776-L870",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "synthesizer/program/src/resources/credits.aleo",
              "detail": "credits.aleo has no approve or allowance function; every transfer is executed by the owner's key (self.caller, self.signer or record ownership).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/synthesizer/program/src/resources/credits.aleo?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | grep -n '^function'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There are no allowances for native credits; each payment is executed by the owner, so nothing can pull funds later. Judgment call: better than exact-amount approvals in substance, but 3 needs a distributed-package or trace record, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/parameters/src/mainnet/mod.rs#L25-L42",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "path": "parameters/src/mainnet/mod.rs",
              "detail": "Every execution, including a withdrawal of one's own credits, needs proving parameters that clients download only from Provable's two URLs unless already cached.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/parameters/src/mainnet/mod.rs?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | sed -n 25,42p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=2 (anchor 3 in substance), C2=2, C3=2 and O3=1. Funds are records or balances under the user's key (S1), and any node accepts a transaction (C2). But spending needs proving parameters that the code fetches only from Provable-run hosts (C3); if Provable disappeared, a user without a cached copy would need to obtain the files elsewhere and check them against the published hashes, a manual step no repo documents. We did not reproduce a self-hosted setup (O3=1). Judgment call: funds are retrievable without Provable only by that undocumented manual step, so we score 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ProvableHQ/sdk/blob/9bbe5e63b29dcadc93fad29fe4631e8c186ce639/sdk/src/network-client.ts#L36-L72",
              "commit": "9bbe5e63b29dcadc93fad29fe4631e8c186ce639",
              "path": "sdk/src/network-client.ts",
              "detail": "The SDK accepts an optional API key or JWT for Provable's gateway, supplied by the integrator; none is bundled.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ProvableHQ/sdk/contents/sdk/src/network-client.ts?ref=9bbe5e63b29dcadc93fad29fe4631e8c186ce639\" --jq .content | base64 -d | sed -n 36,72p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Private keys stay with the user; the protocol has no webhooks. The SDK supports an optional gateway API key or JWT, which an integrator could ship in a browser bundle; the SDK does not do so itself. Using the optional record-scanning service hands a view key to Provable. Judgment call: 2, since 3 needs a package or trace record and the optional services widen key exposure.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "finding": "We found no audit report pinned to a commit in snarkVM, snarkOS or the SDK; snarkVM's SECURITY.md (L1-L11) asks for reports by GitHub issue or email and mentions no bounty. External audits and bounty programmes are known by reputation only, which we do not score.",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "The protocol has no country rule, and the consensus restrictions list (which could block programs, functions or public argument values, not countries) is empty. The node, CLI and SDK contain no country or IP-geolocation gate in GitHub code search on 2026-10-09. The hosted Provable API and the consumer wallets (Shield, Leo Wallet, Puzzle) are closed, so we could not check them for geoblocking, and we found no first-party country list for them. Legality of use varies by jurisdiction; that is not an availability restriction by the protocol.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/parameters/src/mainnet/resources/restrictions.json#L1-L6",
            "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
            "path": "parameters/src/mainnet/resources/restrictions.json",
            "detail": "The mainnet restrictions list is empty.",
            "checked_at": "2026-10-09",
            "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/parameters/src/mainnet/resources/restrictions.json?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/ProvableHQ/snarkOS/blob/493fca395c2c9a103f3f57f1f1aede0a9dae8949/cli/src/commands/developer/transfer_private.rs#L46-L90",
            "commit": "493fca395c2c9a103f3f57f1f1aede0a9dae8949",
            "path": "cli/src/commands/developer/transfer_private.rs",
            "detail": "The reference CLI transfer has no location check; code search of snarkOS for country and geoip returns nothing.",
            "checked_at": "2026-10-09",
            "recheck": "gh search code --repo ProvableHQ/snarkOS country --json path --jq '.[].path'"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: Aleo mainnet credits.aleo transfers, private path. Pins: snarkVM@29343ebb (v4.11.0), snarkOS@493fca39 (v4.11.0), sdk@9bbe5e63 (v0.12.0). Aleo addresses (aleo1..., bech32, 63 characters) and program IDs do not fit the schema's address formats, so chain reads (height, committee, deployed credits.aleo) were made through the Provable API and are recorded in repo evidence details with curl rechecks; C1, C2, S1 and S2 are capped accordingly. No transactions, node runs, builds, traces or self-host attempts were made.",
      "audits": {
        "searched": "Aleo's Security Audits docs page (source in github.com/AleoNet/aleo-docs-source, learn/reference/security-audits.mdx; developer.aleo.org returned a Cloudflare challenge and was not bypassed), the Aleo Foundation post \"Aleo completes security audits of snarkOS & snarkVM\", the repos of ProvableHQ/snarkVM, snarkOS, sdk and leo (no audits folder), github.com/trailofbits/publications, reports.zksecurity.xyz, and Veridise's audit archive. NCC Group published two Aleo reports (snarkVM implementation review, 2023-12-13; snarkOS implementation and consensus review, 2024-02-08) at research.nccgroup.com, linked from the Aleo post; they are listed from that post's links and public summaries because every NCC URL returned 403 to scripted requests, so their findings counts were not read. Provable's formal-verification and fuzzing blog posts are not reports. Third-party Leo programs (Demox, Hyperlane, Sealance, Venture23) are out of scope. No published audit of the Provable SDK or Leo was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "zkSecurity",
            "date": "2025-11-19",
            "type": "audit",
            "scope": "snarkVM dynamic dispatch (call.dynamic instruction) added to the VM",
            "url": "https://reports.zksecurity.xyz/reports/aleo-dynamic-dispatch/",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "partly",
            "findings": "1 medium, 1 low",
            "note": "Feature audit; call.dynamic is present in snarkVM's main branch, which has changed since. No audited commit stated."
          },
          {
            "auditor": "zkSecurity",
            "date": "2025-10-06",
            "type": "audit",
            "scope": "snarkVM serialization, hash and ECDSA instructions (feat/bytes branch), usable in finalize",
            "url": "https://reports.zksecurity.xyz/reports/aleo-ecdsa-bytes/",
            "commit": "41d32c5f",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "partly",
            "findings": "3 medium, 2 low, 1 informational",
            "note": "Feature audit of a branch later merged; not specific to the credits.aleo transfer functions."
          },
          {
            "auditor": "zkSecurity",
            "date": "2025-06-14",
            "type": "audit",
            "scope": "snarkVM program upgradability update",
            "url": "https://reports.zksecurity.xyz/reports/aleo-upgradability/",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "partly",
            "findings": "2 high, 3 medium, 1 low; fixes verified by the auditor",
            "note": "Commissioned by Provable. Feature audit; snarkVM has had many releases since."
          },
          {
            "auditor": "zkSecurity",
            "date": "2024-06-10",
            "type": "review",
            "scope": "ARC-0041 validator activation changes, including a full review of credits.aleo (transfer, fee and staking functions) and related finalize, rewards and committee helpers in snarkVM",
            "url": "https://reports.zksecurity.xyz/reports/aleo-arc41/",
            "commit": "0f382b6a2b553385eb53f3cb6869f2bc1039feb6",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "partly",
            "findings": "No security issues found",
            "note": "The closest review of the credits.aleo program the rating covers; credits.aleo has changed in later consensus upgrades."
          },
          {
            "auditor": "Veridise",
            "date": "2024-06-07",
            "type": "audit",
            "scope": "Demox Labs' arc0038 staking program plus changes to credits.aleo and finalize.rs in snarkVM PRs 2402 and 2406",
            "url": "https://veridise.com/wp-content/uploads/2024/08/VAR_Demox_Labs_V101.pdf",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "partly",
            "findings": "No findings",
            "note": "Commissioned by Demox Labs; only the two credits.aleo change sets are Aleo protocol code."
          },
          {
            "auditor": "zkSecurity",
            "date": "2024-04-08",
            "type": "audit",
            "scope": "Aleo synthesis puzzle (snarkVM) and its snarkOS integration",
            "url": "https://reports.zksecurity.xyz/reports/aleo-puzzle/",
            "commit": "14b03f5ec129991a0277c7d12d3fdd7ef86f8076",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "partly",
            "findings": "6 informational"
          },
          {
            "auditor": "zkSecurity",
            "date": "2024-03-18",
            "type": "review",
            "scope": "ARC-0037 withdrawal-address mapping added to credits.aleo (snarkVM PR 2385)",
            "url": "https://reports.zksecurity.xyz/reports/aleo-arc37/",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "partly",
            "findings": "No issues found",
            "note": "Two-day review of one change set."
          },
          {
            "auditor": "NCC Group",
            "date": "2024-02-08",
            "type": "audit",
            "scope": "snarkOS implementation and consensus mechanism (partially synchronous Bullshark BFT over a DAG), reviewed November 2023 with a retest in January 2024",
            "url": "https://research.nccgroup.com/2024/02/08/public-report-aleo-snarkos-implementation-and-consensus-mechanism-review/",
            "repo": "https://github.com/ProvableHQ/snarkOS",
            "blocked_to_bots": true,
            "covers_deployed": "partly",
            "note": "Linked from the Aleo Foundation post https://aleo.org/post/aleo-completes-security-audits-of-snarkos-and-snarkvm/; returns 403 to scripted requests, so findings were not read. Pre-mainnet snarkOS; mainnet runs v4.11.0."
          },
          {
            "auditor": "NCC Group",
            "date": "2023-12-13",
            "type": "audit",
            "scope": "snarkVM implementation review (testnet3-audit-ncc branch), including the synthesizer and the algorithms (proof system) module, with a retest a few months later",
            "url": "https://research.nccgroup.com/2023/12/13/public-report-aleo-snarkvm-implementation-review/",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "blocked_to_bots": true,
            "covers_deployed": "partly",
            "note": "Linked from the Aleo Foundation post https://aleo.org/post/aleo-completes-security-audits-of-snarkos-and-snarkvm/; returns 403 to scripted requests, so findings and the audited commit were not read. Pre-mainnet snarkVM; mainnet runs v4.11.0."
          },
          {
            "auditor": "Trail of Bits",
            "date": "2023-11-28",
            "type": "audit",
            "scope": "snarkVM (testnet3-audit-tob branch), snarkOS and its Narwhal/Bullshark BFT consensus",
            "url": "https://github.com/trailofbits/publications/blob/master/reviews/2023-10-aleo-securityreview.pdf",
            "commit": "9fcb15fc501ae9734b1a8fe513b90a2e8f9cda5f",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "partly",
            "findings": "1 medium, 4 low, 23 informational, 3 undetermined",
            "note": "Pre-mainnet (testnet3) code; the commit is the snarkVM target, snarkOS was reviewed at dc0c10b0 and narwhal branches. Mainnet runs snarkVM/snarkOS v4.11.0."
          },
          {
            "auditor": "zkSecurity",
            "date": "2023-10-30",
            "type": "audit",
            "scope": "snarkOS consensus (AleoBFT, Bullshark/Narwhal) on the testnet3-audit-zks branch",
            "url": "https://reports.zksecurity.xyz/reports/aleo-consensus/",
            "commit": "9234cbee73666c7e6d00dfbdbcb947a244a43818",
            "repo": "https://github.com/ProvableHQ/snarkOS",
            "covers_deployed": "partly",
            "findings": "4 high, 1 medium, 1 low, 2 informational; fixes reviewed in February 2024",
            "note": "Pre-mainnet code; snarkOS has changed substantially since."
          },
          {
            "auditor": "zkSecurity",
            "date": "2023-10-02",
            "type": "audit",
            "scope": "snarkVM synthesizer (testnet3-audit-zks branch)",
            "url": "https://reports.zksecurity.xyz/reports/aleo-synthesizer/",
            "commit": "9f5246d8c28afc0aef769b723eeaa4ec4a402b9c",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "partly",
            "findings": "6 high, 2 informational",
            "note": "Pre-mainnet code."
          },
          {
            "auditor": "Trail of Bits",
            "date": "2022-10-03",
            "type": "audit",
            "scope": "snarkVM (console, algorithms and related crates) for Aleo Systems",
            "url": "https://github.com/trailofbits/publications/blob/master/reviews/2022-09-aleosystems-snarkvm-securityreview.pdf",
            "commit": "62de4cfe5a7fabb68b14d0175e922c5414ec19a8",
            "repo": "https://github.com/ProvableHQ/snarkVM",
            "covers_deployed": "no",
            "findings": "2 medium, 6 low, 21 informational",
            "note": "2022 snarkVM, superseded by the testnet3 rewrite and later mainnet releases."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 1,
          "limiting": [
            "C1"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F2"
          ]
        },
        "P": {
          "score": 2,
          "limiting": [
            "P1",
            "P4"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 18,
        "short": 4,
        "unk": 1,
        "total": 23
      }
    },
    {
      "slug": "anoma-pay",
      "name": "AnomaPay",
      "type": "transfer",
      "website": "https://anomapay.app",
      "primary_chain": {
        "name": "BNB Chain",
        "chain_id": 56,
        "basis": "Anoma's launch post and press release (2 Apr 2026) put the AnomaPay public beta on BNB Chain, and pa-evm bindings/src/addresses.rs (L32-L35) and the forwarder's addresses.rs map BinanceSmartChain to protocol adapter 0xFC44…2B68 and ERC20 forwarder 0xDe6A…840e. Unit: those two contracts and the RISC Zero verifier they call. Excluded: deployments on Ethereum, Base, Optimism, Arbitrum, Monad, Stable, MegaETH and Aurora (Base had a private beta), and the Solana adapter."
      },
      "repos": [
        {
          "url": "https://github.com/anoma/pa-evm",
          "role": "contracts",
          "license": "MIT"
        },
        {
          "url": "https://github.com/anoma/anomapay-erc20-forwarder",
          "role": "contracts",
          "license": "MIT"
        },
        {
          "url": "https://github.com/anoma/anoma-app-sdk",
          "role": "sdk",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/anoma/arm-risc0",
          "role": "sdk",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/anoma/anomapay-erc20-resource",
          "role": "sdk",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
          "chain_id": 56,
          "role": "Protocol Adapter v1.1.0 (settlement, proof verification)",
          "verified": "sourcify"
        },
        {
          "address": "0xDe6A308ed57AF26BFf059e6C550BD4908aC1840e",
          "chain_id": 56,
          "role": "ERC20 Forwarder v1.0.1 (holds wrapped tokens)",
          "verified": "sourcify"
        },
        {
          "address": "0x7C1B7b8fEB636eA9Ecd32152Bce2744a0EEf39C7",
          "chain_id": 56,
          "role": "RISC Zero verifier router",
          "verified": "sourcify"
        },
        {
          "address": "0xBbcD45801a3c3B858fbc66674FE7c9f94e33dC72",
          "chain_id": 56,
          "role": "RISC Zero verifier (estop) for selector 0x73c457ba",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Protocol Adapter v1.1.0 (non-upgradeable)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "Anoma Foundation Safe 0xE908…Da10 (3-of-5) holds emergencyStop",
          "required": true,
          "repo": "https://github.com/anoma/pa-evm"
        },
        {
          "name": "ERC20 Forwarder (holds deposited tokens; emergency migratable)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "Emergency committee Safe 0xc703…d6C4 (3-of-5, same owners)",
          "required": true,
          "repo": "https://github.com/anoma/anomapay-erc20-forwarder"
        },
        {
          "name": "RISC Zero verifier router and estop verifier",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "RISC Zero router; verifier estop owned by the Anoma Safe 0xE908…Da10",
          "required": true,
          "repo": "https://github.com/risc0/risc0-ethereum"
        },
        {
          "name": "Uniswap Permit2 (deposit authorisation)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "none (immutable)",
          "required": true,
          "repo": "https://github.com/Uniswap/permit2"
        },
        {
          "name": "Anoma Resource Machine proving library (arm-risc0)",
          "role": "sdk",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user or proving service",
          "required": true,
          "repo": "https://github.com/anoma/arm-risc0"
        },
        {
          "name": "AnomaPay ERC20 resource logic and circuits",
          "role": "sdk",
          "public": true,
          "license": "none",
          "operator": "user or proving service",
          "required": true,
          "repo": "https://github.com/anoma/anomapay-erc20-resource"
        },
        {
          "name": "anoma-app-sdk (keys, transfer building, API clients)",
          "role": "sdk",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user's client",
          "required": true,
          "repo": "https://github.com/anoma/anoma-app-sdk"
        },
        {
          "name": "Transaction and Proving Service (backend.anoma.money)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Anoma Foundation",
          "required": true
        },
        {
          "name": "Vast.ai GPU datacenters running the prover",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Vast.ai",
          "required": true
        },
        {
          "name": "AnomaPay Indexer (encrypted resource discovery)",
          "role": "indexer",
          "public": false,
          "license": "proprietary",
          "operator": "Anoma Foundation",
          "required": true
        },
        {
          "name": "Envio GraphQL endpoint (public nullifier index)",
          "role": "indexer",
          "public": false,
          "license": "proprietary",
          "operator": "Envio (hosted)",
          "required": true
        },
        {
          "name": "AnomaPay web app (anomapay.app; source repo not public)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Anoma Foundation",
          "required": false
        },
        {
          "name": "BNB Smart Chain and a JSON-RPC endpoint",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "BNB Chain validators; RPC chosen by the client",
          "required": true,
          "repo": "https://github.com/bnb-chain/bsc"
        }
      ],
      "scores": {
        "C1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/pa-evm/blob/e368e2738df6a28f1b7577215da6789283952cba/contracts/src/ProtocolAdapter.sol#L108-L136",
              "commit": "e368e2738df6a28f1b7577215da6789283952cba",
              "path": "contracts/src/ProtocolAdapter.sol",
              "detail": "At tag contracts/v1.1.0 (identical to the Sourcify source of 0xFC44…2B68), emergencyStop() is onlyOwner and pauses the adapter permanently (there is no unpause); isEmergencyStopped() also returns true if the RISC Zero verifier is paused. execute() is whenNotPaused, so a stop halts deposits, transfers and withdrawals.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
              "address": "0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
              "block_number": 126599882,
              "detail": "owner() is the Safe 0xE9082Ac8Aa2Fb27DEfDBAC604921C196b884Da10 and isEmergencyStopped() is false at block 126599882; the RISC Zero verifier 0xBbcD…dC72 behind selector 0x73c457ba is also owned by that Safe.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68 \"owner()(address)\" --rpc-url https://bsc-rpc.publicnode.com",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000e9082ac8aa2fb27defdbac604921c196b884da10"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0xE9082Ac8Aa2Fb27DEfDBAC604921C196b884Da10",
              "address": "0xE9082Ac8Aa2Fb27DEfDBAC604921C196b884Da10",
              "block_number": 126599882,
              "detail": "The Safe has threshold 3 of 5 owners (0x6FAE…1A29, 0x0f3f…0bfA, 0x2218…2eAb, 0x95Ce…0507, 0x3db4…28bf), no modules, and a zero guard slot.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xE9082Ac8Aa2Fb27DEfDBAC604921C196b884Da10 \"getThreshold()(uint256)\" --rpc-url https://bsc-rpc.publicnode.com",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000003"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A 3-of-5 Safe with no modules or guard can stop the protocol adapter for good, and it also owns the RISC Zero verifier whose pause stops the adapter. There is no timelock, and we found no public list of signers. The stop is global, not per-address. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/pa-evm/blob/e368e2738df6a28f1b7577215da6789283952cba/contracts/src/ProtocolAdapter.sol#L108-L112",
              "commit": "e368e2738df6a28f1b7577215da6789283952cba",
              "path": "contracts/src/ProtocolAdapter.sol",
              "detail": "execute(transaction) is external with no caller check; validity rests on RISC Zero proofs, which arm-risc0 (Apache-2.0) and anomapay-erc20-resource can produce.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/anoma/pa-evm/contents/contracts/src/ProtocolAdapter.sol?ref=e368e2738df6a28f1b7577215da6789283952cba\" --jq .content | base64 -d | sed -n 108,112p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/transfers",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The SDK docs route mint, transfer and burn through the hosted proving backend.",
              "checked_at": "2026-10-09",
              "quote": "submitted to the proving backend via TransferBackendClient.transfer()",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
              "address": "0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
              "block_number": 126599882,
              "detail": "The adapter is not a proxy (EIP-1967 implementation slot zero) and its Sourcify source equals pa-evm contracts/v1.1.0.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Anyone can submit a valid transaction to the adapter, so settlement without Anoma is possible in principle, and the docs say users may run the off-chain infrastructure themselves. But the documented client flow submits every mint, transfer and burn to the hosted proving backend, and no public client builds and proves a transaction end to end. Judgment call: 2, possible but undocumented, reconstructable from verified source.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/api-clients",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The SDK's API clients talk to the proving backend, the Indexer and an Envio GraphQL endpoint.",
              "checked_at": "2026-10-09",
              "quote": "Fetches encrypted resource blobs from the Indexer",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/anoma-pay-protocol-adapter",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The docs state users may run the off-chain services themselves.",
              "checked_at": "2026-10-09",
              "quote": "Any user can decide to run the off-chain infrastructure themselves",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The transaction service, prover and indexer are required in the documented flow and are run by Anoma; none of their code is among the anoma GitHub org's public repos. The docs say users can run this infrastructure themselves, but no code or fallback is published. Scored 1: required, documented, no public code.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/anomapay-erc20-forwarder/blob/916cc7ed960f443f7cce82bd517ab8505519cd1e/contracts/src/ERC20Forwarder.sol#L98-L171",
              "commit": "916cc7ed960f443f7cce82bd517ab8505519cd1e",
              "path": "contracts/src/ERC20Forwarder.sol",
              "detail": "Wrap and unwrap check only the Permit2 signature, amounts and balances; neither the forwarder nor the adapter checks addresses or countries.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/anoma-pay-trust-model",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The trust-model page says the proving service operator runs compliance checks.",
              "checked_at": "2026-10-09",
              "quote": "The proving service operator implements consistent checks in order to ensure full compliance",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anomapay.app/terms-and-conditions",
              "detail": "The terms say the Foundation does not monitor transactions, and reserve geo-restriction.",
              "checked_at": "2026-10-09",
              "quote": "The Foundation does not perform transaction monitoring",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement contracts are neutral. Filtering, if any, sits in the closed proving service: the docs say its operator \"implements consistent checks\" for KYC and AML, while the terms say the Foundation does not monitor transactions. No list source is named and no code is public, and the direct path is not practically available (C2). Scored 1: disclosed in documents only, and the two documents disagree.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/api-clients",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The SDK docs enumerate fee tokens USDC, USDT, WETH and XAN; the forwarder accepts any ERC20 (no token list in code).",
              "checked_at": "2026-10-09",
              "quote": "\"USDC\" | \"USDT\" | \"WETH\" | \"XAN\"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Supported tokens appear only in documentation and the launch post (ETH, USDC, USDT, XAN, with a $500 beta deposit cap claimed there); the forwarder holds whatever ERC20 is wrapped. No statement to payees about issuer freeze powers or BNB Chain's validator set. Scored 1: enumerated in docs only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
              "address": "0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
              "block_number": 126599882,
              "detail": "Sourcify returns match (creation and runtime) for the adapter, the forwarder 0xDe6A…840e, the RISC Zero router 0x7C1B…39C7 and the verifier 0xBbcD…dC72; none is an exact_match.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68 0xDe6A308ed57AF26BFf059e6C550BD4908aC1840e 0x7C1B7b8fEB636eA9Ecd32152Bce2744a0EEf39C7 0xBbcD45801a3c3B858fbc66674FE7c9f94e33dC72; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/56/$a | jq -r .match; done"
            }
          ],
          "finding": "All settlement contracts are partial Sourcify matches, and the adapter source equals the tagged release. No rebuild attempted. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/anoma-app-sdk/blob/7dc89bef8774a560fa55df4efab11f7751eba6bf/README.md#L125-L135",
              "commit": "7dc89bef8774a560fa55df4efab11f7751eba6bf",
              "path": "README.md",
              "detail": "The SDK README cites the audited frontend repo anoma/pay-interface-app, which returns 404 to the GitHub API; the org's public repos include contracts, SDK and proving libraries but no transaction service, prover service or indexer.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/anoma/pay-interface-app --jq .full_name; gh repo list anoma --limit 300 --json name --jq '.[].name' | grep -iE 'index|backend|prov|relay'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Contracts, SDK and proving libraries are public; the web app, transaction and proving service, and indexer are not. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/anoma-app-sdk/blob/7dc89bef8774a560fa55df4efab11f7751eba6bf/README.md#L1-L5",
              "commit": "7dc89bef8774a560fa55df4efab11f7751eba6bf",
              "path": "README.md",
              "detail": "The SDK describes itself as API clients for AnomaPay backend services; the backend those clients need is not public, so no README leads to a working deployment.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A stranger can deploy the contracts (pa-evm has deploy scripts) but cannot stand up the transaction, proving and indexing services the client flow needs, because their code is not published. Judgment call: 0, no path, rather than 1, since the missing pieces are code, not documentation.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/api-clients",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The backend, indexer and Envio APIs are described on the hosted docs site only; contract events are in source, with no committed ABI JSON or API schema in the repos.",
              "checked_at": "2026-10-09",
              "quote": "Communicates with the proving backend",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Interfaces are documented on a hosted site, not versioned with code; no payee export. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/pa-evm/blob/e368e2738df6a28f1b7577215da6789283952cba/contracts/LICENSE",
              "commit": "e368e2738df6a28f1b7577215da6789283952cba",
              "path": "contracts/LICENSE",
              "detail": "pa-evm and the forwarder carry MIT under contracts/LICENSE (no root licence, so GitHub reports none); anoma-app-sdk and arm-risc0 are Apache-2.0; anomapay-erc20-resource has no licence.",
              "checked_at": "2026-10-09",
              "recheck": "for r in pa-evm anomapay-erc20-forwarder anoma-app-sdk arm-risc0 anomapay-erc20-resource; do echo $r $(gh api repos/anoma/$r --jq '.license.spdx_id // \"none\"'); done",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The transaction and proving service and the indexer are required and closed, so F1 is 0. The resource-logic repo needed to prove AnomaPay transfers also has no licence.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/pa-evm/blob/e368e2738df6a28f1b7577215da6789283952cba/contracts/LICENSE",
              "commit": "e368e2738df6a28f1b7577215da6789283952cba",
              "path": "contracts/LICENSE",
              "detail": "No CONTRIBUTING or CLA file at the root of pa-evm or the forwarder; no relicensing event found.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/anoma/pa-evm/contents/?ref=e368e2738df6a28f1b7577215da6789283952cba\" --jq '.[].name'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No CLA, no relicensing event, no written licence-stability commitment.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/transfers",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "Every SDK operation ends in a call to the hosted proving backend.",
              "checked_at": "2026-10-09",
              "quote": "submitted to the proving backend via TransferBackendClient.transfer()",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The documented production flow needs Anoma's hosted proving, transaction and indexing services, with no open alternative published. Client-side proving is announced as future work. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/anoma-pay-trust-model",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The proving service operator and Vast.ai datacenters see witness data (sender, receiver, asset, amount).",
              "checked_at": "2026-10-09",
              "quote": "Sees (temporarily) the unencrypted witness data",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anomapay.app/terms-and-conditions",
              "detail": "The terms list collected data including user info, invitation code, Ethereum address, device identity and IP address.",
              "checked_at": "2026-10-09",
              "quote": "network information (IP Address",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Beyond settlement data, the service collects account, device and network data and sees every transfer's sender, receiver, asset and amount in clear while proving; the docs also mention KYC/AML checks. Disclosed in documents. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/anomapay-erc20-forwarder/blob/916cc7ed960f443f7cce82bd517ab8505519cd1e/contracts/src/ERC20Forwarder.sol#L70-L78",
              "commit": "916cc7ed960f443f7cce82bd517ab8505519cd1e",
              "path": "contracts/src/ERC20Forwarder.sol",
              "detail": "Wrapped(token, from, amount) and Unwrapped(token, to, amount) are emitted in plaintext; the adapter emits tags, logic refs and resource payload blobs (ProtocolAdapter.sol L344-L385).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/anoma/anomapay-erc20-forwarder/contents/contracts/src/ERC20Forwarder.sol?ref=916cc7ed960f443f7cce82bd517ab8505519cd1e\" --jq .content | base64 -d | sed -n 70,78p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/anoma-pay-privacy-guarantees",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The docs state deposit and withdrawal addresses are public, shielded transfers are not.",
              "checked_at": "2026-10-09",
              "quote": "the initial deposit or final withdrawal address is visible on-chain",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Deposits and withdrawals reveal address, token and arbitrary amount; shielded transfers between AnomaPay users carry only tags and payload blobs and are submitted by the service, not the user. We did not verify from code that payload blobs are encrypted end to end (the SDK has AES-GCM helpers). Judgment call: 2, minimal linkage documented; not 3 because entry and exit amounts are plaintext and the payload encryption was not traced. The proving service sees everything (P2, P4).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/anoma-pay-trust-model",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "Vast.ai datacenters see witness data during proving.",
              "checked_at": "2026-10-09",
              "quote": "Vast.ai datacenters provide ISO certifications",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The proving service, Vast.ai, the indexer and an Envio GraphQL endpoint sit in the payment path; they are named in docs but not shown in public code. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/api-clients",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The docs show the backend client constructed with a URL argument; the indexer code is not public.",
              "checked_at": "2026-10-09",
              "quote": "Communicates with the proving backend",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK docs show endpoint URLs passed as constructor arguments, but the clients are not in the public SDK source at our commit, the web app is closed, and the indexer cannot be self-hosted. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/anomapay-erc20-forwarder/blob/916cc7ed960f443f7cce82bd517ab8505519cd1e/contracts/src/bases/EmergencyMigratableForwarderBase.sol#L40-L70",
              "commit": "916cc7ed960f443f7cce82bd517ab8505519cd1e",
              "path": "contracts/src/bases/EmergencyMigratableForwarderBase.sol",
              "detail": "Once the adapter is stopped, the emergency committee sets an emergency caller once, and that caller's forwardEmergencyCall runs _forwardCall directly (ERC20Forwarder.sol L174-L180), so it can unwrap any amount to any receiver without a proof.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/anoma/anomapay-erc20-forwarder/contents/contracts/src/bases/EmergencyMigratableForwarderBase.sol?ref=916cc7ed960f443f7cce82bd517ab8505519cd1e\" --jq .content | base64 -d | sed -n 40,70p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0xc703402252Ce1251aa07e0815D50060d27fdd6C4",
              "address": "0xc703402252Ce1251aa07e0815D50060d27fdd6C4",
              "block_number": 126599882,
              "detail": "The forwarder's constructor argument emergencyCommittee (Sourcify) is the Safe 0xc703…d6C4, threshold 3 with the same five owners as the adapter owner; getEmergencyCaller() is zero and the forwarder held about 1,477 USDC and 5,458 USDT at block 126599882.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000003"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Deposited tokens sit in the non-upgradeable forwarder and move out only through proven adapter transactions, unless the adapter is stopped. The same five signers can stop the adapter (3-of-5) and, as emergency committee (3-of-5), appoint a caller who can send the forwarder's tokens anywhere, with no timelock. The docs say funds \"can only be moved with a valid proof\", which the code does not bear out. Scored 0: the provider can redirect funds.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0xDe6A308ed57AF26BFf059e6C550BD4908aC1840e",
              "address": "0xDe6A308ed57AF26BFf059e6C550BD4908aC1840e",
              "block_number": 126599882,
              "detail": "Neither the forwarder nor the adapter is a proxy (EIP-1967 implementation slot zero); the forwarder's emergency migration is controlled by the 3-of-5 committee Safe with no timelock.",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0xDe6A308ed57AF26BFf059e6C550BD4908aC1840e 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://bsc-rpc.publicnode.com",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The contract code cannot be changed, but the stop-and-migrate path lets a 3-of-5 multisig move all funds to a new adapter version of its choosing, which works as an upgrade. Judgment call: we treat that as upgrade authority and score 1 (multisig, no timelock) rather than 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/anomapay-erc20-forwarder/blob/916cc7ed960f443f7cce82bd517ab8505519cd1e/contracts/src/ERC20Forwarder.sol#L133-L159",
              "commit": "916cc7ed960f443f7cce82bd517ab8505519cd1e",
              "path": "contracts/src/ERC20Forwarder.sol",
              "detail": "_wrap pulls exactly the wrapped amount through Permit2 permitWitnessTransferFrom, with a deadline and the action-tree root as witness.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/anoma/anomapay-erc20-forwarder/contents/contracts/src/ERC20Forwarder.sol?ref=916cc7ed960f443f7cce82bd517ab8505519cd1e\" --jq .content | base64 -d | sed -n 133,159p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Deposits use Permit2 signature transfers of the exact amount with expiry (the docs example uses 30 minutes), which fits anchor 3. A 3 needs a package or trace, and we did not see how large a base approval to Permit2 the closed app requests. Judgment call: 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/anoma-pay-protocol-adapter",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "The docs say users may run the off-chain services themselves; no public tooling does so.",
              "checked_at": "2026-10-09",
              "quote": "Any user can decide to run the off-chain infrastructure themselves",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=0, C2=2, C3=1, O3=0. If Anoma disappeared, funds would stay in the forwarder (no one stops the adapter by disappearing), and execute() stays open. But retrieving them needs a self-built prover pipeline from arm-risc0 and the unlicensed resource logic, plus resource discovery without the hosted indexer; this is claimed in docs, not shown by public code. Judgment call: 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/pa-evm/blob/e368e2738df6a28f1b7577215da6789283952cba/README.md#L32-L56",
              "commit": "e368e2738df6a28f1b7577215da6789283952cba",
              "path": "README.md",
              "detail": "The README lists audits by Informal Systems (commit fc69013e, Oct 2025) and Nethermind (commit fee4f470, tag v1.0.0-rc.4) with PDFs in audits/, and a security contact email; the forwarder README lists an Informal Systems audit of commit 03e60b64 (Dec 2025). The deployed adapter is tag contracts/v1.1.0 (e368e273, 2026-01-27), after the audited commit.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Audit reports exist and are pinned to commits, but the deployed adapter was built from a later tag, findings were not traced to fix commits here, and we found no bug bounty. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "blocklist",
        "countries": [
          "BY",
          "BI",
          "CF",
          "CG",
          "CD",
          "KP",
          "GN",
          "GW",
          "IR",
          "IQ",
          "LB",
          "LY",
          "ML",
          "MM",
          "SS",
          "RU",
          "SO",
          "SD",
          "SY",
          "UA",
          "VE",
          "YE",
          "ZW"
        ],
        "note": "From the AnomaPay terms (Version 1.0), which name SECO-embargoed \"Prohibited Jurisdictions\" as \"including, but not limited to\" this list, so it is not exhaustive. \"Congo\" is not specified; we list both CG and CD (more restrictive reading). The clause as published reads \"are using the Software from one of the countries embargoed\", apparently a drafting error for \"are not\". The terms also bar persons under UN, US, EU or Swiss sanctions and commercial use, and reserve geo-restriction. The contracts have no address or country check; we did not inspect the closed app for a geoblock.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://anomapay.app/terms-and-conditions",
            "detail": "Section 2 lists the Prohibited Jurisdictions and reserves geo-restriction.",
            "checked_at": "2026-10-09",
            "quote": "including, but not limited to: Belarus, Burundi, Central African Republic, Congo",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: the BNB Smart Chain protocol adapter (v1.1.0) and ERC20 forwarder used by the AnomaPay public beta, with the RISC Zero verifier they call. BSC reads at blocks 126599704 (adapter owner, stop state) and 126599882 (Safes, forwarder state, balances); publicnode serves only recent BSC state, so rechecks use the latest block. Operator: Anoma Foundation (Zug) per the terms. The anomapay.app landing page also advertises an \"AnomaPay Card\"; card products were not assessed. No transactions, app runs, traces or self-host attempts.",
      "audits": {
        "searched": "The Audits sections and audits/ folders of github.com/anoma/pa-evm, anomapay-erc20-forwarder, arm-risc0, anomapay-erc20-resource and anoma-app-sdk; for the shared components, the audit log at github.com/risc0/rz-security (RISC Zero zkVM, recursion circuits and EVM verifier contracts) and the audits/ folder of github.com/Uniswap/permit2. Deployed code was compared with audited commits through GitHub's compare API. The RISC Zero log also lists a Veridise audit of the next-generation M3 zkVM (Feb 2026) and audits of Steel, Kailua, Boundless and Solana verifiers, which are not in this payment path and are left out.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Informal Systems",
            "date": "2025-12-19",
            "type": "audit",
            "scope": "AnomaPay Phase I - ERC20 forwarder contracts (V1/V2 with migration), ERC20 resource logic and witness libraries, and the frontend key-management vault",
            "url": "https://github.com/anoma/anomapay-erc20-forwarder/blob/main/audits/2025-12-19_Informal_Systems_AnomaPay_Phase_I.pdf",
            "commit": "03e60b64d9dc3845c55e34d1d0bef25392cb5b60",
            "repo": "https://github.com/anoma/anomapay-erc20-forwarder",
            "covers_deployed": "partly",
            "findings": "1 critical, 2 medium, 5 informational; critical and mediums marked resolved",
            "note": "The same PDF sits in anomapay-erc20-resource and anoma-app-sdk; the SDK README ties it to commit 957e8bf1 of anoma/pay-interface-app, which is not public. The deployed forwarder tag contracts/v1.0.1 is 216 commits after the audited commit and changes ERC20Forwarder.sol and its bases."
          },
          {
            "auditor": "Informal Systems",
            "date": "2025-11-24",
            "type": "audit",
            "scope": "EVM Protocol Adapter contracts and the Anoma Resource Machine RISC Zero implementation (arm-risc0 circuits, encryption and authorization modules)",
            "url": "https://github.com/anoma/pa-evm/blob/main/audits/2025-11-24_Informal_Systems_RISC_Zero_RM_%26_EVM_Protocol_Adapter.pdf",
            "commit": "fc69013e7bc2db1bddf6ef6936e8bf03d14f2963",
            "repo": "https://github.com/anoma/pa-evm",
            "covers_deployed": "partly",
            "findings": "2 medium, 4 low, 9 informational; both mediums resolved in tag v0.8.2",
            "note": "Audit ran 2025-10-13 to 2025-10-31; arm-risc0 was reviewed at commit 61e68468. The deployed adapter (tag contracts/v1.1.0, e368e273) is 306 commits later and changes ProtocolAdapter.sol and the proving libraries."
          },
          {
            "auditor": "Nethermind",
            "date": "2025-11-13",
            "type": "audit",
            "scope": "EVM Protocol Adapter contracts and Anoma Resource Machine circuits (security review NM-0677)",
            "url": "https://github.com/anoma/pa-evm/blob/main/audits/2025-11-13_Nethermind_RISC_Zero_RM_%26_EVM_Protocol_Adapter.pdf",
            "commit": "fee4f47050689b82473e9a3198e7a2065becb3fb",
            "repo": "https://github.com/anoma/pa-evm",
            "covers_deployed": "partly",
            "findings": "3 low, 3 informational, 2 best practices; 6 fixed, 2 acknowledged",
            "note": "Audited at pa-evm tag v1.0.0-rc.4 and arm-risc0 commit a0cca9cd. The deployed adapter v1.1.0 is 224 commits later with changes to ProtocolAdapter.sol and the proving libraries."
          },
          {
            "auditor": "Veridise",
            "date": "2025-02-24",
            "type": "audit",
            "scope": "Shared component: RISC Zero zkVM V2 RISC-V circuit, STARK-to-STARK and STARK-to-SNARK recursion circuits, STARK verifiers and prover",
            "url": "https://github.com/risc0/rz-security/blob/main/audits/zkVM/veridise_zkVM_20250224.pdf",
            "repo": "https://github.com/risc0/risc0",
            "covers_deployed": "unknown",
            "findings": "4 critical, 1 high, 4 medium, 2 low, 19 warnings, 11 informational; all critical, high and medium fixed",
            "note": "Reviewed risc0/risc0 at commits a6159d9 and 35c65de (Jul-Dec 2024). We did not tie the verifier selector used on BSC to a zkVM release."
          },
          {
            "auditor": "Hexens",
            "date": "2024-05-20",
            "type": "audit",
            "scope": "Shared component: RISC Zero EVM verifier contracts (RiscZeroGroth16Verifier, Groth16Verifier, RiscZeroVerifierRouter, RiscZeroVerifierEmergencyStop)",
            "url": "https://github.com/risc0/rz-security/blob/main/audits/contracts/hexens_verifiercontract_20240605.pdf",
            "repo": "https://github.com/risc0/risc0-ethereum",
            "covers_deployed": "unknown",
            "findings": "1 high, 1 low, 1 informational",
            "note": "Reviewed 2024-05-13 to 2024-05-20 on the main branch; the report gives no pinned commit."
          },
          {
            "auditor": "Hexens",
            "date": "2023-10-31",
            "type": "audit",
            "scope": "Shared component: RISC Zero zkVM (executor, ELF loader, syscalls, circuits)",
            "url": "https://github.com/risc0/rz-security/blob/main/audits/zkVM/hexens_zkVM_20231031.pdf",
            "commit": "323b5f58e45a7b0de02df6227e1e9de475f70176",
            "repo": "https://github.com/risc0/risc0",
            "covers_deployed": "unknown",
            "findings": "1 high, 2 medium, 4 low, 3 informational; fixes in commit 83cf6867",
            "note": "An older zkVM version, superseded by the V2 circuit reviewed by Veridise."
          },
          {
            "auditor": "ChainSecurity",
            "date": "2022-11-18",
            "type": "audit",
            "scope": "Shared component: Uniswap Permit2 (AllowanceTransfer, SignatureTransfer, Permit2Lib)",
            "url": "https://github.com/Uniswap/permit2/blob/main/audits/Chainsecurity%20Audit.pdf",
            "repo": "https://github.com/Uniswap/permit2",
            "covers_deployed": "unknown",
            "findings": "1 high (corrected), 1 medium (risk accepted), 1 low (corrected)",
            "note": "Initial version e3e496f5 (2022-10-25) with fix versions to 2022-11-18. We did not compare the BSC Permit2 bytecode with the final reviewed version."
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2022-11-16",
            "type": "audit",
            "scope": "Shared component: Uniswap Permit2 contracts",
            "url": "https://github.com/Uniswap/permit2/blob/main/audits/ABDKAudit.pdf",
            "repo": "https://github.com/Uniswap/permit2",
            "covers_deployed": "unknown",
            "findings": "1 critical, 12 major and lesser issues; the critical fixed, unfixed majors judged not a threat per client comments"
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 1,
          "limiting": [
            "C1",
            "C3",
            "C4",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S5"
          ]
        }
      },
      "tally": {
        "holds": 5,
        "short": 16,
        "unk": 2,
        "total": 23
      }
    },
    {
      "slug": "avalanche-card",
      "name": "Avalanche Card",
      "type": "incumbent",
      "website": "https://www.avalanchecard.com",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Avalanche Card app (mobile)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Rain Liquidity LLC",
          "required": true
        },
        {
          "name": "Rain card platform, collateral and authorisation backend",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Rain (Signify Holdings, Inc.)",
          "required": true
        },
        {
          "name": "Collateral contract (chain and address not disclosed)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Rain Liquidity / Issuer",
          "required": true
        },
        {
          "name": "Third-party non-custodial smart wallet (provider not named)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Not disclosed",
          "required": true
        },
        {
          "name": "Price oracle for collateral value (not named)",
          "role": "oracle",
          "public": false,
          "license": "proprietary",
          "operator": "Not disclosed",
          "required": true
        },
        {
          "name": "Third National (card issuer; Nimbus LLC, a Rain affiliate)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Nimbus LLC d/b/a Third National",
          "required": true
        },
        {
          "name": "Visa (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Identity verification and sanctions screening (vendor not named)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Rain",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
              "detail": "The card agreement lets Rain Liquidity and the issuer suspend the card or account with or without notice, and deny any purchase for any reason.",
              "quote": "We may terminate or suspend your use of the Card or the Account, with or without notice",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There are no assessable settlement contracts. The card agreement lets the provider and issuer suspend an individual card or account with or without notice, which meets anchor 0 (\"can target individual addresses with no notice\").",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-terms-conditions-4b62a44e",
              "detail": "The app terms say an outside oracle and Rain Liquidity set the cardholder's spending power against collateral. Merchants are paid through Visa by the issuer.",
              "quote": "Rain Liquidity uses that price in determining how much spending power you have",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Card settlement runs through Rain Liquidity, the issuer and Visa. No published contract or ABI lets a payer or payee settle directly.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "The privacy policy assigns the app, card services and collateral functionality to Rain Liquidity LLC, and Visa card issuance and settlement to Third National. Both are Rain entities.",
              "quote": "Visa card issuance, licensed lending, licensed money transmission",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every step of a card payment (app, collateral accounting, authorisation, issuing, settlement) runs on closed Rain-group services with no public code and no fallback.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
              "detail": "The cardholder must not be blocked or sanctioned by the US Government (OFAC).",
              "quote": "You are not a person who is blocked or sanctioned by the United States Government",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "The privacy policy names sanctions screening among the purposes for sharing data across Rain entities and partners.",
              "quote": "conduct sanctions screening",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Sanctions screening is disclosed in the card agreement and privacy policy. The settlement layer cannot be inspected, so its neutrality cannot be shown. Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
              "detail": "The card agreement's \"Supported Blockchains\" are Ethereum, Polygon, Optimism and Arbitrum, plus others at the issuer's discretion. Avalanche is not listed.",
              "quote": "means the Ethereum Blockchain, Polygon Blockchain, Optimism Blockchain, Arbitrium Blockchain",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://www.avalanchecard.com/",
              "detail": "The homepage says the card supports USDC, USDT, AVAX and WAVAX.",
              "quote": "Currently supporting USDC, USDT, AVAX and WAVAX.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The binding card agreement lists supported blockchains that omit Avalanche, while marketing names Avalanche-native collateral (AVAX, WAVAX). No issuer freeze or sequencer assumptions are stated. Judgment call: the chain enumeration in the terms is wrong for this product, which meets \"misstated\" (0).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/SignifyHQ/rain-sdk-android/blob/49301504673b9814d5ef9e781a48c642c43259cb/README.md#L440-L470",
              "commit": "49301504673b9814d5ef9e781a48c642c43259cb",
              "path": "README.md",
              "detail": "Rain (Signify Holdings, GitHub SignifyHQ) publishes integrator SDKs, such as this Android SDK for Rain collateral on EVM chains and Solana. No Avalanche Card app, backend or collateral contract repository exists, and nothing ties these SDKs to the Avalanche Card app.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-terms-conditions-4b62a44e",
              "detail": "The app licence forbids decompiling or reverse engineering the app.",
              "quote": "decompile, reverse engineer, disassemble",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Nothing in the Avalanche Card payment path is public. Rain's open SDKs serve other integrators and are not shown to run this product. Judgment call: 0 rather than 1, because no public SDK or contract is evidenced as part of this card.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-terms-conditions-4b62a44e",
              "detail": "The app is licensed for use only; modification and reverse engineering are forbidden.",
              "quote": "decompile, reverse engineer, disassemble",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "All required components are closed and proprietary, so F1 is 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "Rain entities provide the app, collateral functionality, issuing and settlement.",
              "quote": "Rain is a financial technology provider. We are not a bank and do not hold deposits.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The product is entirely hosted, proprietary Rain-group services. Nothing can run without them.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "The privacy policy discloses SDKs, analytics tools and advertising technologies, and says third parties may process the data under their own notices.",
              "quote": "analytics tools, advertising technologies",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics and advertising SDKs are disclosed in the policy. The app is closed and no trace was run, so their presence and default state are not confirmed. Judgment call: disclosed in policy, so 1 (the documented cap).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "The policy discloses collection of identifiers, government IDs, financial data, wallet addresses and biometric identifiers (facial geometry) for KYC.",
              "quote": "biometric identifiers, including facial geometry",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Full KYC, including biometrics, is collected and disclosed in policy only. Collection goes well beyond settlement needs. Disclosed in policy, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "The policy lists data sharing among Rain entities and partners for identity verification, card issuing, transaction processing, settlement and sanctions screening.",
              "quote": "conduct sanctions screening",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Rain entities, Third National, Visa and unnamed verification, analytics and oracle providers see payment data. They are disclosed in docs only and are not swappable. No trace was run, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The Avalanche Card is offered by Rain Liquidity LLC, which the site describes as \"a financial technology company and not a bank\", and is issued by Third National. Rain's privacy policy defines Rain as Signify Holdings, Inc. and affiliates, including Nimbus LLC d/b/a Third National, which provides Visa card issuance, licensed lending and licensed money transmission (https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7). The card agreement states that Rain Liquidity and the issuer never hold custody of collateral, and that a liquidation event (an unpaid balance after one calendar day, or collateral value below charges) lets them liquidate collateral.",
      "notes": "Classified as incumbent: I found no verified contract or public repository shown to be needed to run this card. Searched: avalanchecard.com and legal.avalanchecard.com (terms, card agreements, privacy policy); GitHub for Rain orgs, where SignifyHQ (Signify Holdings, i.e. Rain) publishes integrator SDKs and a collateral-examples repo; GitHub code search for RainCollateral; Avalanche C-Chain via cast and Routescan. Rain's v1 RainCollateralController 0x753Fb325... and RainCollateral 0xD71Fd741... are live on Avalanche and verified on Routescan. Their controllerAdmin can liquidate any collateral, and user withdrawals need a Rain signature. But 1000 recent Withdrawal events show only USDe, USDC and USDT, with no AVAX or WAVAX, and the card agreement does not list Avalanche as a supported chain, so I could not tie them to this card. Re-assess as type card if Rain discloses the card's collateral contract.",
      "availability": {
        "model": "blocklist",
        "countries": [
          "BY",
          "CN",
          "CU",
          "IL",
          "IN",
          "IQ",
          "IR",
          "KP",
          "LK",
          "NG",
          "NI",
          "NP",
          "RU",
          "SY",
          "TR",
          "UA",
          "VE",
          "VN"
        ],
        "note": "The site FAQ names 18 countries whose residents cannot be issued a card, and these are listed. The same answer says the card \"is currently available in many U.S. states, Latin America, and the Caribbean\" without enumerating those regions, so availability outside the Americas is not affirmed by any document; the blocklist records only what is named. In the US, residents of 16 states cannot be issued a card: Arizona, Delaware, Georgia, Idaho, Louisiana, Maryland, Nevada, New Mexico, North Dakota, Ohio, Oregon, Rhode Island, South Dakota, Vermont, Washington and Wisconsin. US residents use the separate US card agreement; under the international card agreement the holder attests they are not a US citizen. Both agreements bar persons blocked or sanctioned by the US (OFAC), and the app terms require that the user is not located in a US-embargoed or \"terrorist supporting\" country (not listed).",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.avalanchecard.com/",
            "quote": "Cannot issue to residents of the following countries: Belarus, Cuba, India, Iran, Iraq, Israel, Mainland China, Nepal, Nicaragua, Nigeria, North Korea, Russia, Sri Lanka, Syria, Turkey, Ukraine, Venezuela, Vietnam",
            "detail": "Avalanche Card site FAQ \"What countries are supported?\", which also lists the 16 excluded US states and says the card is available in many US states, Latin America and the Caribbean.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
            "quote": "You attest that you are not a United States citizen, and that you are signing up for a card that is intended for those outside of the United States",
            "detail": "Avalanche Card international card agreement (Rain Liquidity / issuer), section 1 representations; also requires the holder not be blocked or sanctioned by the US (OFAC).",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle"
          },
          {
            "symbol": "USDT",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Tether"
          },
          {
            "symbol": "AVAX",
            "class": "native"
          },
          {
            "symbol": "WAVAX",
            "class": "other"
          }
        ],
        "conversion": "unknown",
        "note": "The card is a Rain collateralised card: the user posts digital assets as collateral from a linked wallet, card charges create a USD balance owed to Rain Liquidity and the issuer, and the collateral secures that balance. The card agreement says the user repays Rain and that collateral is liquidated to cover charges on a Liquidation Event (unpaid obligations or collateral value falling below charges); it does not say whether collateral is sold at each authorisation or swept later, so conversion is recorded as unknown. The homepage lists USDC, USDT, AVAX and WAVAX (WAVAX is wrapped AVAX); the FAQ names only USDC and AVAX as collateral. No default is stated. Chains and contract addresses are not given: marketing implies Avalanche C-Chain, while the card agreement's Supported Blockchains (Ethereum, Polygon, Optimism, Arbitrum) omit Avalanche (see C5), so no chain is recorded.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.avalanchecard.com/",
            "detail": "The homepage lists the four supported assets.",
            "quote": "Currently supporting USDC, USDT, AVAX and WAVAX.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.avalanchecard.com/",
            "detail": "The FAQ describes the card as crypto-backed and names USDC and AVAX as collateral.",
            "quote": "Supports USDC and AVAX for collateral",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
            "archive": "data/archive/avalanche-card-ops-international-card-agreement.txt",
            "detail": "The card agreement (s3) makes the posted digital assets collateral securing USD charges, which Rain satisfies and the user repays; collateral is liquidated only to cover outstanding obligations.",
            "quote": "will be required to post Collateral that has Market Value in United States Dollars",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "avalanchecard.com and legal.avalanchecard.com (no audit mentioned), Rain's security page (audits under NDA, Sherlock named; SOC 2, PCI DSS and pentest summary only on request, not code audits), Rain's GitHub org SignifyHQ (SDKs and integration examples, no audits folder) and the Sherlock report repo (one Rain report). No audit of Rain's v1 RainCollateral contracts live on Avalanche C-Chain, or of the card app, is published.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Sherlock",
            "date": "2025-02-11",
            "type": "contest",
            "scope": "Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest",
            "url": "https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2025.02.11%20-%20Final%20-%20Rain%20Private%20Best%20Efforts%20Audit%20Contest%20Report.pdf",
            "commit": "6f578d5b9c9fa35bbe857959a50fa5aab4fa611a",
            "repo": "https://github.com/SignifyHQ/collateral-contract-evm-v2",
            "covers_deployed": "unknown",
            "findings": "0 high, 2 medium (statement payoff rounding; missing Chainlink min/max answer check)",
            "note": "Logged because Rain Liquidity runs this card and its collateral. Rain v1 contracts (RainCollateralController 0x753Fb325...) are live on Avalanche but were not tied to this card, and this contest covered v2. The Rain repo is private; contest ran 2-8 December 2024 on b432939a, 6f578d5 is the fix commit."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 11,
        "unk": 12,
        "total": 23
      }
    },
    {
      "slug": "avici-card",
      "name": "Avici Card",
      "type": "incumbent",
      "website": "https://avici.money",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Avici app and wallet backend",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Avici Inc",
          "required": true
        },
        {
          "name": "Card loan escrow contract (EVM; chain and address not disclosed)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Avici Inc / card partner",
          "required": true
        },
        {
          "name": "Avici smart wallet (ZeroDev on EVM; key-based wallet on Solana)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "User (infrastructure by ZeroDev and Avici)",
          "required": true
        },
        {
          "name": "Avici gas relayer (EVM and Solana)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Avici Inc",
          "required": false
        },
        {
          "name": "Relay (auto-swap and bridging for card top-ups)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Relay",
          "required": false
        },
        {
          "name": "Sumsub (KYC and ongoing AML monitoring)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub",
          "required": true
        },
        {
          "name": "Third National (card issuer)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Third National",
          "required": true
        },
        {
          "name": "Visa (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tos",
              "detail": "Avici's terms let it decline, restrict, suspend or pause any account or service at its discretion, which can stop card spending.",
              "quote": "We may decline, restrict, suspend, or pause access to any account or service at our discretion",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tosavicicard",
              "detail": "The card terms let Avici and the issuer block transactions and suspend account access.",
              "quote": "Avici and Issuer reserve the right to block and terminate transactions and suspend access to your Account",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No settlement contract could be assessed. The terms let Avici and the issuer block an individual's card and account at their discretion, with no notice period. That meets anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.avici.money/getting-started/secured-credit-cards",
              "detail": "Avici's docs say spends are charged against the escrow using its own \"spend attestation\", and that Avici periodically liquidates the spent USDC to settle with Visa.",
              "quote": "we liquidate the spent USDC amount from the card contract",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tosavicicard",
              "detail": "The card program is issued by Third National under licence from Visa.",
              "quote": "The issuer for this card program is Third National",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "By Avici's own description, settlement needs Avici's spend attestation and its periodic liquidation, plus the issuer and Visa. No contract or ABI is published for a direct path. The provider's admission holds this at 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tos",
              "detail": "Avici's terms describe cards issued via Third National, ZeroDev wallet infrastructure, and onramps through Moonpay and Bridge.",
              "quote": "Visa cards issued via our card partner Third National",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card flow depends on Avici's closed backend (escrow creation, spending-power API, attestations, liquidation), Sumsub, Third National and Visa. None of these is public or has a fallback.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tos",
              "detail": "Card access requires KYC with sanctions, watchlist and fraud screening.",
              "quote": "Sanctions, watchlist, and fraud screening",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Screening is disclosed in the terms but runs in closed services. The settlement contract is undisclosed, so its neutrality cannot be shown. Docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.avici.money/getting-started/secured-credit-cards/faqs",
              "detail": "The FAQ says only that the loan contract \"is on EVM\" and accepts deposits bridged from Solana. It names no chain or contract.",
              "quote": "The contract is on EVM but can accept deposits from Solana",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The token (USDC) is named, but the chain holding card collateral is not, and no freeze or sequencer assumptions are stated. Judgment call: without a chain, the dependencies are not enumerated, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Avici-Labs/octane/blob/33bca8141ae03b6715ef8953b6d79f9cb2f5df5a/README.md#L1-L5",
              "commit": "33bca8141ae03b6715ef8953b6d79f9cb2f5df5a",
              "path": "README.md",
              "detail": "Avici-Labs has four public repos (v-mcp, redirectAvici, octane, meme50). None is the card, escrow contract, app or backend; octane is a 2024 Solana gasless relayer.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Nothing in the card payment path is public. Absence is the finding.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tos",
              "detail": "The required components (Avici backend, escrow contract, ZeroDev wallet stack, Sumsub, Third National, Visa) are third-party or provider services with no published source.",
              "quote": "Our EVM smart wallet infrastructure is powered by ZeroDev",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Required components are closed, so F1 is 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.avici.money/getting-started/secured-credit-cards/profile-verification",
              "detail": "Avici's docs say Avici creates the escrow loan contract and provides the API for spending power, transaction history and card creation.",
              "quote": "We then create the escrow loan contract and provide the API",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "By the provider's own account, the card cannot run without Avici's hosted API and partners. Provider admission, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/privacypolicy",
              "detail": "The privacy policy lists analytics and error reporting among the third parties it shares personal information with.",
              "quote": "analytics and error reporting",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics and error reporting are disclosed in the policy. The app is closed and no trace was run, so presence and default state are unconfirmed. Documented cap, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/privacypolicy",
              "detail": "For cards, the verification provider collects ID documents, personal details, address, tax identifiers, a selfie and liveness check, and biometric facial data.",
              "quote": "verification provider collects your identity documents",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Full KYC, including biometrics, is required for the card and disclosed in policy only. The wallet alone needs none. Collection goes beyond settlement needs. Disclosed in policy, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/privacypolicy",
              "detail": "The policy lists sharing with identity verification, card issuing and payment networks, onramps, wallet infrastructure, hosting, analytics and AI model providers.",
              "quote": "card issuing and payment networks",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties are disclosed by category, and some by name in docs (Sumsub, Third National, Visa, ZeroDev, Relay, Moonpay, Bridge). None can be swapped. No trace was run, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. Avici is operated by Avici Inc, a Delaware corporation (privacy policy, https://avici.money/privacypolicy). Its card terms name Third National as issuer of the card program, issued under licence from Visa (https://avici.money/tosavicicard). They state that Avici and the issuer never hold custody of collateral, and that a liquidation event lets them liquidate it to cover charges. The docs say KYC data is shared with Visa and its partners when required, and that Sumsub runs ongoing AML monitoring of users and their onchain funds.",
      "notes": "Classified as incumbent: I found no verified contract or public repository needed to run the card. Searched: avici.money (home, tos, tosavicicard, privacypolicy), docs.avici.money (llms.txt index and the card, wallet and FAQ pages), and GitHub (Avici-Labs org with 4 unrelated repos; users avici, avicimoney, aviciii; code search for avici.money). The docs say the card collateral sits in a self-custodial \"Loan Escrow\" contract \"on EVM\" that \"only user's wallet\" can withdraw from, but they give no chain, address, ABI or audit. These claims cannot be checked and were not used to score custody. The wallet supports ten EVM chains plus Solana. Re-assess as type card if the escrow contract address is published.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "AE",
          "AG",
          "AR",
          "AU",
          "BB",
          "BD",
          "BO",
          "BR",
          "BS",
          "BZ",
          "CI",
          "CO",
          "CR",
          "DO",
          "EC",
          "EG",
          "GD",
          "GH",
          "GT",
          "GY",
          "HK",
          "HN",
          "JP",
          "KE",
          "KN",
          "KY",
          "LC",
          "MA",
          "MX",
          "MY",
          "NZ",
          "PA",
          "PE",
          "PH",
          "PK",
          "PY",
          "SG",
          "SN",
          "SR",
          "SV",
          "TC",
          "TH",
          "TT",
          "UG",
          "US",
          "UY",
          "VC",
          "ZA",
          "ZM"
        ],
        "note": "From the \"Available Regions\" tab of Avici's card regions page (50 entries, 49 codes). The list has both \"Dominica Republica\" and \"Dominicana\"; both names point to the Dominican Republic, so only DO is listed and Dominica (DM) is not, the more restrictive reading. US: only 31 states are supported for personal cards (AL, AK, AR, CA, CO, CT, FL, HI, IL, IN, IA, KS, KY, ME, MA, MI, MN, MT, NE, NH, NJ, NY, NC, OK, PA, SC, TX, UT, VA, WV, WY). The Avici Spend Card terms on avici.money require the holder to attest they are not a US citizen; US cardholders are on separate US card terms. The page also names 17 countries whose residents are prohibited (BY, CN, CU, IN, IR, IQ, IL, MM, NP, NI, KP, RU, SY, TR, UA, VE, VN, none of which are in the allowlist), says the card cannot be used to spend in CU, IR, KP, RU, SY, UA or VE, and says unlisted jurisdictions may still be restricted. The page also says the Avici self-custody smart wallet is available without restriction; this block covers the card only.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.avici.money/getting-started/secured-credit-cards/regions-and-prohibitions-for-avici-card.md",
            "quote": "Please find below the lists for Available and Prohibited regions",
            "detail": "Avici docs \"Regions and Prohibitions for Avici Card\" (GitBook Markdown copy listed in docs.avici.money/llms.txt), with tabs for Available Regions, Prohibited Regions and Supported US States.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.avici.money/getting-started/secured-credit-cards/regions-and-prohibitions-for-avici-card.md",
            "quote": "Avici Card services are unavailable for users to residents of the following countries",
            "detail": "Prohibited Regions tab of the same page (17 countries), plus the list of countries where the card cannot be used to spend.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true
          }
        ],
        "conversion": "at_spend",
        "note": "The user deposits USDC into a Loan Escrow contract, which creates a USD credit balance on the card; each purchase reduces that balance, and Avici liquidates the spent USDC from the contract every one to two days (sometimes weekly) to settle with Visa. Conversion is therefore of the spent amount after authorisation, in batches, rather than one sale per swipe. The docs say the contract is on an EVM chain and accepts deposits from Solana but name neither the chain nor the contract address, so no chain or address is recorded.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.avici.money/getting-started/secured-credit-cards",
            "detail": "The docs say users deposit USDC into a Loan Escrow contract that backs a USD credit balance on the card.",
            "quote": "User deposits USDC in a Loan Escrow smart contract",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.avici.money/getting-started/secured-credit-cards",
            "detail": "Avici liquidates the spent USDC from the card contract every one to two days or weekly and settles with Visa.",
            "quote": "we liquidate the spent USDC amount from the card contract",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "avici.money (terms, card terms, privacy) and docs.avici.money (all pages; no audit mentioned), the Avici-Labs GitHub org (no card or escrow code), ZeroDev's audits page and the audits/ folder of github.com/zerodevapp/kernel, Rain's security page and the Sherlock report repo. No audit of Avici's Loan Escrow contract, app or relayer is published. Logged are the Kernel v3 reports; the older Kernel v1/v2, recovery and WebAuthn plugin reports by KALOS in the same folder are not, since Avici does not publish which Kernel version its wallets run. Sumsub, Third National and Visa publish no code audits.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Felix Kim (independent auditor)",
            "date": "2024-06",
            "type": "audit",
            "scope": "Shared component: ZeroDev Kernel v3.0-to-3.x changes (incremental, the v3.1 release) plus WebAuthn, MultiChain WebAuthn and Weighted validators and the SpendingLimit hook",
            "url": "https://github.com/zerodevapp/kernel/blob/release/v3.3/audits/v_3_1_incremental_audit.pdf",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "unknown",
            "findings": "3 minor (validator and hook issues)",
            "note": "Audit period 27 May-9 June 2024; reviews only the diff from v3.0. Avici's docs say its EVM wallet is built on ZeroDev but give no wallet address or Kernel version."
          },
          {
            "auditor": "KALOS",
            "date": "2024-04-12",
            "type": "audit",
            "scope": "Shared component: ZeroDev Kernel v3 KernelFactory and FactoryStaker",
            "url": "https://github.com/zerodevapp/kernel/blob/main/audits/kalos_v3_plugins.pdf",
            "commit": "85617952ec4cdf8d6478a9139540968fb92a6f10",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "unknown",
            "findings": "No security issues found",
            "note": "The file is named kalos_v3_plugins but its scope is the factory contracts."
          },
          {
            "auditor": "ChainLight (Theori)",
            "date": "2024-04-05",
            "type": "audit",
            "scope": "Shared component: ZeroDev Kernel v3.0 (ERC-7579 smart account) core and validation modules",
            "url": "https://github.com/zerodevapp/kernel/blob/main/audits/chainlight_v3_0.pdf",
            "commit": "8646f2c25f2727019d91cbfb43f9c5688acc6fc2",
            "repo": "https://github.com/zerodevapp/kernel_v3",
            "covers_deployed": "unknown",
            "findings": "2 high, 2 medium, 3 low, 5 informational",
            "note": "Audit started 11 March 2024 on kernel_v3 commits 5f086737 and 8646f2c2."
          },
          {
            "auditor": "Sherlock",
            "date": "2025-02-11",
            "type": "contest",
            "scope": "Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest",
            "url": "https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2025.02.11%20-%20Final%20-%20Rain%20Private%20Best%20Efforts%20Audit%20Contest%20Report.pdf",
            "commit": "6f578d5b9c9fa35bbe857959a50fa5aab4fa611a",
            "repo": "https://github.com/SignifyHQ/collateral-contract-evm-v2",
            "covers_deployed": "unknown",
            "findings": "0 high, 2 medium (statement payoff rounding; missing Chainlink min/max answer check)",
            "note": "Logged because the card is issued by Third National (a Rain affiliate) under Rain-template card terms with an EVM collateral contract. Avici does not name Rain or say whether its Loan Escrow is Rain's collateral contract, so this may not apply. The Rain repo is private; contest ran 2-8 December 2024."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 11,
        "unk": 12,
        "total": 23
      }
    },
    {
      "slug": "aztec",
      "name": "Aztec (Alpha mainnet private token transfers)",
      "type": "transfer",
      "website": "https://aztec.network",
      "primary_chain": {
        "name": "Aztec mainnet (Alpha)",
        "caip2": "aztec:mainnet",
        "basis": "Aztec is a privacy L2 with its own state, sequencers and provers, settling to Ethereum. Unit: the mainnet the node follows. AztecProtocol/networks network_config.json L21-L32 names Registry 0x35b2…e298 on chain 1, whose canonical rollup is 0x91fF…8E34 (v5, Ethereum block 26,153,545). Scope: private transfers in tokens built on the reference Token contract. Excluded: testnet, older rollup versions, Fee Juice (not transferable). aztec:mainnet is not a registered CAIP-2 namespace."
      },
      "repos": [
        {
          "url": "https://github.com/AztecProtocol/aztec-packages",
          "role": "contracts",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/AztecProtocol/networks",
          "role": "deploy",
          "license": "none"
        }
      ],
      "contracts": [],
      "components": [
        {
          "name": "Aztec L1 rollup contracts on Ethereum (Registry, Rollup v5, Inbox, Outbox)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Aztec Governance (Registry owner; Rollup parameter owner)",
          "required": true,
          "repo": "https://github.com/AztecProtocol/aztec-packages"
        },
        {
          "name": "Aztec L2 network (staked sequencer committee, provers, escape hatch)",
          "role": "ledger",
          "public": true,
          "license": "Apache-2.0",
          "operator": "3,085 staked attesters at Ethereum block 26,153,545; permissionless provers",
          "required": true,
          "repo": "https://github.com/AztecProtocol/aztec-packages"
        },
        {
          "name": "Ethereum mainnet (L1 settlement and data availability)",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Ethereum validators",
          "required": true,
          "repo": "https://github.com/ethereum/go-ethereum"
        },
        {
          "name": "Aztec node (own, or someone else's), with an Ethereum execution and beacon RPC",
          "role": "backend",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user or node operator",
          "required": true,
          "repo": "https://github.com/AztecProtocol/aztec-packages"
        },
        {
          "name": "PXE and wallet (aztec.js, wallet-sdk, aztec-wallet CLI)",
          "role": "wallet",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/AztecProtocol/aztec-packages"
        },
        {
          "name": "Fee Juice and FeeJuicePortal (non-transferable fee asset bridged from L1)",
          "role": "other",
          "public": true,
          "license": "Apache-2.0",
          "operator": "none (portal immutable); fee asset bridged from the AZTEC L1 token",
          "required": true,
          "repo": "https://github.com/AztecProtocol/aztec-packages"
        },
        {
          "name": "Token contract and L1 portal of the asset being paid (third-party)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "token and bridge owners (e.g. Nyx.money TokenVaultPortal, Ownable)",
          "required": true,
          "repo": "https://github.com/AztecProtocol/aztec-packages"
        },
        {
          "name": "Aztec Governance and GovernanceProposer (sequencer signalling, token vote)",
          "role": "other",
          "public": true,
          "license": "Apache-2.0",
          "operator": "AZTEC token holders and sequencers",
          "required": false,
          "repo": "https://github.com/AztecProtocol/aztec-packages"
        },
        {
          "name": "Aztec Labs hosted RPC (mainnet.rpc.aztec-labs.com, Cloud Armor policy)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Aztec Labs",
          "required": false
        },
        {
          "name": "Network config and snapshot hosts (networks repo, aztec-labs-snapshots.com)",
          "role": "other",
          "public": true,
          "license": "none",
          "operator": "Aztec Labs",
          "required": false,
          "repo": "https://github.com/AztecProtocol/networks"
        },
        {
          "name": "Third-party browser wallets and fee payment contracts (not reviewed)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "wallet and FPC developers",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/l1-contracts/src/core/RollupCore.sol#L265-L345",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "l1-contracts/src/core/RollupCore.sol",
              "detail": "The Rollup's owner-only functions set reward config, mana target, proving cost, staking-queue config, a time-delayed slasher swap and a set-once escape hatch; there is no pause, freeze or blacklist. Read on Ethereum at block 26,153,545 (not recordable as onchain evidence here, see notes) with cast, Rollup 0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34 owner() = Governance 0x1102471Eb3378FEE427121c9EfcEa452E4B6B75e, getEscapeHatch() = 0xF459348962F5eA3A9A101826B03A2CE1F459E51A.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34 \"owner()(address)\" --rpc-url https://ethereum-rpc.publicnode.com; cast call 0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34 \"getEscapeHatch()(address)\" --rpc-url https://ethereum-rpc.publicnode.com"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/l1-contracts/src/core/EscapeHatch.sol#L19-L30",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "l1-contracts/src/core/EscapeHatch.sol",
              "detail": "The escape hatch lets a bonded, randomly chosen candidate propose blocks during periodic windows, bypassing the sequencer committee.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr#L62-L77",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr",
              "detail": "The reference L2 Token contract's admin can change the admin and minters; it has no pause or blacklist.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "The rollup contracts have no pause, freeze or blacklist, the Rollup is not a proxy, and the reference Token contract has none either. The committee of staked sequencers can censor by omission, but the escape hatch gives a bonded outsider periodic block-production windows. Any particular token on Aztec is deployed by a third party whose contracts may add controls; the one bridge we sampled (Nyx.money TokenVaultPortal) is Ownable. Judgment call: the substance supports 3 for the protocol layer, but the rollup contracts live on Ethereum while this row's chain is aztec:mainnet, so the dashboard cannot record the onchain reads as onchain evidence (see notes), and third-party token controls are unknown; we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr#L271-L277",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr",
              "detail": "transfer_in_private moves a private balance from one account to another, authorised by the sender's account (authorize_once); the user's PXE proves it locally and submits it to any node.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 271,277p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/yarn-project/cli/src/utils/commands.ts#L35-L40",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "yarn-project/cli/src/utils/commands.ts",
              "detail": "The CLI's node option defaults to http://localhost:8080, the user's own node.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "A payer proves a private transfer in their own PXE and sends it to any Aztec node, which gossips it to the sequencers; no company API or signature is needed. Judgment call: anchor 3 needs onchain evidence about deployed contracts that this row's chain id cannot carry, and the token contract being paid is third-party, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-operate/operators/full-node/setup.md#L8-L109",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "docs/docs-operate/operators/full-node/setup.md",
              "detail": "The repo documents running a full node against the user's own Ethereum execution and beacon endpoints; the CLI defaults to a local node.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/docs/docs-operate/operators/full-node/setup.md?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 8,48p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/l1-contracts/src/core/EscapeHatch.sol#L19-L30",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "l1-contracts/src/core/EscapeHatch.sol",
              "detail": "Block production is by a committee of 48 drawn from 3,085 staked attesters (getTargetCommitteeSize, getActiveAttesterCount on Rollup 0x91fF…8E34 at Ethereum block 26,153,545), with the escape hatch as fallback.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No relayer, paymaster or company API is required. Users can run their own node from public code, sequencing and proving are open to stakers and provers, and the escape hatch is a fallback if the committee censors. Fees need Fee Juice bridged from L1, which is a protocol asset rather than a service. Aztec Labs' hosted RPC, network-config and snapshot hosts are conveniences with overrides.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-developers/docs/aztec-js/how_to_use_private_fee_juice.md#L25-L27",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "docs/docs-developers/docs/aztec-js/how_to_use_private_fee_juice.md",
              "detail": "Nodes apply a protocol-level allowlist of public functions callable in a transaction's setup phase; it filters functions, not addresses or countries.",
              "checked_at": "2026-10-09",
              "recheck": "gh search code --repo AztecProtocol/aztec-packages sanction --json path --jq '.[].path'; gh search code --repo AztecProtocol/aztec-packages geoblock --json path --jq '.[].path'"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/l1-contracts/src/core/RollupCore.sol#L265-L345",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "l1-contracts/src/core/RollupCore.sol",
              "detail": "The rollup checks proofs and attestations; it has no address or country rule. Code search on 2026-10-09 found no sanctions or geoblocking code (the only country hit is a testnet mock staking handler).",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Settlement is neutral: the rollup and the reference token have no address or country checks, and private senders and recipients are not visible to sequencers. The setup-phase allowlist restricts which public functions may run before fees are paid, which shapes fee payment but does not target users. Aztec Labs' hosted RPC sits behind a Cloud Armor policy (spartan/environments/mainnet.env) whose rules are not public. Judgment call: 2, not 3, because 3 needs a distributed-package or trace record and because the hosted RPC's filtering is undisclosed (users can avoid it by running a node).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/noir-projects/noir-contracts/contracts/protocol/fee_juice_contract/src/main.nr#L11-L12",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "noir-projects/noir-contracts/contracts/protocol/fee_juice_contract/src/main.nr",
              "detail": "The protocol's own asset, Fee Juice, can only be bridged in, not withdrawn or transferred, so every payment uses a third-party token.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/networks/contents/network_config.json?ref=7182c14bbb32f5af995e06edcec0690633acae4a\" --jq .content | base64 -d | sed -n 21,33p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/networks/blob/7182c14bbb32f5af995e06edcec0690633acae4a/network_config.json#L21-L33",
              "commit": "7182c14bbb32f5af995e06edcec0690633acae4a",
              "path": "network_config.json",
              "detail": "The mainnet network config lists bootnodes, snapshot hosts, the Registry and the L1 chain, and no token list. Recent L1-to-L2 messages (Ethereum blocks 26,144,545 to 26,153,545) came from an OperationExecutor 0xe883…9e19 and a TokenVaultPortal 0xD0b1…80d0 by Nyx.money, both Sourcify exact matches; the portal is Ownable.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The rail does not enumerate the tokens a payee might receive: Fee Juice cannot be transferred, and payable assets are app-deployed token contracts bridged through third-party portals with their own owners, which the protocol neither lists nor describes. The sequencer, escape-hatch and upgrade assumptions are stated in the Alpha documentation. Scored 0: tokens not enumerated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/tree/49a592109ec4f18d79212b43d621891aaf36f7b6/l1-contracts/src",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "l1-contracts/src",
              "detail": "Sourcify on 2026-10-09 returns match (partial) for Registry 0x35b2…e298, Rollup 0x91fF…8E34, Governance 0x1102…B75e, GovernanceProposer 0x06Ef…63ef, GSE 0xa92e…7a4f, Inbox 0x7d4E…b8cA, Outbox 0x5B06…A2D7, FeeJuicePortal 0xaf73…691c, EscapeHatch 0xF459…E51A, Slasher 0xCD68…2548 and the AZTEC token 0xA27E…62D2, all on Ethereum.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0x35b22e09Ee0390539439E24f06Da43D83f90e298 0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34 0x1102471Eb3378FEE427121c9EfcEa452E4B6B75e 0x7d4Ef0676c2032bbCC09227501D34d86641ab8cA 0x5B062aB5fD3A66BC7e73b04CeD38587673b6A2D7 0xaf73Dd51D1eb8a079BB097f39c832cDD00ac691c; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/1/$a | jq -r .match; done"
            }
          ],
          "finding": "All L1 rollup and governance contracts are partial matches on Sourcify. We did not check L2 contract classes (the token contracts users pay with) against source, and attempted no rebuild. Scored 2: partial matches.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/tree/49a592109ec4f18d79212b43d621891aaf36f7b6/yarn-project",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "yarn-project",
              "detail": "The monorepo at v5.2.0 contains the node, sequencer, prover, PXE, aztec.js, wallet-sdk and CLI wallet (yarn-project), the L1 contracts (l1-contracts), Noir protocol and app contracts (noir-projects), the proving backend (barretenberg) and network deployment (spartan).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/yarn-project?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq '.[].name'"
            }
          ],
          "finding": "The whole protocol stack is public in one Apache-2.0 monorepo, including node, sequencer, prover, client, contracts and deploy tooling. The hosted RPC's access policy and third-party browser wallets are not public, but neither is needed. Judgment call: we score the stack a user needs, not the hosted conveniences, at 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-operate/operators/full-node/setup.md#L8-L109",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "docs/docs-operate/operators/full-node/setup.md",
              "detail": "Step-by-step Docker Compose setup for a mainnet full node, with required environment variables.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Node setup documentation exists in the repo. Reproduction not attempted, so the score is capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr#L271-L300",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr",
              "detail": "Contract interfaces (Noir ABIs generated from source, L1 ABIs in l1-artifacts) and the node's typed API schemas (stdlib) are in the repo; a Transfer event is emitted for private transfers.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 271,300p"
            }
          ],
          "finding": "ABIs, events and the node API schema are versioned in the repo. We found no payee export format in the wallet tooling. Scored 2: interfaces present, export absent.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/LICENSE",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "LICENSE",
              "detail": "aztec-packages is Apache-2.0; AztecProtocol/networks (the default network config) has no licence file.",
              "checked_at": "2026-10-09",
              "recheck": "for r in aztec-packages networks; do echo $r $(gh api repos/AztecProtocol/$r --jq '.license.spdx_id // \"none\"'); done",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Everything needed to run the protocol is Apache-2.0. The network-config repo the node reads by default has no licence; the same mainnet values are compiled into the CLI (chain_l2_config.ts), so it is not critical. Scored 2: one non-critical repo unlicensed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/LICENSE",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "LICENSE",
              "detail": "The LICENSE file changed from GPL-2.0 to Apache-2.0 in commit 356db7c7 (2023-02-28), four days after the initial commit, and its copyright holder changed to Aztec Foundation in 82e3c33d (2026-10-06); CONTRIBUTING.md mentions no CLA.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/commits?path=LICENSE&per_page=10\" --jq '.[]|[.sha[0:8],.commit.author.date,.commit.message[0:60]]|@tsv'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no CLA and no licence-stability commitment. The monorepo's licence changed from GPL-2.0 to Apache-2.0 days after the repo was created, before any release. Judgment call: anchor 0 names any prior relicense event; this one was early and permissive, but under the take-the-lower-anchor rule we score 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/yarn-project/cli/src/utils/commands.ts#L35-L40",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "yarn-project/cli/src/utils/commands.ts",
              "detail": "The client defaults to a local node; the node needs only Ethereum endpoints the operator chooses.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/yarn-project/cli/src/utils/commands.ts?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 35,40p"
            }
          ],
          "finding": "A production setup (own node, PXE, wallet) needs no proprietary plugin; hosted RPC, snapshots and third-party wallets are optional. Judgment call: the code supports 3, but with no O3 reproduction we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/yarn-project/pxe/package.json#L1-L120",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "yarn-project/pxe/package.json",
              "detail": "No analytics, telemetry or error-reporting dependency in the pxe, aztec.js, wallet-sdk or cli-wallet manifests; the node's OpenTelemetry export is operator-side and needs an endpoint configured.",
              "checked_at": "2026-10-09",
              "recheck": "for p in pxe aztec.js wallet-sdk cli-wallet; do gh api \"repos/AztecProtocol/aztec-packages/contents/yarn-project/$p/package.json?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | jq -r '.dependencies|keys[]' | grep -iE 'telemetry|sentry|analytics|posthog'; done",
              "package": {
                "name": "@aztec/aztec.js",
                "version": "5.2.0",
                "integrity": "sha512-vQg1KZEqukjPXvF1UDjEHNhqhDzW+LPHSUCZu9VgFZ3XkLmmEv3qMCPbrsam6/bZZQ7oy+m12xExXlXb9kqhlg=="
              }
            }
          ],
          "finding": "The client libraries ship no analytics or telemetry. Third-party browser wallets were not inspected. Judgment call: absence shown in code and the published package, without a trace, is capped at 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr#L271-L277",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr",
              "detail": "A private transfer takes sender, recipient, amount and an authorisation nonce; nothing else.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 271,277p"
            }
          ],
          "finding": "The protocol and reference token collect only what settlement needs, and no required component holds identity data. A third-party node, if used, sees the user's IP and queries (P4).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-developers/docs/aztec-js/how_to_use_private_fee_juice.md#L67-L70",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "docs/docs-developers/docs/aztec-js/how_to_use_private_fee_juice.md",
              "detail": "Private calldata and identities are hidden, but the transaction's fee payer address is recorded onchain by the protocol.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/docs/docs-developers/docs/aztec-js/how_to_use_private_fee_juice.md?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 67,70p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-developers/docs/resources/considerations/limitations.md#L30-L37",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "docs/docs-developers/docs/resources/considerations/limitations.md",
              "detail": "msg_sender leaks on private-to-public calls by default, and the counts of public calls and L2-to-L1 messages remain visible.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "A private token transfer hides the recipient and amount. Unless the payer uses a private fee payment contract, the payer's own account pays the fee and is recorded publicly as fee payer, so the chain shows who sent a private transaction, though not to whom. Side-effect counts give transaction fingerprints, and the docs warn that the zk property is not yet guaranteed. All of this is documented. Judgment call: minimal, documented linkage is anchor 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-developers/docs/resources/considerations/limitations.md#L69-L73",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "docs/docs-developers/docs/resources/considerations/limitations.md",
              "detail": "The docs state there are no privacy-preserving queries to third-party nodes; a user who queries someone else's node may reveal who they are and their activity.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/yarn-project/cli/src/utils/commands.ts?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 35,40p"
            }
          ],
          "finding": "With a local node, only the user's Ethereum endpoints see anything. With a remote node (for example Aztec Labs' hosted RPC), that operator sees the user's IP, the transactions they send and the notes and logs they query. The node URL is named in code and swappable. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/yarn-project/cli/src/utils/commands.ts#L35-L40",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "yarn-project/cli/src/utils/commands.ts",
              "detail": "The node URL is a CLI option and AZTEC_NODE_URL environment variable; the node, which also serves as the indexer, is public code.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/yarn-project/cli/src/utils/commands.ts?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 35,40p"
            }
          ],
          "finding": "The data endpoint is configurable in the client, and the node that serves it is public. Scored 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr#L271-L277",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr",
              "detail": "A private transfer nullifies the sender's notes and creates notes owned by the recipient in the same transaction.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 271,277p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-developers/docs/resources/considerations/limitations.md#L51-L61",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "docs/docs-developers/docs/resources/considerations/limitations.md",
              "detail": "The docs say some complex circuits are still under-constrained, so proof soundness is not guaranteed.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Funds move directly between users' notes; no one holds them in flight. The L1 backing of a bridged token sits in that token's portal, controlled by its owner, and the rollup's correctness rests on circuits the project itself calls under-constrained. Judgment call: direct transfer is anchor 3 in substance, but 3 needs onchain evidence this row cannot carry, and the soundness caveat argues against the top score; we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/l1-contracts/src/governance/Governance.sol#L402-L407",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "l1-contracts/src/governance/Governance.sol",
              "detail": "Only the GovernanceProposer (sequencer signalling, 600 of 1,000 slots per round) can propose; execute() (L488-L506) runs arbitrary calls except to the governance asset. Read on Ethereum at block 26,153,545 with cast getConfiguration() on 0x1102…B75e - votingDelay 259200 s, votingDuration 604800 s, executionDelay 172800 s, gracePeriod 604800 s, quorum 20%, yea margin 33%; proposalCount 5.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x1102471Eb3378FEE427121c9EfcEa452E4B6B75e \"getConfiguration()((uint256,uint256),uint256,uint256,uint256,uint256,uint256,uint256,uint256)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/l1-contracts/src/governance/Registry.sol#L59-L109",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "l1-contracts/src/governance/Registry.sol",
              "detail": "Upgrades add a new rollup version to the Registry (owner-only addRollup); Registry owner() and getGovernance() both return Governance 0x1102…B75e, numberOfVersions() is 3, and the Rollup's EIP-1967 implementation and admin slots are zero (no proxy) at block 26,153,545.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-participate/alpha.md#L60-L76",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "docs/docs-participate/alpha.md",
              "detail": "The Alpha page says a new rollup version becomes canonical while the old one stays accessible for bridging out, state does not carry over, and applications must redeploy.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Deployed rollup code cannot be changed in place: upgrades register a new rollup version, which needs sequencer signalling plus an AZTEC token vote, at least 12 days from proposal to execution (3-day delay, 7-day vote, 2-day execution delay), far longer than the roughly one-epoch exit to L1. The old rollup stays usable for exits. But state does not migrate, so users must move funds at each upgrade, and governance execution can call any contract. Judgment call: the timelock exceeds the user exit and the notice channel is the Alpha docs, which supports 3 in substance; we take 2 because 3 needs onchain evidence this row cannot carry and because forced migrations shift work and risk onto users.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr#L258-L277",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr",
              "detail": "Spending on another's behalf uses authwits (authorize_once) that authorise one exact call with a nonce and can be cancelled (cancel_authwit); the token has no standing allowance.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/noir-projects/noir-contracts/contracts/app/token_contract/src/main.nr?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 258,277p"
            }
          ],
          "finding": "The reference token uses one-time authorisations for an exact action instead of allowances, and a direct transfer needs none. Judgment call: anchor 3 in substance, but 3 needs a distributed-package or trace record for the client, so we take 2; third-party tokens may differ.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/l1-contracts/src/core/EscapeHatch.sol#L19-L30",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "l1-contracts/src/core/EscapeHatch.sol",
              "detail": "If the committee stops including a user's transactions, escape-hatch windows let a bonded candidate produce blocks; Outbox and FeeJuicePortal have no owner.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34 \"getEscapeHatch()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=2, C2=2, C3=3 and O3=1. Funds are notes under the user's keys (S1), any node accepts a transaction (C2), and no company service is required (C3). If Aztec Labs disappeared, users could run a node and exit through the token's portal and the ownerless Outbox. Fee Juice cannot be withdrawn at all, and a bridged token's exit depends on its portal owner. We did not reproduce a self-hosted setup (O3=1). Judgment call: 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/yarn-project/cli/src/utils/commands.ts#L28-L40",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "yarn-project/cli/src/utils/commands.ts",
              "detail": "Keys and API keys come from the user's environment (PRIVATE_KEY, MNEMONIC, API_KEY); nothing is bundled.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/yarn-project/cli/src/utils/commands.ts?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | sed -n 28,40p"
            }
          ],
          "finding": "Account keys stay in the user's PXE, and the protocol has no webhooks. The limitations page warns that the PXE does not yet enforce which apps can read a user's private data. Judgment call: 2, since 3 needs a package or trace record and the PXE data-access caveat is documented.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/audit-reports/tree/b3b60cefe2d136763d841957daa5e9bfcff0421f/l1-contracts",
              "commit": "b3b60cefe2d136763d841957daa5e9bfcff0421f",
              "path": "l1-contracts",
              "detail": "Cantina reports on the rollup contracts, governance, escape hatch and staking registry, Veridise on governance, and a governance formal verification are published; Barretenberg primitives have separate reports.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/SECURITY.md#L1-L12",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "path": "SECURITY.md",
              "detail": "SECURITY.md says a limited-scope bug bounty is being prepared and also links a Cantina bounty page for submissions; scope is not in the repo.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Audit reports exist for the L1 contracts and parts of the proving library, but we did not read them for pinned commits, and the project's own docs say no part of the stack has been fully audited and some circuits are under-constrained. A bounty page is linked, with scope outside the repo. Scored 1: reports only, nothing pinned.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "The rollup contracts and reference token have no country rule, and the node, PXE, aztec.js and CLI wallet contain no country or geolocation gate (code search on 2026-10-09; the only country hit is a testnet mock staking handler). Aztec Labs' hosted mainnet RPC (mainnet.rpc.aztec-labs.com) runs behind a Google Cloud Armor policy named in spartan/environments/mainnet.env whose rules are not public, so it may filter by region; users avoid it by running a node. Third-party wallets, bridges and token issuers may impose their own limits, which we did not evidence. Legality of use varies by jurisdiction; that is not an availability restriction by the protocol.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/spartan/environments/mainnet.env#L1-L30",
            "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
            "path": "spartan/environments/mainnet.env",
            "detail": "The hosted mainnet RPC is configured with RPC_CLOUD_ARMOR_POLICY_NAME=mainnet-rpc-policy; the policy's rules are not in the repo.",
            "checked_at": "2026-10-09",
            "recheck": "gh api \"repos/AztecProtocol/aztec-packages/contents/spartan/environments/mainnet.env?ref=49a592109ec4f18d79212b43d621891aaf36f7b6\" --jq .content | base64 -d | grep -n ARMOR"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/yarn-project/cli/src/utils/commands.ts#L35-L40",
            "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
            "path": "yarn-project/cli/src/utils/commands.ts",
            "detail": "The client connects to a node URL of the user's choice (default localhost) with no location check.",
            "checked_at": "2026-10-09",
            "recheck": "gh search code --repo AztecProtocol/aztec-packages geoblock --json path --jq '.[].path'"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: Aztec Alpha mainnet private token transfers. Pins: aztec-packages@49a59210 (v5.2.0; v5.2.1 changes only barretenberg), networks@7182c14b, audit-reports@b3b60cef. Ethereum reads at block 26,153,545 via publicnode: Registry 0x35b22e09Ee0390539439E24f06Da43D83f90e298, canonical Rollup 0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34 (proven checkpoint 99,016, pending 99,048), Governance 0x1102471Eb3378FEE427121c9EfcEa452E4B6B75e, GovernanceProposer 0x06Ef1DcF87E419C48B94a331B252819FADbD63ef, EscapeHatch 0xF459348962F5eA3A9A101826B03A2CE1F459E51A. These are Ethereum (chain 1) contracts, but this row's primary chain is aztec:mainnet, and the validator requires onchain evidence to match the primary chain, so the reads are recorded in repo evidence details with cast rechecks and contracts is empty; C1, C2, S1 and S2 are capped at 2 for that reason. No transactions, node runs, builds, traces or self-host attempts were made.",
      "audits": {
        "searched": "github.com/AztecProtocol/audit-reports at b3b60cef (l1-contracts, Barretenberg and TGE folders), SECURITY.md and barretenberg/cpp/scripts/audit (scope files, not reports) in aztec-packages, the noir-lang/noir repo (no audits folder), and the Trail of Bits publications list. Not listed: the TGE reports (Spearbit, zkSecurity), Cantina's Soulbound, Uniswap TWAP, Protocol Treasury, Coinissuer and Ignition staking-registry reviews, which cover token-sale, treasury, reward and staking contracts outside the transfer path; Trail of Bits' 2019 review of the earlier AZTEC Protocol; and Aztec Connect audits (a retired product). No published audit of the protocol circuits, PXE or Noir compiler was found; the docs say the stack is not fully audited.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Cyfrin",
            "date": "2026-04-06",
            "type": "audit",
            "scope": "Barretenberg stdlib logic module (in-circuit AND/XOR constraints), part of the proving system.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/Barretenberg/stdlib_primitives/Logic/cyfrin-stdlib-logic.pdf",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "4 low, 4 informational",
            "note": "Shared proving-system code; the report gives no commit, so we could not match it to v5.2.0."
          },
          {
            "auditor": "Cantina",
            "date": "2026-03-05",
            "type": "review",
            "scope": "Alpha upgrade payload and deployment (DeployAlpha.s.sol, run_alpha_upgrade.sh, AlphaPayload.sol, AlphaVerifier.sol) plus PR 21066 updating the verification-key tree root.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/l1-contracts/Cantina%20-%20Payload%202025.03.05.pdf",
            "commit": "ed3f61d6",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "unknown",
            "findings": "1 high (fixed), 4 informational (acknowledged)",
            "note": "The file name says 2025.03.05; the report is dated March 5, 2026 (Aztec PR 20865)."
          },
          {
            "auditor": "Cantina",
            "date": "2026-02-24",
            "type": "audit",
            "scope": "L1 EscapeHatch contract (forced exit path when the sequencer set censors).",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/l1-contracts/Cantina%20-%20Escape%20Hatch.pdf",
            "commit": "0092f9f0",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "1 high, 6 medium, 5 low, 3 gas, 16 informational; 16 fixed, 15 acknowledged",
            "note": "Audited before the v5.2.0 release (49a59210) used for this assessment; we did not diff EscapeHatch.sol."
          },
          {
            "auditor": "Sherlock",
            "date": "2026-01",
            "type": "audit",
            "scope": "Barretenberg cycle_group (Grumpkin in-circuit curve operations) and RAM/ROM memory modules.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/Barretenberg/stdlib_primitives/RAM%20ROM/Sherlock_CycleGroup_RAMROM_Final_Report.pdf",
            "commit": "c58cd76497e68c2236d875e7eac424f4b2d7bbd5",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "1 high, 4 medium, 3 low/info; all resolved or acknowledged",
            "note": "Audited January 14 to 28, 2026; fix review at 6b858739."
          },
          {
            "auditor": "Cantina",
            "date": "2025-12-16",
            "type": "audit",
            "scope": "Barretenberg stdlib field primitive.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/Barretenberg/stdlib_primitives/Field/Cantina-Field-Audit.pdf",
            "commit": "458fb330",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "3 low, 14 informational; all fixed"
          },
          {
            "auditor": "Cantina",
            "date": "2025-11-12",
            "type": "audit",
            "scope": "L1 rollup contracts at the stated commit (findings span the Rollup, Outbox and related libraries) and the EmpireSlashingProposer change (PR 16357).",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/l1-contracts/Cantina%20-%20Rollup%20Contracts.pdf",
            "commit": "270e2a58ae2a378472f9be791900bbd4342c7881",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "1 critical, 2 high, 6 medium, 6 low, 1 gas, 7 informational; 15 fixed, 8 acknowledged",
            "note": "The deployed Rollup v5 was built from a later commit (v5.2.0, 49a59210); we did not diff the contracts."
          },
          {
            "auditor": "Cantina",
            "date": "2025-11-12",
            "type": "audit",
            "scope": "L1 governance contracts (findings span Governance, the EmpireBase signalling used by GovernanceProposer, and GSE).",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/l1-contracts/Cantina%20-%20Governance.pdf",
            "commit": "6496e59d",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "4 medium, 6 low, 1 gas, 9 informational; 15 fixed, 4 acknowledged"
          },
          {
            "auditor": "Cantina",
            "date": "2025-11-10",
            "type": "audit",
            "scope": "Barretenberg stdlib bool and byte_array primitives.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/Barretenberg/stdlib_primitives/Bool%20and%20Bytearray/Cantina-Bool-Bytearray-Audit.pdf",
            "commit": "72f52e7b",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "2 critical, 3 medium, 5 low, 5 informational; all fixed"
          },
          {
            "auditor": "Veridise",
            "date": "2025-10-13",
            "type": "audit",
            "scope": "L1 governance contracts, including GSE and the BN254 library.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/l1-contracts/Veridise%20-%20Governance.pdf",
            "commit": "a6eebac",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "10 issues, 1 medium"
          },
          {
            "auditor": "Veridise",
            "date": "2025-09-18",
            "type": "audit",
            "scope": "Barretenberg bigfield (non-native field arithmetic) in the proving system.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/Barretenberg/stdlib_primitives/Bigfield/Veridise_Bigfield_Final_Report.pdf",
            "commit": "480f49d",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "9 issues, none high or critical; 3 low"
          },
          {
            "auditor": "Igor Konnov and Thomas Pani",
            "date": "2025-09-15",
            "type": "formal_verification",
            "scope": "Formal verification (Quint/TLA+) of the L1 governance contracts EmpireBase, GovernanceProposer, Governance, GSE and SlashingProposer.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/l1-contracts/Igor%20Konnov%2C%20Thomas%20Pani%20-%20Governance%20Formal%20Verification.pdf",
            "commit": "8b10b2b2",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "0 critical, 0 high, 5 medium, 3 low, 6 informational",
            "note": "Commit range ffc8af0c to 8b10b2b2."
          },
          {
            "auditor": "Cantina",
            "date": "2024-10-04",
            "type": "audit",
            "scope": "Barretenberg bigfield, one of three parallel reviews of the same commit.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/Barretenberg/stdlib_primitives/Bigfield/Test%20Bigfield%20Audit/Cantina%20Audit%20Report%20-%20Barretenberg%20Bigfield.pdf",
            "commit": "4ba553ba",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "2 critical, 1 high, 2 medium, 2 low, 10 informational",
            "note": "Superseded in part by Veridise's 2025 bigfield audit."
          },
          {
            "auditor": "Zellic",
            "date": "2024-07-25",
            "type": "audit",
            "scope": "Barretenberg bigfield proof circuit.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/Barretenberg/stdlib_primitives/Bigfield/Test%20Bigfield%20Audit/Zellic%20Audit%20Report%20-%20Barretenberg%20Bigfield.pdf",
            "commit": "d9ca76a2",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly",
            "findings": "5 critical, 2 high, 8 low, 2 informational"
          },
          {
            "auditor": "zkSecurity",
            "date": "2024-07-01",
            "type": "audit",
            "scope": "Barretenberg bigfield and field modules.",
            "url": "https://github.com/AztecProtocol/audit-reports/blob/b3b60cefe2d136763d841957daa5e9bfcff0421f/Barretenberg/stdlib_primitives/Bigfield/Test%20Bigfield%20Audit/ZKSecurity%20Audit%20Report%20-%20Barretenberg%20Bigfield.pdf",
            "commit": "4ba553ba31",
            "repo": "https://github.com/AztecProtocol/aztec-packages",
            "covers_deployed": "partly"
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C5"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F2"
          ]
        },
        "P": {
          "score": 2,
          "limiting": [
            "P1",
            "P3",
            "P4"
          ]
        },
        "S": {
          "score": 1,
          "limiting": [
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 19,
        "short": 4,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "bitget-wallet-card",
      "name": "Bitget Wallet Card",
      "type": "card",
      "website": "https://web3.bitget.com/card",
      "primary_chain": {
        "name": "Arbitrum One",
        "chain_id": 42161,
        "basis": "The only card program tied to a contract is the Fiat24-issued \"Bitget Wallet Card (Fiat24)\" (Mainland China; closed to new signups, existing cards active). Onchain, Fiat24Account.walletProviderMap(8088) = \"Bitget\", and Bitget-referred accounts (e.g. #119154) are debited by Fiat24CardAuthorization 0xe2e3B88B... at Arbitrum block 512546136. Excluded: the other regional programs (EEA/UK, LatAm, APAC, South Asia), whose issuers and funding contracts are not disclosed."
      },
      "repos": [],
      "contracts": [
        {
          "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
          "chain_id": 42161,
          "role": "Fiat24CardAuthorization proxy (card debits)",
          "verified": "sourcify"
        },
        {
          "address": "0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16",
          "chain_id": 42161,
          "role": "Fiat24CardAuthorizationMarqeta implementation",
          "verified": "sourcify"
        },
        {
          "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
          "chain_id": 42161,
          "role": "EUR24 cash token proxy",
          "verified": "sourcify"
        },
        {
          "address": "0xbE00f3db78688d9704BCb4e0a827aea3a9Cc0D62",
          "chain_id": 42161,
          "role": "USD24 cash token proxy",
          "verified": "sourcify"
        },
        {
          "address": "0xd41F1f0cf89fD239ca4c1F8E8ADA46345c86b0a4",
          "chain_id": 42161,
          "role": "CHF24 cash token proxy",
          "verified": "sourcify"
        },
        {
          "address": "0x7288Ac74d211735374A23707D1518DCbbc0144fd",
          "chain_id": 42161,
          "role": "CNH24 cash token proxy",
          "verified": "none"
        },
        {
          "address": "0x133CAEecA096cA54889db71956c7f75862Ead7A0",
          "chain_id": 42161,
          "role": "Fiat24Account NFT proxy (account status, limits)",
          "verified": "sourcify"
        },
        {
          "address": "0x4582f67698843Dfb6A9F195C0dDee05B0A8C973F",
          "chain_id": 42161,
          "role": "Fiat24 crypto top-up and FX proxy",
          "verified": "sourcify"
        },
        {
          "address": "0x50873C8501143e55349f9938795f69A2BB64b6ca",
          "chain_id": 42161,
          "role": "ProxyAdmin for all Fiat24 proxies (owner is an EOA)",
          "verified": "sourcify"
        },
        {
          "address": "0x40C57923924B5c5c5455c48D93317139ADDaC8fb",
          "chain_id": 42161,
          "role": "SanctionsList oracle read by the cash tokens",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Fiat24CardAuthorization contract (debits the cardholder's cash tokens)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "SR Saphirstein AG (Fiat24); admin EOA 0x1272...9D59",
          "required": true
        },
        {
          "name": "Fiat24 cash tokens EUR24, USD24, CHF24, CNH24 and Fiat24Account NFT",
          "role": "ledger",
          "public": true,
          "license": "MIT",
          "operator": "SR Saphirstein AG (Fiat24)",
          "required": true
        },
        {
          "name": "Fiat24 card authorizer key (sole AUTHORIZER_ROLE holder, an EOA)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "SR Saphirstein AG (Fiat24)",
          "required": true
        },
        {
          "name": "Fiat24 backend and API (api.fiat24.com; KYC, status, payouts)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "SR Saphirstein AG (Fiat24)",
          "required": true
        },
        {
          "name": "Marqeta card processing (named in the authorizer contract)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Marqeta",
          "required": true
        },
        {
          "name": "Fiat24 (SR Saphirstein AG) as card issuer and account provider",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "SR Saphirstein AG",
          "required": true
        },
        {
          "name": "Mastercard (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Mastercard",
          "required": true
        },
        {
          "name": "Fiat24 KYC and onboarding (vendor not named)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "SR Saphirstein AG (Fiat24)",
          "required": true
        },
        {
          "name": "Bitget Wallet app (Card tab, top-up, referrals)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Bitget Wallet",
          "required": false
        },
        {
          "name": "Cardholder's Arbitrum address holding the account NFT and cash tokens",
          "role": "wallet",
          "public": true,
          "license": "none",
          "operator": "Cardholder",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "block_number": 512546136,
              "detail": "EUR24 hasRole(OPERATOR_ROLE, 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59) = true; that address is an EOA (no code, nonce 1350) and also holds DEFAULT_ADMIN_ROLE, which can pause() the token. In the Sourcify-verified Fiat24Token source, transfers require the Fiat24Account status to be Live, and an operator can sendToSundry() any holder's balance.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d1485497667070c54ef182b0f5858b034beac1b6f3089aa2d3188bb1e8929f4fa9b9290000000000000000000000001272c99befa7a70f935edca81bf9a6e85c6d9d59",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA \"hasRole(bytes32,address)(bool)\" $(cast keccak OPERATOR_ROLE) 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59 --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "Fiat24CardAuthorization hasRole(DEFAULT_ADMIN_ROLE, 0x1272...9D59) = true and the same EOA holds OPERATOR_ROLE, which can pause() every card authorization; paused() = false at this block.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d1485400000000000000000000000000000000000000000000000000000000000000000000000000000000000000001272c99befa7a70f935edca81bf9a6e85c6d9d59",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59",
              "address": "0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59",
              "block_number": 512546136,
              "eoa": true,
              "detail": "The admin and operator address 0x1272...9D59 has no code (an EOA, not a Safe) and nonce 1350.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/payment-card-terms-and-conditions",
              "detail": "Fiat24's card terms let it block the card on suspicion, on breach, or on other grounds in the agreement or legislation.",
              "quote": "Fiat24 has the right to block the use of the Card until the circumstances have been verified",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "The account terms let Fiat24 suspend or close an account without notice on breach.",
              "quote": "We may at any time suspend or close your Fiat24 Account and/or end the agreement with you without notice",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A single EOA holds the admin and operator roles on the card authorizer and the cash tokens. It can pause card authorizations or all transfers of a currency, and Fiat24 operators can set an individual account to Soft- or Hard-Blocked, which the token contract enforces on every transfer. The terms allow card blocks and account suspension without notice. EOA-held role that can target individual accounts with no notice, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "authorize(), increment(), advice() and reverse() in the verified Fiat24CardAuthorizationMarqeta implementation each revert unless msg.sender has AUTHORIZER_ROLE; hasRole(AUTHORIZER_ROLE, 0xec659e857089E301C87965ED4839B74Ea835755a) = true, and that address is an EOA with nonce 7130096.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d1485414dd327f3834be9d0f7cf44f6cf11c96ded83bd68d1a1b3926d35739e7bb88d0000000000000000000000000ec659e857089e301c87965ed4839b74ea835755a",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14 \"hasRole(bytes32,address)(bool)\" $(cast keccak AUTHORIZER_ROLE) 0xec659e857089E301C87965ED4839B74Ea835755a --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/tx/0x6561f3d82eabf5384db2dc7c49fe2625e33e25dc783576066b04d7815e30bfbf",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "A sample card payment by Bitget-referred account",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Card settlement is a pull executed only by Fiat24's authorizer key after the card network authorizes the payment. Neither the cardholder nor the merchant can settle a card payment by calling the contract. Plain token transfers between Fiat24 accounts are a separate P2P feature, not card settlement.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xec659e857089E301C87965ED4839B74Ea835755a",
              "address": "0xec659e857089E301C87965ED4839B74Ea835755a",
              "block_number": 512546136,
              "eoa": true,
              "detail": "The only observed caller of authorize() is this EOA (nonce 7130096), Fiat24's card authorizer; no code for the service that drives it is public.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-2-api-reference",
              "detail": "Fiat24's API reference (hosted, not in a repo) uses a custom wallet-signature header for its closed API at api.fiat24.com.",
              "quote": "Fiat24 does NOT use any standard protocol for authentication and authorisation",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web3.bitget.com/helpCenter/482",
              "archive": "data/archive/bitget-wallet-card-help-fiat24.txt",
              "detail": "Bitget's help centre names this program \"Bitget Wallet Card (Fiat24)\"; article 802 says Mainland China signups are closed and existing users are not affected. Both pages are client-rendered, so their text is archived.",
              "quote": "Invite friends to apply for a Bitget Wallet Card (Fiat24)",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card payment needs Fiat24's closed authorization service and key, Marqeta processing and Mastercard. None is public, and there is no fallback operator. Closed and single-vendor, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "block_number": 512546136,
              "detail": "EUR24 sanctionCheck() = true and sanctionContract() = 0x40C57923924B5c5c5455c48D93317139ADDaC8fb (Sourcify-verified SanctionsList); the verified tokenTransferAllowed() reverts any transfer to or from a listed address and requires Live account status for the sender.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xb5c9ee0f",
                "expect": "0x00000000000000000000000040c57923924b5c5c5455c48d93317139addac8fb"
              },
              "recheck": "cast call 0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA \"sanctionContract()(address)\" --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "The terms disclose sanctions compliance as a duty of Fiat24, but not that the token contracts screen addresses onchain against an oracle.",
              "quote": "the Swiss sanctions regulations, as well as other sanctions regulations deemed appropriate by us",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Address filtering sits inside the settlement layer itself: the cash tokens check an onchain sanctions oracle and the account's KYC status on every transfer, including the card pull. Judgment call: the check is visible in Sourcify-verified source, but no Fiat24 or Bitget document discloses contract-level screening or its list source, so this takes the lower anchor, 0, rather than 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "validXXX24Tokens() returns true for USD24 0xbE00f3db..., CHF24 0xd41F1f0c..., EUR24 0x2c5d06f5... and CNH24 0x7288Ac74...; these are the card's settlement currencies.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x1b7238770000000000000000000000002c5d06f591d0d8cd43ac232c2b654475a142c7da",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14 \"validXXX24Tokens(address)(bool)\" 0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
              "detail": "Fiat24's developer guide lists the cash-token addresses on Arbitrum and Mantle; neither it nor Bitget's card pages state the issuer's freeze powers or Arbitrum sequencer assumptions to cardholders.",
              "quote": "The entire booking system of Fiat24 is managed transparently on the Arbitrum and Mantle blockchain",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The four cash tokens are enumerated in the contract and in Fiat24's developer docs. Bitget's card pages do not tell cardholders about the issuer's operator powers, the sanctions oracle or Arbitrum's sequencer. Enumerated in code, assumptions not stated, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/42161/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "Sourcify: card authorizer proxy exact_match, implementation 0x96AA3D05... match (partial); EUR24 and USD24 proxies and implementations (0x7aFe16b7..., 0x98BEC5F5...) match (partial); Fiat24Account proxy exact_match, implementation 0x78726B1e... match; ProxyAdmin 0x50873C85... match. Implementation slots read at the pinned block.",
              "checked_at": "2026-10-07",
              "recheck": "for a in 0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14 0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16 0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA 0x7aFe16b7d1A2F4C106E49FD0C2BE852a3a536E96; do curl -s https://sourcify.dev/server/v2/contract/42161/$a | jq -c '{address,match}'; done",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x00000000000000000000000096aa3d05755c54d2745d0dc98ea55e163da5bb16"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement contracts are verified on Sourcify, mostly as partial (metadata) matches; CHF24 is a partial match and the CNH24 proxy is not on Sourcify. No public repository or build script reproduces the bytecode. Partial match without a build script, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/bitgetwallet/tob-api-sdk/blob/fd1c2345af0253e72551c1cf4fdbe7aa1cae12fd/README.md",
              "commit": "fd1c2345af0253e72551c1cf4fdbe7aa1cae12fd",
              "path": "README.md",
              "detail": "The bitgetwallet org's 12 repos are swap, bridge, staking and trading-API SDKs (this one is the Go client for Bitget Wallet's trading APIs); none contains card code. GitHub users fiat24, Fiat24, fiat24-ag and fiat24ag return 404.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "The contract source is public only as Sourcify-verified files.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Only the contracts are public (through Sourcify). The Bitget card screens, Fiat24's backend, the authorizer and the API are closed, and no SDK is published. Contracts only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
              "detail": "Fiat24's developer guide documents contract addresses and functions (approve, authorize flow, payouts, top-up) on a hosted docs site, with the API reference on a separate hosted page.",
              "quote": "needs to approve a certain limit amount for future card spendings",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Interfaces are documented on a hosted docs site, not versioned in a repo. No payee export format is specified. Documented only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "Fiat24 grants users only a limited, non-transferable licence to its web app and API; the backend, authorizer and card processing have no published source.",
              "quote": "non-transferable, non-sub-licensable, worldwide, non-exclusive license to use the Fiat24 Web-App",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Required components (authorizer, backend, card processing, issuer) are closed, so F1 is 0. The verified contracts carry MIT SPDX headers, but they are not in any public repo.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "Card debits only run through authorize() called by Fiat24's AUTHORIZER_ROLE key; the contracts alone cannot process a card payment.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The card cannot run without Fiat24's hosted authorizer, backend and card processor, none of which has an open alternative. Core cannot run without proprietary components, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Fiat24's privacy policy discloses Google Analytics and Google Tag Manager on its site and web app.",
              "quote": "We use Google Analytics, a web analysis service of Google Ireland Limited",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web3.bitget.com/resource/policy.html",
              "detail": "Bitget Wallet's privacy policy lists data analytics among its processing purposes, without naming vendors.",
              "quote": "Use of data analytics to improve our Platform, Services and App",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics is disclosed by Fiat24 (Google Analytics, Tag Manager) and by Bitget Wallet (unnamed). Neither app was traced. Documented cap, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Fiat24 collects identity documents, contact data and transaction data for onboarding.",
              "quote": "Passport and/or photo ID for identity verification purposes",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web3.bitget.com/resource/policy.html",
              "detail": "Bitget Wallet's privacy policy lists government ID data and biometric data processed for AML/KYC.",
              "quote": "Government identification data: ID number",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Full KYC is required and disclosed in Fiat24's and Bitget Wallet's privacy policies; the legal basis (Swiss AML) is stated in the terms but not limited in code or a repo document. Disclosed in policy, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/tx/0x568b9d28f19fb3363d2a278bd5ef0463998df007cb89b862ec103a2248dde21f",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "The Authorized event indexes the account number (#730612) and holder address, and logs the card id, currency and amount; the calldata also carries the transaction currency and amount. Fiat24 account numbers map to Swiss IBANs.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "The terms tell users that balances and transactions are public on a blockchain and that they waive Swiss bank secrecy.",
              "quote": "you waive the Swiss bank secrecy to this extent",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card spend is public and linked to the cardholder's account number, address, card id and amount, though not to the merchant. The linkage is disclosed in the terms. Account tags in events, disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "The policy discloses sharing with service providers (payment processing, customer service and others) and for KYC and AML compliance, by category; Marqeta appears only in the contract name, and the sanctions oracle is not mentioned.",
              "quote": "We may share information to comply with laws, including KYC, AML, and tax law requirements.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties in the card flow (Fiat24, Marqeta, Mastercard, the KYC vendor) are disclosed by category in Fiat24's policy, and none can be swapped. No trace was run. Docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x7aFe16b7d1A2F4C106E49FD0C2BE852a3a536E96",
              "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "block_number": 512546136,
              "detail": "In the verified Fiat24Token source, sendToSundry(from, amount) lets any OPERATOR_ROLE holder move a holder's balance to the sundry account",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0x133CAEecA096cA54889db71956c7f75862Ead7A0 \"ownerOf(uint256)(address)\" 9103 --rpc-url https://arb1.arbitrum.io/rpc --block 512546136"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
              "detail": "Fiat24 describes the tokens as bank-issued claims on cash deposits.",
              "quote": "These tokens are issued by SR Saphirstein AG, a Swiss licensed deposit-taking institution.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card balance is a Fiat24 deposit represented by tokens in the user's address, not an asset the user controls: the issuer's operator EOA can move any balance, and card pulls land in Fiat24-held EOAs. \"Self-custody\" here means only that the wallet key signs; the provider can redirect funds, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0x50873C8501143e55349f9938795f69A2BB64b6ca",
              "address": "0x50873C8501143e55349f9938795f69A2BB64b6ca",
              "block_number": 512546136,
              "detail": "The EIP-1967 admin slot of the card authorizer, EUR24, USD24 and Fiat24Account proxies all hold ProxyAdmin 0x50873C85...; its owner() is EOA 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59. No timelock or Safe sits in between.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000001272c99befa7a70f935edca81bf9a6e85c6d9d59"
              },
              "recheck": "cast call 0x50873C8501143e55349f9938795f69A2BB64b6ca \"owner()(address)\" --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "Card authorizer EIP-1967 admin slot = ProxyAdmin 0x50873C85....",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x00000000000000000000000050873c8501143e55349f9938795f69a2bb64b6ca"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every settlement contract is upgradeable at once by a single EOA, with no timelock. EOA admin, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xbE00f3db78688d9704BCb4e0a827aea3a9Cc0D62",
              "address": "0xbE00f3db78688d9704BCb4e0a827aea3a9Cc0D62",
              "block_number": 512546136,
              "detail": "USD24 allowance(0x03746aaDcD9472F6778CfF0Bd07C37C69E5F4187, card authorizer) = 2^256-1 for Bitget-referred account",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xdd62ed3e00000000000000000000000003746aadcd9472f6778cff0bd07c37c69e5f4187000000000000000000000000e2e3b88b9893e18d0867c08f9ca93f8ab5935b14",
                "expect": "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
              },
              "recheck": "cast call 0x133CAEecA096cA54889db71956c7f75862Ead7A0 \"walletProvider(uint256)(uint256)\" 119154 --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
              "detail": "Fiat24's guide shows a bounded approval and says it must be repeated once used; this does not match what Bitget users hold.",
              "quote": "Once the approved amount is used, the approval needs to be repeated.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Almost all Bitget cardholders on this program have an unlimited allowance to the authorizer, which only Fiat24's key can spend through. Neither Bitget nor Fiat24 discloses that. Judgment call: the app's default is inferred from onchain allowances, not from Bitget code (closed); 188 of 195 sampled accounts are unbounded, so \"unbounded, undisclosed\", 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x7aFe16b7d1A2F4C106E49FD0C2BE852a3a536E96",
              "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "block_number": 512546136,
              "detail": "Cash-token transfers require a Live sender status set by Fiat24 operators, and cash payouts to a bank account need Fiat24's CASH_OPERATOR_ROLE to complete (cashPayoutOK).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Derived. S1 = 0 (operator can move balances), C2 = 0 (only Fiat24's key settles), C3 = 0 (closed single-vendor backend), O3 unknown. The balance is a deposit claim on Fiat24; turning it back into money needs Fiat24's payout operator, and even token transfers depend on Fiat24-set account status. Funds depend on provider liveness, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. Per Fiat24's terms (https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients), Fiat24 is SR Saphirstein AG, Zurich (CHE-256.014.995), holding a FINMA fintech licence under Article 1b of the Swiss Banking Act; the terms state that the Swiss deposit protection scheme does not apply to Fiat24 client deposits and that no interest is paid. The card is a Mastercard debit card issued by Fiat24 (payment card terms). Bitget's card page says issuing partners vary by region; other regional Bitget cards have other issuers and terms.",
      "notes": "Bitget Wallet Card is a family of regional card programs; the card page says issuing partners vary by region, and Bitget names none on the page. Eligibility rests on the one program tied to verified contracts: the Fiat24-issued card for Mainland China (Bitget help articles 482 and 802, archived; new signups closed, existing cards unaffected). Onchain, Fiat24Account.walletProviderMap(8088) returns \"Bitget\", and Bitget-referred accounts were the largest group of card payers in the sampled window. Scores describe that program at Arbitrum block 512546136. The EEA/UK/LatAm cards top up a separate card balance that \"the card provider\" credits (help article 281, logged in docs/research/bitget-wallet-card.md; press reports name Immersve for the EEA/UK card, third-party claim); no contract or repo ties those programs to the product, so they are not scored. The \"self-custody\" framing is a claim: the Fiat24 balance is a deposit token Fiat24 can gate and move. Arbiscan returns 403 to scripted requests, so explorer links point to Blockscout and Sourcify. No browser trace was run.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "CN"
        ],
        "note": "Scoped to the Fiat24-issued programme this file assesses, which Bitget's help centre files under Mainland China. The documents disagree: the card page FAQ still lists \"mainland China\" among regions where the card is currently available, but help article 802 says users in Mainland China can no longer apply for a new card (existing users unaffected). Taking the more restrictive reading, this programme serves existing Mainland China cardholders only and is closed to new applicants. Fiat24's own coverage list (info.fiat24.com/api/fiat24/getCountries, checked 2026-10-09) does not include CN as an eligible domicile, which is consistent with the closure. Bitget's other regional programmes (EEA and UK; ten Latin American countries; APAC; South Africa; Pakistan and Bangladesh, per the card page) use different issuers that this file does not assess, so they are not listed.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://web3.bitget.com/helpCenter/802",
            "archive": "data/archive/bitget-wallet-card-help-fiat24.txt",
            "quote": "Users in Mainland China can no longer apply for a new Bitget Wallet Card. Existing users are not affected.",
            "detail": "Bitget Wallet help centre article 802 (Mainland China section, client-rendered; archived 2026-10-07).",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://web3.bitget.com/card",
            "quote": "Vietnam, Malaysia, mainland China, Taiwan, Australia",
            "detail": "Card page FAQ \"Who can apply for a Bitget Wallet Card?\" lists mainland China under Asia-Pacific, and says \"Card issuing partners vary by region\".",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USD24",
            "class": "platform",
            "chain_id": 42161,
            "address": "0xbE00f3db78688d9704BCb4e0a827aea3a9Cc0D62"
          },
          {
            "symbol": "EUR24",
            "class": "platform",
            "chain_id": 42161,
            "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA"
          },
          {
            "symbol": "CHF24",
            "class": "platform",
            "chain_id": 42161,
            "address": "0xd41F1f0cf89fD239ca4c1F8E8ADA46345c86b0a4"
          },
          {
            "symbol": "CNH24",
            "class": "platform",
            "chain_id": 42161,
            "address": "0x7288Ac74d211735374A23707D1518DCbbc0144fd"
          }
        ],
        "conversion": "at_top_up",
        "note": "Bitget Wallet Card's Mainland China program (the one scored here) is Fiat24's Mastercard, which spends Fiat24 cash tokens on Arbitrum: USD24, EUR24, CHF24 and CNH24 (RMB). They are tokenised deposits issued by SR Saphirstein AG (Fiat24), the card issuer, backed one-to-one by cash deposits; transfers are gated by Fiat24's KYC status and sanctions checks, so they are classed as platform tokens rather than freely circulating stablecoins. Crypto becomes fiat at top-up: the wallet swaps the user's asset into Arbitrum USDC and Fiat24's top-up contract converts it into a cash token. At spend, Fiat24's card-authorisation contract debits the balance in the transaction currency if Direct Pay is on for it; otherwise it converts from the user-selected default card currency. No default is fixed by Fiat24.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://arbitrum.blockscout.com/address/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
            "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
            "chain_id": 42161,
            "block_number": 512546136,
            "detail": "Fiat24CardAuthorization validXXX24Tokens() returns true for USD24, CHF24, EUR24 and CNH24 (EUR24 check shown).",
            "checked_at": "2026-10-12",
            "check": {
              "call": "0x1b7238770000000000000000000000002c5d06f591d0d8cd43ac232c2b654475a142c7da",
              "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
            },
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
            "detail": "Fiat24's developer guide names the four cash tokens, their issuer and their deposit backing, and lists all four as supported for the debit card on Arbitrum.",
            "quote": "which are ERC-20 tokens backed one-to-one by cash deposits. These tokens are issued by SR Saphirstein AG, a Swiss licensed deposit-taking institution.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
            "detail": "Crypto top-up converts the wallet's crypto into Fiat24 cash tokens.",
            "quote": "it converts the cryptocurrency from the wallet into our fiat holdings, which are in the form of ERC20 tokens",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
            "detail": "Spending rules; the matching currency balance is charged first (Direct Pay), otherwise the user's chosen default card currency is converted and debited.",
            "quote": "If your card transactions are in these currencies, the corresponding balance will be charged first, avoiding unnecessary foreign exchange fees",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "Bitget's card page and help centre (no audit mentioned), Fiat24's developer and legal docs (no audit or security page), GitHub (no public Fiat24 contracts repository; the Arbitrum sources are on Sourcify only), and auditor portfolios. The only published reports found are BlockSec's three audits of Mantle's fork of the Fiat24 contracts (private repository mantle-xyz/fiat24contracts, client Mantle), listed below as the closest shared code. None is stated to cover the Arbitrum deployment: the Arbitrum Fiat24CardAuthorizationMarqeta implementation 0x96AA3D05... was deployed at block 276754432 (November 2024) and lacks the double-booking functions the 2026 reports review. No report was found for Fiat24Account, the cash tokens' Arbitrum code or the ProxyAdmin set-up.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "BlockSec",
            "date": "2026-07-16",
            "type": "audit",
            "scope": "Shared Fiat24 contracts, Mantle's fork: fee manager, Arbitrum and Tempo deposit paths via LayerZero, DelegationVault, batch double-booking in Fiat24CardAuthorizationMarqeta, BufferPool, CryptoRelay and Fiat24Token changes since ad90880.",
            "url": "https://github.com/blocksecteam/audit-reports/blob/7e41a27c8dd358d027d880144d541efd75aa7da5/solidity/blocksec_mantle_fiat24_contracts_signed_20260716.pdf",
            "commit": "66f0ff159016f7df0b1979e7d9209457f2d793f5",
            "covers_deployed": "no",
            "findings": "7 low (6 fixed, 1 confirmed), 4 recommendations, 1 note",
            "note": "Reviews changes made in Mantle's private fork; the Arbitrum contracts this file scores do not contain them."
          },
          {
            "auditor": "BlockSec",
            "date": "2026-06-08",
            "type": "audit",
            "scope": "Shared Fiat24 contracts, Mantle's fork: new DelegationVault, double-booking in Fiat24CardAuthorizationMarqeta and Fiat24CryptoDeposit_Avax (changes since b670bb8).",
            "url": "https://github.com/blocksecteam/audit-reports/blob/7e41a27c8dd358d027d880144d541efd75aa7da5/solidity/blocksec_mantle_fiat24_contracts_signed_20260608.pdf",
            "commit": "ad908801e2dc30fb805551dc117268312f6fdbc7",
            "covers_deployed": "no",
            "findings": "1 medium and 1 low, both fixed; 5 recommendations, 3 notes",
            "note": "Reviews changes made in Mantle's private fork; the Arbitrum card authorizer has no double-booking functions."
          },
          {
            "auditor": "BlockSec",
            "date": "2025-08-06",
            "type": "audit",
            "scope": "Shared Fiat24 contracts, Mantle's fork: Fiat24CryptoDeposit (and variants), Fiat24CardAuthorizationMarqeta (card authorize/increment/reverse), Fiat24CryptoRelay, FiatTokenBeacon and FiatTokenFactory.",
            "url": "https://github.com/blocksecteam/audit-reports/blob/7e41a27c8dd358d027d880144d541efd75aa7da5/solidity/blocksec_mantle_fiat24_v1.0-signed.pdf",
            "commit": "8fa9f76352a27f901c293552ed1c03b06c9bb3f4",
            "covers_deployed": "unknown",
            "findings": "1 high (fixed), 2 medium, 6 low, 6 recommendations, 7 notes; most medium and low confirmed rather than fixed",
            "note": "Same contract names and card functions (authorize, increment) as the Arbitrum implementation 0x96AA3D05..., but the audited private repository cannot be compared with the Arbitrum source, so whether the deployed card authorizer matches is unknown."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C4"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 2,
        "short": 16,
        "unk": 5,
        "total": 23
      }
    },
    {
      "slug": "blanksquare",
      "name": "Blanksquare (Shielder)",
      "type": "transfer",
      "website": "https://docs.blanksquare.io",
      "primary_chain": {
        "name": "Base",
        "chain_id": 8453,
        "basis": "The Deployments doc lists Base as the only mainnet row with a mainnet relayer (proxy 0x064A…dCFf), and the Web App doc names Base as its only network. The implementation is a Sourcify match identical to blanksquare-monorepo@5dad5a07 contracts/Shielder.sol. Unit: the proxy, implementation and four linked libraries. Excluded: HyperEVM (listed with a testnet relayer), Base and Arbitrum Sepolia, and the older v2 deployments (Aleph Zero EVM, Arbitrum) in shielding-dapp."
      },
      "repos": [
        {
          "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo",
          "role": "contracts",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/Cardinal-Cryptography/shielding-dapp",
          "role": "frontend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/Cardinal-Cryptography/shielder-quickstart",
          "role": "frontend",
          "license": "MIT"
        }
      ],
      "contracts": [
        {
          "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
          "chain_id": 8453,
          "role": "Shielder proxy (ERC1967, UUPS)",
          "verified": "explorer"
        },
        {
          "address": "0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53",
          "chain_id": 8453,
          "role": "Shielder implementation (v0.1.1)",
          "verified": "sourcify"
        },
        {
          "address": "0x37aA4F682012000acA40196F30E6cD737CF1eb94",
          "chain_id": 8453,
          "role": "Deposit Halo2 verifier (linked library)",
          "verified": "sourcify"
        },
        {
          "address": "0xd03dD8d2af1afCb6fC1F5f52D34273e3dd0B37dC",
          "chain_id": 8453,
          "role": "Withdraw Halo2 verifier (linked library)",
          "verified": "sourcify"
        },
        {
          "address": "0x04ebcaCDd79f80A0A992636bB0Bc9ADae8D9c0Fb",
          "chain_id": 8453,
          "role": "NewAccount Halo2 verifier (linked library)",
          "verified": "sourcify"
        },
        {
          "address": "0x152D43037802b57A17584AEf55C5B925366d3B6e",
          "chain_id": 8453,
          "role": "Poseidon2T8 library",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Shielder proxy, implementation and verifier libraries on Base",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Common Labs; owner Safe 0x9Dc4…2165 (2-of-5) can pause and upgrade",
          "required": true,
          "repo": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo"
        },
        {
          "name": "Shielder circuits and client-side WASM prover",
          "role": "sdk",
          "public": true,
          "license": "GPL-3.0-only-with-Classpath-exception",
          "operator": "user (proofs generated client-side)",
          "required": true,
          "repo": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo"
        },
        {
          "name": "shielder-sdk (TypeScript client, incl. withdrawManual direct path)",
          "role": "sdk",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user or integrating wallet",
          "required": true,
          "repo": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo"
        },
        {
          "name": "Base mainnet and a JSON-RPC endpoint of the user's choice",
          "role": "ledger",
          "public": true,
          "license": "MIT",
          "operator": "Base sequencer (Coinbase); RPC chosen by the integrator",
          "required": true,
          "repo": "https://github.com/ethereum-optimism/optimism"
        },
        {
          "name": "Shielder relayer (Base host did not resolve on 2026-10-09)",
          "role": "relayer",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Blanksquare / Common Labs Inc.",
          "required": false,
          "repo": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo"
        },
        {
          "name": "TEE prover and scheduler (Private Send delayed withdrawals)",
          "role": "other",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Blanksquare / Common Labs Inc.",
          "required": false,
          "repo": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo"
        },
        {
          "name": "Blanksquare Web App (app.blanksquare.io; offline on 2026-10-09)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Common Labs Inc.",
          "required": false
        },
        {
          "name": "Blanksquare Mobile App",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Common Labs Inc.",
          "required": false
        },
        {
          "name": "Anonymity revoker (holder of the AR private key set by the owner)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": false
        },
        {
          "name": "PostHog analytics in the apps",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "PostHog Inc.",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/contracts/Shielder.sol#L155-L197",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "contracts/Shielder.sol",
              "detail": "onlyOwner can upgrade (_authorizeUpgrade), pause and unpause, set deposit and withdraw fee bps and the fee receiver, and replace the anonymity-revoker public key; newAccount, deposit and withdraw are all whenNotPaused (L216, L274, L392, L441, L545, L598), so a pause also stops exits. There is no per-address blacklist.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "block_number": 52371351,
              "detail": "owner() of the Shielder proxy is 0x9Dc4e0e4f6d9693e5760227469c0b8Cf9a432165 and pendingOwner() is zero; paused() is false at block 52371351.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x064A67a5484DF6baf36be42F9554d45E7741dCFf \"owner()(address)\" --rpc-url https://mainnet.base.org",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000009dc4e0e4f6d9693e5760227469c0b8cf9a432165"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x9Dc4e0e4f6d9693e5760227469c0b8Cf9a432165",
              "address": "0x9Dc4e0e4f6d9693e5760227469c0b8Cf9a432165",
              "block_number": 52371351,
              "detail": "The owner is a Safe 1.4.1 with threshold 2 of 5 owners (0x4Ca7…2397, 0xEfD1…d425, 0x6b02…4D73, 0x428B…453f, 0x07A8…fc76); getModulesPaginated(0x1,10) returns no modules and the guard slot is zero. No timelock sits between the Safe and the proxy.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x9Dc4e0e4f6d9693e5760227469c0b8Cf9a432165 \"getThreshold()(uint256)\" --rpc-url https://mainnet.base.org",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000002"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x9Dc4e0e4f6d9693e5760227469c0b8Cf9a432165",
              "address": "0x9Dc4e0e4f6d9693e5760227469c0b8Cf9a432165",
              "block_number": 52371351,
              "detail": "Safe guard storage slot 0x4a20…34c8 reads zero at block 52371351.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A 2-of-5 Safe owns the Shielder and can pause it, which stops deposits and withdrawals alike. The Safe has no modules or guard, but there is no timelock, and we found no public list of the signers. Pause is global; there is no per-address blacklist in the contract. Scored 1: a multisig role that misses the timelock and signer-disclosure conditions.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/contracts/Shielder.sol#L532-L582",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "contracts/Shielder.sol",
              "detail": "withdrawNative and withdrawERC20 (L584-L645) are external with no caller check; the relayer address and fee are only parameters bound into the proof commitment (L687-L698), and a fee of 0 skips the relayer transfer. depositNative and depositERC20 (L383-L476) are open to any caller.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/ts/shielder-sdk/src/client/client.ts#L214-L250",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "ts/shielder-sdk/src/client/client.ts",
              "detail": "The SDK's withdrawManual sends the withdraw transaction to the Shielder directly from the user's own account, documented as the path for when the relayer is not available.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/blanksquare-monorepo/contents/ts/shielder-sdk/src/client/client.ts?ref=5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e\" --jq .content | base64 -d | sed -n 214,250p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/integration-guides/deployments.md",
              "detail": "The Deployments page publishes the Base Shielder address.",
              "checked_at": "2026-10-09",
              "quote": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53",
              "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "block_number": 52371351,
              "detail": "The proxy's EIP-1967 implementation slot points at 0xfFF4…8b53, whose Sourcify source (match) is identical to Shielder.sol at the pinned commit.",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0x064A67a5484DF6baf36be42F9554d45E7741dCFf 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://mainnet.base.org",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x000000000000000000000000fff44d366dedf9b2a531109e1a08bf9873c58b53"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer deposits and later withdraws to any payee address by calling the Shielder directly; no relayer, signer or API is needed, and the SDK ships a direct-withdraw method. The address is published in the docs and the source is public and verified. Payment model: there is no shielded transfer to another account in this contract version, so a payment is a withdraw to the payee's address. We sent no transaction. The owner Safe can still pause the contract (C1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/ts/shielder-sdk/src/client/factories.ts#L30-L67",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "ts/shielder-sdk/src/client/factories.ts",
              "detail": "The SDK takes an injected viem publicClient (any RPC), a cryptoClient (local WASM prover) and a relayerUrl string; chain state is read from contract events through that RPC (chain/contract.ts L550-L560), so no indexer or hosted API is involved.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/blanksquare-monorepo/contents/ts/shielder-sdk/src/client/factories.ts?ref=5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e\" --jq .content | base64 -d | sed -n 30,67p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/tree/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/crates/shielder-relayer",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "crates/shielder-relayer",
              "detail": "The relayer is a public Rust service with a README covering native and Docker runs and its configuration options.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Settlement needs only the Shielder, a client-side prover and an RPC. The relayer is optional (withdrawManual), and its code is public. The official hosted relayer did not resolve in DNS on 2026-10-09, which leaves the direct path as the working one. Judgment call: as with Tornado Cash, withdrawing without a relayer needs gas in the withdrawing account and weakens privacy (P3); the cell measures settlement dependence, so 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/contracts/Shielder.sol#L647-L709",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "contracts/Shielder.sol",
              "detail": "The withdraw path checks version, amount, fee, Merkle root, nullifier and proof only; no address or country check exists in the contract. A grep of crates/shielder-relayer for sanction, blocklist, chainalysis and country finds nothing.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/other/terms-and-conditions-shielder-service",
              "archive": "data/archive/blanksquare-shielder-terms.txt",
              "detail": "The Shielder Service terms bar Restricted Countries (Annex 3), sanctioned persons and PEPs, and reserve geo-blocking.",
              "checked_at": "2026-10-09",
              "quote": "SERVICE PROVIDER reserves the right to employ geo-blocking solutions or similar measures"
            }
          ],
          "finding": "The settlement contract is neutral. Edge filtering is set out in the terms (country list, sanctioned persons, PEPs, a reserved right to geo-block), not in code or a versioned repo document, and the official apps that would enforce it are closed and now offline, so we could not see what they did. The direct contract path bypasses any app-level filter. The docs also describe an anonymity revoker and a \"Shielder Guard\" (description marked work in progress). Scored 1: edge filtering disclosed in documents only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/contracts/Shielder.sol#L430-L476",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "contracts/Shielder.sol",
              "detail": "depositERC20 accepts any token address; the contract has no token list.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/shielding-dapp/blob/f167cd97b3ffc5e87520360cb6fd1fb712016674/src/domains/chains/utils/definitions/chains/base/base.ts#L11-L27",
              "commit": "f167cd97b3ffc5e87520360cb6fd1fb712016674",
              "path": "src/domains/chains/utils/definitions/chains/base/base.ts",
              "detail": "The public dapp's Base config covers only Base Sepolia (whitelisted test tokens); no public file enumerates the tokens offered on Base mainnet.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "We found no enumeration of supported Base mainnet tokens in public code or docs, and no statement to users about issuer freeze powers (USDC is held by the pool) or Base's sequencer and forced-inclusion assumptions. The pool held about 0.078 ETH and 48.2 USDC at our block. Scored 0: not enumerated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53",
              "address": "0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53",
              "block_number": 52371351,
              "detail": "Sourcify returns match (partial) for the implementation and for the four linked libraries (0x37aA…eb94, 0xd03d…37dC, 0x04eb…c0Fb, 0x152D…B6e), and no record for the proxy 0x064A…dCFf; Basescan shows the implementation and libraries as Source Code Verified and the proxy as an ERC1967Proxy Similar Match.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0x064A67a5484DF6baf36be42F9554d45E7741dCFf 0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53 0x37aA4F682012000acA40196F30E6cD737CF1eb94; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/8453/$a | jq -r .match; done"
            }
          ],
          "finding": "Every settlement contract has public verified source: partial Sourcify matches plus explorer verification for the implementation and libraries, and an explorer similar-match for the standard ERC1967 proxy. No full match and no rebuild attempted. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/tree/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/crates",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "crates",
              "detail": "The monorepo holds contracts, circuits, relayer, TEE prover and scheduler, CLI and deploy scripts (scripts/), and ts/ holds the SDK and WASM crypto. shielding-dapp is a public frontend but configures only testnets and the older v2 deployments.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/blanksquare-monorepo/contents/crates?ref=5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e\" --jq '.[].name'"
            }
          ],
          "finding": "Contracts, circuits, SDK, relayer and deploy scripts are public, and no indexer is needed. The frontend that served Base mainnet (app.blanksquare.io) and the mobile app were not traced to public source; the public shielding-dapp does not configure Base mainnet. Judgment call: 2, everything public except the live app.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/crates/shielder-relayer/README.md#L8-L45",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "crates/shielder-relayer/README.md",
              "detail": "The relayer README gives native and Docker run steps and a configuration table; the root README gives setup steps and shielder-quickstart is a minimal SDK app.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Build and run documentation exists for the relayer, SDK and a quickstart app. Reproduction not attempted, so the score is capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/contracts/Shielder.sol#L63-L100",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "contracts/Shielder.sol",
              "detail": "NewAccount, Deposit and Withdraw events are defined in source; the SDK imports its ABI from ../_generated/abi, which is generated at build time and not committed. The relayer has no OpenAPI or equivalent schema in the repo.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Interfaces can be derived from verified source, and the docs describe the SDK, but no ABI file, API schema or payee export is committed. Judgment call: 1, as the interface record is source and hosted docs only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/LICENSE",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "LICENSE",
              "detail": "blanksquare-monorepo is Apache-2.0, and its NOTICE and README (L236-L242) state the circuits crate is GPL-3.0-only with Classpath exception; shielding-dapp and shielder-quickstart are MIT (GitHub license API).",
              "checked_at": "2026-10-09",
              "recheck": "for r in blanksquare-monorepo shielding-dapp shielder-quickstart; do echo $r $(gh api repos/Cardinal-Cryptography/$r --jq '.license.spdx_id // \"none\"'); done",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every listed repo, and every required component, carries an OSI licence (Apache-2.0, MIT, GPL-3.0 with an added Classpath permission). The closed web and mobile apps are not required to settle.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/LICENSE",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "LICENSE",
              "detail": "The repo root has no CONTRIBUTING or CLA file; LICENSE has one commit (64fc870c, 2024-12-12).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/blanksquare-monorepo/commits?path=LICENSE&sha=5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e\" --jq '.[].sha'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No CLA, no relicensing event and no written licence-stability commitment.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/ts/shielder-sdk/src/client/factories.ts#L30-L67",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "ts/shielder-sdk/src/client/factories.ts",
              "detail": "The SDK's dependencies are viem, zod, comlink, async-mutex and the project's own crypto packages; it needs a user-supplied RPC and the relayer URL is optional for withdrawManual.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/blanksquare-monorepo/contents/ts/shielder-sdk/package.json?ref=5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e\" --jq .content | base64 -d | jq .dependencies",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No proprietary plugin or hosted-only service is needed to deposit and withdraw. Judgment call: the code supports 3, but with no O3 reproduction we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/shielding-dapp/blob/f167cd97b3ffc5e87520360cb6fd1fb712016674/src/domains/misc/components/Providers/PostHogProvider.tsx#L30-L48",
              "commit": "f167cd97b3ffc5e87520360cb6fd1fb712016674",
              "path": "src/domains/misc/components/Providers/PostHogProvider.tsx",
              "detail": "The public dapp initialises PostHog whenever the build sets PUBLIC_VAR_POSTHOG_KEY (envVarsSchema requires it), with in-memory persistence and an address-sanitising before_send hook; there is no opt-in toggle.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/other/privacy-policy-apps",
              "archive": "data/archive/blanksquare-privacy-policy-apps.txt",
              "detail": "The apps' privacy policy discloses PostHog analytics.",
              "checked_at": "2026-10-09",
              "quote": "The PostHog analytics solutions enabled in the App operate in a cookieless mode."
            }
          ],
          "finding": "The SDK has no analytics dependency. The apps ship PostHog on by default, disclosed in the privacy policy. Scored 1; the closed live builds were not inspected.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/contracts/Shielder.sol#L204-L216",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "contracts/Shielder.sol",
              "detail": "Account creation posts symKeyEncryption (the account key encrypted to the anonymity revoker's public key) and every action posts a MAC, beyond the amount, token and address that settlement needs.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/other/privacy-policy-apps",
              "archive": "data/archive/blanksquare-privacy-policy-apps.txt",
              "detail": "The apps collect IP addresses, location data, device data and user-journey statistics.",
              "checked_at": "2026-10-09",
              "quote": "IP addresses; Location data; User hardware and software data"
            }
          ],
          "finding": "Through the SDK the protocol collects settlement data plus an anonymity-revoker ciphertext and MACs that let the revoker link an account's actions; the docs disclose this, but no legal basis is stated. The apps also collect IP, location and analytics data under the privacy policy. Scored 1: collection beyond settlement, disclosed in documents.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/contracts/Shielder.sol#L63-L100",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "contracts/Shielder.sol",
              "detail": "Deposit emits token, amount, note, MAC and memo (the depositor is the tx sender); Withdraw emits token, amount, withdrawalAddress, relayer, fee, MAC and memo. The proof hides which account a withdrawal spends from.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/blanksquare-monorepo/contents/contracts/Shielder.sol?ref=5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e\" --jq .content | base64 -d | sed -n 63,100p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/protocol-details/design-against-bad-actors/anonymity-revokers.md",
              "detail": "The docs state that the anonymity revoker, on a governance decision, can reveal all of a user's Shielder transactions.",
              "checked_at": "2026-10-09",
              "quote": "this allows everyone to see the details of all other transactions performed by the illicit user",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Onchain data shows who deposited and who received, and the exact amounts, but not which deposit funded which withdrawal. Amounts are arbitrary and in plaintext, so amount and timing matching can link payer and payee. The anonymity-revoker key holder (set by the owner Safe) can link every action of an account. Judgment call: 2, minimal linkage by design and documented, but not 3 because amounts are public and a designated party can deanonymise.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/ts/shielder-sdk/src/client/factories.ts#L30-L67",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "ts/shielder-sdk/src/client/factories.ts",
              "detail": "The SDK contacts only the injected RPC client and the configured relayer URL (fee quote and relay).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/blanksquare-monorepo/contents/ts/shielder-sdk/src/chain/relayer.ts?ref=5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e\" --jq .content | base64 -d | grep -n fetch",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "On the SDK path only the chosen RPC and, if used, the relayer see a request; the relayer sees the withdrawal address and the user's IP. The apps add PostHog and Reown/WalletConnect. Named in code and swappable in the SDK. Scored 2 (3 would need a package or trace).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/shielding-dapp/blob/f167cd97b3ffc5e87520360cb6fd1fb712016674/src/domains/chains/utils/definitions/chains/base/base.ts#L11-L27",
              "commit": "f167cd97b3ffc5e87520360cb6fd1fb712016674",
              "path": "src/domains/chains/utils/definitions/chains/base/base.ts",
              "detail": "The public dapp hardcodes relayer and fee-estimator URLs per chain; the SDK takes RPC client and relayer URL as config (factories.ts L30-L48), and no indexer exists.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/shielding-dapp/contents/src/domains/chains/utils/definitions/chains/base/base.ts?ref=f167cd97b3ffc5e87520360cb6fd1fb712016674\" --jq .content | base64 -d | sed -n 11,27p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Endpoints are configurable in SDK code; the public UI fixes them at build time and offers no setting. No indexer is needed. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53",
              "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "block_number": 52371351,
              "detail": "Funds sit in the UUPS proxy between deposit and withdrawal; the implementation (Shielder.sol L22-L31, L155) lets the owner Safe upgrade it with no delay.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x000000000000000000000000fff44d366dedf9b2a531109e1a08bf9873c58b53"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "In the current code only a valid proof moves funds out, to the address bound in it. The escrow is upgradeable by a 2-of-5 Safe with no timelock, so the owner could deploy code that redirects funds. Upgradeability is visible in verified source. Scored 1: upgradeable escrow, disclosed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "block_number": 52371351,
              "detail": "UUPS proxy (EIP-1967 admin slot zero; upgrade authorised by onlyOwner in the implementation); owner() is the Safe 0x9Dc4…2165, threshold 2 of 5, no modules, no guard.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x064A67a5484DF6baf36be42F9554d45E7741dCFf \"owner()(address)\" --rpc-url https://mainnet.base.org",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A 2-of-5 Safe can upgrade the Shielder at once; there is no timelock and we found no signer disclosure or notice channel. Scored 1: multisig admin, no timelock.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/shielding-dapp/blob/f167cd97b3ffc5e87520360cb6fd1fb712016674/src/domains/shielder/utils/useShield.tsx#L104-L121",
              "commit": "f167cd97b3ffc5e87520360cb6fd1fb712016674",
              "path": "src/domains/shielder/utils/useShield.tsx",
              "detail": "The public dapp checks the allowance and, if short, approves exactly the shield amount to the Shielder.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/shielding-dapp/contents/src/domains/shielder/utils/useShield.tsx?ref=f167cd97b3ffc5e87520360cb6fd1fb712016674\" --jq .content | base64 -d | sed -n 104,121p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK leaves approval to the integrator; the public reference dapp approves the exact amount. That fits anchor 3, but a 3 needs a package or trace and we did not inspect the closed live app. Judgment call: 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "block_number": 52371351,
              "detail": "paused() is false at block 52371351, so withdraw is callable by anyone with a valid proof.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x064A67a5484DF6baf36be42F9554d45E7741dCFf \"paused()(bool)\" --rpc-url https://mainnet.base.org",
              "check": {
                "call": "0x5c975abb",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=1, C2=3, C3=3, O3=1. The official web app and relayer are already offline, and the contract stays unpaused: an account holder can rebuild state from RPC events and withdraw with withdrawManual and the local prover (C2, C3). The owner Safe could still pause or upgrade (S1), so funds are safe from provider disappearance but not from provider action. There is no public frontend build for Base mainnet and no reproduction (O3=1). Judgment call: 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/shielding-dapp/blob/f167cd97b3ffc5e87520360cb6fd1fb712016674/envVarsSchema.ts#L1-L10",
              "commit": "f167cd97b3ffc5e87520360cb6fd1fb712016674",
              "path": "envVarsSchema.ts",
              "detail": "The dapp bundles only public variables (Reown project ID, PostHog key and host, OG image URL); the SDK has no API keys or webhooks and derives the shielder seed client-side.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Cardinal-Cryptography/shielding-dapp/contents/envVarsSchema.ts?ref=f167cd97b3ffc5e87520360cb6fd1fb712016674\" --jq .content | base64 -d",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No secrets in the client and no webhooks; the bundled keys are publishable identifiers. Private Send hands a key to a TEE, which is opt-in. Scored 2 (3 needs a package or trace).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://reports.zksecurity.xyz/reports/aleph-zero-shielder/",
              "detail": "zkSecurity audited zkOS-monorepo at commit 22e2f52 plus a private circuits repo, starting 2025-03-25.",
              "checked_at": "2026-10-09",
              "quote": "The audit lasted 2 weeks with 2 consultants",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/zkOS-monorepo/tree/22e2f52f93b45a9aaac09caeb9d1ca0544279ad5/contracts",
              "commit": "22e2f52f93b45a9aaac09caeb9d1ca0544279ad5",
              "path": "contracts",
              "detail": "The audited commit is dated 2025-03-21; Shielder.sol later changed (caller commitment 2025-04-07, AR key setter 2025-04-17, protocol fees 2025-07-17), and the deployed code comes from blanksquare-monorepo@5dad5a07.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "One audit report, pinned to a commit before several contract changes that are now deployed; no per-finding fix links reviewed, and no bug bounty or SECURITY file found. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "blocklist",
        "countries": [
          "AF",
          "BB",
          "BF",
          "CM",
          "KP",
          "CD",
          "GI",
          "HT",
          "IR",
          "JM",
          "ML",
          "MZ",
          "MM",
          "NG",
          "PA",
          "PH",
          "SN",
          "ZA",
          "SS",
          "SY",
          "TZ",
          "TT",
          "UG",
          "AE",
          "VU",
          "VN",
          "YE",
          "DZ",
          "AO",
          "BG",
          "CI",
          "HR",
          "KE",
          "LA",
          "LB",
          "MC",
          "NA",
          "NP",
          "VE",
          "RU",
          "BY"
        ],
        "note": "From Annex 3 of the Shielder Service terms (4 Nov 2025), which also bars Russian-occupied territories of Ukraine (Ukraine itself is not listed), sanctioned persons and politically exposed persons, and limits use to personal, non-commercial use. Section 6.2 points to \"Annex no. 1\" for the list while Section 22.15 points to Annex 3; the list is in Annex 3. The terms bind use of the official apps; the Shielder contract has no address or country check, so the protocol is callable from anywhere through the SDK. The apps were offline on 2026-10-09.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.blanksquare.io/other/terms-and-conditions-shielder-service",
            "archive": "data/archive/blanksquare-shielder-terms.txt",
            "detail": "Annex 3 lists the restricted countries; Section 6.2 refuses service to people located in, citizens of or resident in them.",
            "checked_at": "2026-10-09",
            "quote": "III. Countries and territories subject to international sanctions"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: the Base Shielder proxy 0x064A…dCFf and its implementation and libraries; all Base reads at block 52371351 (mainnet.base.org serves historical state). Status on 2026-10-09: blanksquare.io and app.blanksquare.io return Vercel DEPLOYMENT_NOT_FOUND, the Base relayer host does not resolve, and the Merkle tree's next free leaf has not moved since a block between 44,000,000 and 46,000,000 (about May 2026; 448 leaves in total). The contracts are live and unpaused, so we treat the rail as deployed but dormant. Operator: Common Labs Inc. (Panama) per the terms; code by Cardinal Cryptography. No transactions, app runs, traces or self-host attempts.",
      "audits": {
        "searched": "The README and crates/shielder-circuits/README of github.com/Cardinal-Cryptography/blanksquare-monorepo (both link one zkSecurity report), the Blanksquare docs (llms.txt and sitemap, no audits page), the zkOS-monorepo repo, a GitHub code search of the Cardinal-Cryptography org for audit, and reports.zksecurity.xyz. No other audit of the Shielder contracts, circuits, SDK, relayer or TEE prover was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "zkSecurity",
            "date": "2025-03-25",
            "type": "audit",
            "scope": "Shielder circuits (private zkOS-circuits at 491a0dd), Shielder.sol and Poseidon2 Solidity generator, and the Rust/TypeScript client SDK; the Halo2 verifier and the Poseidon2 circuit component were out of scope",
            "url": "https://reports.zksecurity.xyz/reports/aleph-zero-shielder/",
            "commit": "22e2f52f93b45a9aaac09caeb9d1ca0544279ad5",
            "repo": "https://github.com/Cardinal-Cryptography/zkOS-monorepo",
            "covers_deployed": "partly",
            "findings": "1 medium, 3 informational; fixes linked to zkOS-monorepo pull requests",
            "note": "Commissioned as the Aleph Zero Shielder. Shielder.sol changed after the audited commit (caller commitment, AR key setter, protocol fees in April-July 2025), and the Base deployment comes from blanksquare-monorepo@5dad5a07."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C5"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 2,
          "limiting": [
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 1,
          "limiting": [
            "P1",
            "P2"
          ]
        },
        "S": {
          "score": 1,
          "limiting": [
            "S1",
            "S2",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 13,
        "short": 10,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "coca-card",
      "name": "COCA Card",
      "type": "incumbent",
      "website": "https://www.coca.xyz",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "COCA app and backend (card management, top-up, compliance)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "CCA Labs FZCO",
          "required": true
        },
        {
          "name": "Card spending contract or smart-wallet module (chain and address not disclosed)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "COCA / card program provider",
          "required": true
        },
        {
          "name": "COCA smart wallet (EIP-7702 per COCA docs; keys via Privy)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "User (infrastructure by Privy and COCA)",
          "required": true
        },
        {
          "name": "Third-party card program provider and issuer (not named by COCA)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Not disclosed",
          "required": true
        },
        {
          "name": "Visa (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "KYC (passport-based; vendor not named)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Not disclosed",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "detail": "The COCA Wallet Terms (dated 4 November 2023) let COCA terminate, suspend or limit any user's access or functionality without liability.",
              "quote": "we may at any time and without liability, terminate, suspend or limit your use or any functionality of the Coca Wallet",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No settlement contract could be assessed. The terms let COCA suspend or limit an individual's use at its discretion with no notice period, and the card itself is run by an unnamed third party. Anchor 0 (can target individuals with no notice).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "detail": "The terms describe card use as moving assets to a third party's linked smart contract wallet, provided by third-party service providers.",
              "quote": "transfer Digital Assets to a third party linked smart contract wallet for use in fiat payment system as an extension provided by third party services providers",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.coca.xyz/coca/the-bank-we-all-deserve/where-is-my-money-stored-and-who-controls-it",
              "detail": "COCA's docs say a card authorization triggers the smart wallet to approve the amount, with COCA providing the \"card\" and \"compliance rails\"; no contract, ABI or chain is given.",
              "quote": "COCA provides the bank-like interface (app, card, support, compliance rails)",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Card settlement runs through COCA's and a third-party provider's card system; no direct contract path is published. Docs and terms only, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.coca.xyz/coca/the-bank-we-all-deserve/is-coca-safe",
              "detail": "COCA says its wallet runs on Privy's key infrastructure; card authorization and top-ups run through COCA's app and its card partner.",
              "quote": "we use Privy as part of the wallet infrastructure",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "detail": "Card use is an extension provided by third-party service providers.",
              "quote": "as an extension provided by third party services providers",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card flow depends on COCA's closed backend, Privy, an unnamed card program provider and issuer, and Visa. None is public or has a fallback. Closed and single-vendor, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "detail": "The terms define prohibited countries (a named list plus any country sanctioned by the UN Security Council or under the user's local law).",
              "quote": "is sanctioned by the United Nations Security Council",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.coca.xyz/coca/banking-account/overview",
              "detail": "COCA's docs limit the card to residents of 54 listed countries.",
              "quote": "Card availability depends on your residence in one of the 54 supported countries",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Geographic and sanctions restrictions are disclosed in the terms and docs. The settlement layer is undisclosed, so its neutrality cannot be shown. Docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.coca.xyz/coca/banking-account/overview",
              "detail": "The docs say only that stablecoins can be topped up on multiple blockchains, without naming tokens, chains or contracts.",
              "quote": "supported stablecoins on multiple blockchains",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Neither the card's settlement token nor its chain is enumerated, and no freeze or sequencer assumptions are stated. Provider's own description, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "detail": "The terms reserve all rights in the COCA software (source and object forms) to the NCW Group and grant users only a revocable personal licence.",
              "quote": "we grant you a personal, non-exclusive, limited, revocable and non-transferable license to use the NCW Group Technology",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Required components are closed and proprietary, so F1 is 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "detail": "Card use depends on third-party service providers' fiat payment system.",
              "quote": "transfer Digital Assets to a third party linked smart contract wallet for use in fiat payment system as an extension provided by third party services providers",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card cannot run without COCA's hosted service and its third-party card provider. Core cannot run without proprietary components, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/privacy",
              "detail": "The privacy policy discloses first- and third-party cookies, without naming analytics vendors.",
              "quote": "first party and third party cookies when you access our services",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tracking is disclosed in the policy without vendors. The app was not inspected and no trace was run. Documented cap, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/privacy",
              "detail": "The privacy policy discloses collection of location and device data, including for AML and sanctions purposes; COCA's docs say the card is ordered with a passport, while its home page says the wallet needs no KYC.",
              "quote": "location data for the purpose of preventing and detecting crime and to comply with laws relating to money laundering",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Identity and location data beyond settlement needs are collected for the card and disclosed in the policy only. Disclosed in policy, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/privacy",
              "detail": "The privacy policy discloses sharing with service providers by category, without naming the card partner or KYC vendor.",
              "quote": "with third parties providing services to us, such as market analysis and benchmarking",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties are disclosed by category (Privy and Morpho are named in the docs; the card issuer and KYC vendor are not). None can be swapped. No trace was run, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The COCA Wallet Terms (https://www.coca.xyz/terms, dated 4 November 2023) name CCA Labs FZCO, Dubai Silicon Oasis, UAE, as the wallet provider and describe the card as a third-party extension; no COCA document names the card issuer, programme manager or any licence. COCA's docs describe the account as a self-custodial smart wallet and say COCA cannot move or freeze user funds; no artifact backs that claim.",
      "notes": "Classified as incumbent: I found no verified contract or public repository needed to run the card. Searched: coca.xyz (home, terms, privacy), docs.coca.xyz (full llms.txt index, all 19 pages; the only addresses are the COCA ERC-20 token on Polygon and Base, which is not in the card path), GitHub (users/orgs coca-xyz, cocaxyz, cocawallet, coca-wallet, coca-card, coca-finance, ccalabs, cca-labs, CCALabs: 404; coca-labs has two unrelated 2024 repos, cocalabs and cocacard are empty; code search for coca.xyz finds only third-party lists), and subdomains app., web., api., wallet., card.coca.xyz (no response). The docs say the card spends from an EIP-7702 smart wallet that approves each authorization, but give no chain, address, ABI or audit; these claims were not used to score custody. The Android app id is com.wirex.wallet, and a third-party guide says Wirex supplied the card infrastructure at launch; I found no COCA artifact linking the card to Wirex's onchain stack, so it is not evidence here. Re-assess as type card if COCA publishes the spending contract.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "EU",
          "IS",
          "NO",
          "AD",
          "GI",
          "MC",
          "ME",
          "CH",
          "GB",
          "AU",
          "HK",
          "ID",
          "MY",
          "NZ",
          "PH",
          "SG",
          "TW",
          "TH",
          "VN",
          "AR",
          "BR",
          "CL",
          "CO",
          "EC",
          "MX",
          "PE"
        ],
        "note": "The COCA card is limited to residents of the countries listed in COCA's docs. The docs say \"54 supported countries, which include\" and then name 52: the 29 listed under \"EEA countries\" (the EU 27 plus Iceland and Norway; Liechtenstein is not named), six other European countries, ten in Asia-Pacific and seven in Latin America. The two unnamed countries are not listed here. Separately, the COCA Wallet Terms (4 November 2023) prohibit residents of named countries (Afghanistan, North Korea, DR Congo, Eritrea, Libya, Somalia, South Sudan, Sudan, Yemen, Iraq, Iran, Cuba, Syria, Mali, Central African Republic, Guinea-Bissau, Lebanon) and any UN-sanctioned country; none of those are on the card list.",
        "evidence": [
          {
            "tier": "claimed",
            "by": "provider",
            "kind": "document",
            "url": "https://docs.coca.xyz/coca/banking-account/overview",
            "detail": "COCA's docs list the card's supported residence countries by region (EEA, Other Europe, Asia-Pacific, Latin America).",
            "quote": "Andorra, Gibraltar, Monaco, Montenegro, Switzerland, United Kingdom.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.coca.xyz/terms",
            "detail": "The COCA Wallet Terms define Prohibited Countries by name and require users not to be resident in them.",
            "quote": "Afghanistan, the Democratic People's Republic of Korea, Democratic Republic of Congo, Eritrea, Libya",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true
          }
        ],
        "conversion": "at_spend",
        "note": "The COCA Banking Account is a smart-contract wallet the user controls (Privy keys); at each card authorisation the wallet approves the exact amount, which is moved for settlement through COCA and its unnamed card partner. The account holds USD and EUR balances. The September 2026 update shows exchange rates as local currency per USDC, which indicates the USD balance is held in USDC; the token behind the EUR balance (funded by SEPA to the COCA IBAN) is not named in any COCA source found, so it is not listed. USDC and USDT can be deposited on many chains (NEAR, Ethereum, Arbitrum, Base, Solana, Gnosis, Polygon, Optimism, Avalanche and others); whether deposited USDT is kept as USDT or swapped into the USD balance is not stated. The chain and contract of the spending balance are not disclosed.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.coca.xyz/coca/the-bank-we-all-deserve/where-is-my-money-stored-and-who-controls-it",
            "detail": "The docs say the Banking Account is a user-controlled smart wallet and that only the authorised amount of a card payment is moved for settlement.",
            "quote": "Only the authorized amount is moved for settlement",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.coca.xyz/post/coca-monthly-update-september-2026",
            "archive": "data/archive/coca-card-ops-update-sep-2026.txt",
            "detail": "COCA's September 2026 update says the app now shows how much local currency one USDC is worth and which account currency a payment came from.",
            "quote": "you see how much of your local currency one USDC is worth",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.coca.xyz/post/coca-monthly-update-august-2026",
            "archive": "data/archive/coca-card-ops-update-aug-2026.txt",
            "detail": "COCA's August 2026 update lists the chains on which USDC and USDT can be deposited to fund the banking account.",
            "quote": "making it simpler to fund your COCA banking account",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "coca.xyz (terms, privacy) and docs.coca.xyz (all 19 pages; the Is COCA Safe page cites audits of Privy and Morpho but none of COCA's own code), the GitHub orgs and users listed in the notes (no card or wallet code), and Privy's security docs, which point to its open-source Shamir secret-sharing library and its two published reports. No audit of COCA's smart wallet, spending module or backend is published. Morpho vaults are a yield feature, not the card path. Privy's SOC 2 and its other audits (Doyensec, infrastructure) are not published as reports.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Zellic",
            "date": "2023-08-15",
            "type": "audit",
            "scope": "Shared component: Privy shamir-secret-sharing TypeScript library (key splitting used by Privy embedded wallets)",
            "url": "https://github.com/Zellic/publications/blob/master/Privy_Shamir_Secret_Sharing_-_Zellic_Audit_Report.pdf",
            "commit": "cd8422d",
            "repo": "https://github.com/privy-io/shamir-secret-sharing",
            "covers_deployed": "unknown",
            "findings": "1 low; acknowledged",
            "note": "Assessment 27-29 June 2023. COCA says wallet keys are managed via Privy but not which Privy key scheme or library version its wallets use."
          },
          {
            "auditor": "Cure53",
            "date": "2023-04-24",
            "type": "audit",
            "scope": "Shared component: Privy shamir-secret-sharing TypeScript library, cryptography review and code audit",
            "url": "https://cure53.de/audit-report_privy-sss-library.pdf",
            "commit": "3383ad927211615f3d70b5ceb5489f8a149be191",
            "repo": "https://github.com/privy-io/shamir-secret-sharing",
            "covers_deployed": "unknown",
            "findings": "1 high (polynomial degree could be below t-1), 2 info; fixes verified by Cure53",
            "note": "Testing in February 2023 (two days). Covers only the library, not Privy's key-management service."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 10,
        "unk": 13,
        "total": 23
      }
    },
    {
      "slug": "coinbase-commerce",
      "name": "Coinbase Commerce (Onchain Payment Protocol)",
      "type": "checkout",
      "website": "https://beta.commerce.coinbase.com",
      "primary_chain": {
        "name": "Base",
        "chain_id": 8453,
        "basis": "Base Transfers deployments of the Commerce Onchain Payment Protocol. OnchainKit Checkout, the only public Commerce checkout SDK, forces base.id and USDC on Base (CheckoutProvider.tsx L297-L300, constants.ts L49 at 3ecbd8fd). Sampled Transferred logs put Base payments on 0x0305…b7a8 until 2026-04-01; 0xeADE…4971 is the README address. Excluded: Ethereum 0x1DAe…b25C, Polygon 0xc225…28FB, older Base deployments, testnets."
      },
      "repos": [
        {
          "url": "https://github.com/coinbase/commerce-onchain-payment-protocol",
          "role": "contracts",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/coinbase/onchainkit",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/coinbase/coinbase-commerce-php",
          "role": "sdk",
          "license": "MIT"
        }
      ],
      "contracts": [
        {
          "address": "0x03059433BCdB6144624cC2443159D9445C32b7a8",
          "chain_id": 8453,
          "role": "Transfers (Oct 2024 build; carried Base payments to 2026-04)",
          "verified": "sourcify"
        },
        {
          "address": "0xeADE6bE02d043b3550bE19E960504dbA14A14971",
          "chain_id": 8453,
          "role": "Transfers (README-documented Base address, repo HEAD)",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Transfers settlement contract (Base)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Coinbase (owner EOA 0x8899…428C)",
          "required": true,
          "repo": "https://github.com/coinbase/commerce-onchain-payment-protocol"
        },
        {
          "name": "Coinbase Commerce operator signer (TransferIntent signing key)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Coinbase Bermuda Technologies Limited",
          "required": true
        },
        {
          "name": "Coinbase Commerce Charge API (api.commerce.coinbase.com)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Coinbase Bermuda Technologies Limited",
          "required": true
        },
        {
          "name": "Commerce merchant account, onboarding and dashboard",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Coinbase Bermuda Technologies Limited",
          "required": true
        },
        {
          "name": "Hosted checkout page (commerce.coinbase.com/pay)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Coinbase",
          "required": false
        },
        {
          "name": "OnchainKit Checkout component (deprecated 2026-09-22)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "Coinbase",
          "required": false,
          "repo": "https://github.com/coinbase/onchainkit"
        },
        {
          "name": "CDP JSON-RPC endpoint serving cdp_hydrateCharge and cdp_createProductCharge",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Coinbase Developer Platform",
          "required": false
        },
        {
          "name": "Commerce API client libraries (PHP, Ruby)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "Coinbase",
          "required": false,
          "repo": "https://github.com/coinbase/coinbase-commerce-php"
        },
        {
          "name": "Permit2 (SignatureTransfer)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "Uniswap Labs (immutable deployment)",
          "required": false,
          "repo": "https://github.com/Uniswap/permit2"
        },
        {
          "name": "Uniswap Universal Router (swap-and-pay paths)",
          "role": "contracts",
          "public": true,
          "license": "GPL-2.0-or-later",
          "operator": "Uniswap Labs",
          "required": false,
          "repo": "https://github.com/Uniswap/universal-router"
        },
        {
          "name": "Hosted checkout analytics (Amplitude, Sprig, Bugsnag, as.coinbase.com)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Coinbase and named vendors",
          "required": false
        },
        {
          "name": "Base mainnet (chain 8453)",
          "role": "ledger",
          "public": true,
          "license": "MIT",
          "operator": "Base network (sequencer operator not verified here)",
          "required": true,
          "repo": "https://github.com/ethereum-optimism/optimism"
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/transfers/Transfers.sol#L800-L808",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/transfers/Transfers.sol",
              "detail": "pause() and unpause() are onlyOwner; every payment entrypoint (transferNative L147-L155, transferToken L172, transferTokenPreApproved L224, wrapAndTransfer L271, unwrapAndTransfer L298, swap paths L389/L417/L463, subsidizedTransferToken L512) carries whenNotPaused.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "address": "0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "chain_id": 8453,
              "block_number": 52285285,
              "detail": "owner() of the Transfers contract that carried Base payments is 0x8899CECFD929504414696C734eAf6300FDbB428C at block 52285285; paused() returns false.",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0x03059433BCdB6144624cC2443159D9445C32b7a8 \"owner()(address)\" --rpc-url https://mainnet.base.org --block 52285285",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000008899cecfd929504414696c734eaf6300fdbb428c"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "address": "0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "chain_id": 8453,
              "block_number": 52285285,
              "detail": "owner() of the README-documented Base Transfers contract is the same 0x8899CECFD929504414696C734eAf6300FDbB428C at block 52285285.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000008899cecfd929504414696c734eaf6300fdbb428c"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x8899CECFD929504414696C734eAf6300FDbB428C",
              "address": "0x8899CECFD929504414696C734eAf6300FDbB428C",
              "chain_id": 8453,
              "block_number": 52285285,
              "eoa": true,
              "detail": "The owner has no code at block 52285285 (cast codesize returns 0, nonce 22); getThreshold() and getOwners() revert, so it is an EOA and not a Safe. It is also the deployer of both Transfers contracts (Sourcify deployment data).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "One externally owned account can pause every payment method of both Base Transfers contracts at once, with no multisig and no timelock. The same key can appoint a sweeper (see S1). Pause is global; the contract has no per-address blacklist. A second control sits outside the contract: every payment needs a TransferIntent signed by its operator, and for Commerce payments that operator is Coinbase, which can decline to sign for any payer or merchant without notice (README L60-L65). The contracts were not paused at block 52285285.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/README.md#L35-L42",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "README.md",
              "detail": "README states that registering as an operator is permissionless and that Coinbase controls only the operator address used for Coinbase Commerce; L10-L24 lists the deployed addresses, including Base 0xeADE6bE02d043b3550bE19E960504dbA14A14971, and L81-L104 documents each payment method.",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/coinbase/commerce-onchain-payment-protocol/contents/README.md?ref=d891289bd1f41bb95f749af537f2b6a36b17f889 --jq .content | base64 -d | sed -n 35,42p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/transfers/Transfers.sol#L780-L798",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/transfers/Transfers.sol",
              "detail": "registerOperator and registerOperatorWithFeeDestination have no access modifier; validIntent (L79-L124) only requires the intent to be signed by the intent's own operator, so a payee registered as its own operator can sign intents for its payers.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "address": "0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "chain_id": 8453,
              "block_number": 52285285,
              "detail": "Sourcify reports exact_match (creation and runtime) for the README Base address, and its Transfers.sol, ITransfers.sol and Sweepable.sol are byte-identical to the repo at d891289; paused() returns false at block 52285285.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://sourcify.dev/server/v2/contract/8453/0xeADE6bE02d043b3550bE19E960504dbA14A14971 && cast call 0xeADE6bE02d043b3550bE19E960504dbA14A14971 \"paused()(bool)\" --rpc-url https://mainnet.base.org --block 52285285",
              "check": {
                "call": "0x5c975abb",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payee can settle without Coinbase. It registers its own address as an operator, signs a TransferIntent for each payer, and the payer calls a documented method on the deployed contract. The README documents the ABI-level methods, the addresses and the permissionless operator role, and the deployed code matches the repo exactly. Refunds have no onchain path because payments are atomic; nothing is held to refund. The direct path still depends on the owner not pausing the contract (C1). Judgment call: we read \"payer or payee completes settlement\" as satisfied when the payee acts as its own operator, because the operator signature then comes from a party to the payment and not from the provider.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/api/buildPayTransaction.ts#L17-L52",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/api/buildPayTransaction.ts",
              "detail": "The checkout obtains the signed TransferIntent and contract address only from the JSON-RPC methods cdp_hydrateCharge or cdp_createProductCharge, sent to the CDP endpoint built in getRPCUrl.ts L7-L16 (throws without a CDP API key or rpcUrl).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/coinbase-commerce-php/blob/c258b69d5bb6d4dd45fdc68fee3b60c4a75247d2/src/ApiClient.php#L17-L21",
              "commit": "c258b69d5bb6d4dd45fdc68fee3b60c4a75247d2",
              "path": "src/ApiClient.php",
              "detail": "The merchant client library defaults to https://api.commerce.coinbase.com/ for creating charges; no repo in the coinbase org contains the Charge API, the operator signing service, or an alternative operator implementation.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/README.md#L35-L42",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "README.md",
              "detail": "The operator role is documented as permissionless, so other operators are possible, but no operator service code is published.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.cdp.coinbase.com/coinbase-business/checkout-apis/migrate-from-commerce/overview",
              "detail": "CDP docs direct Commerce merchants from the Charge API at api.commerce.coinbase.com to the Coinbase Business Checkouts API; the Commerce API docs no longer resolve (docs.cdp.coinbase.com/commerce/... returns 404).",
              "checked_at": "2026-10-07",
              "quote": "Migrate from Commerce Charge API to the Checkouts API",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A Commerce payment needs three things only Coinbase runs and has not published: the Charge API, the operator key that signs each TransferIntent, and the merchant account. The public SDK can point at another RPC URL, but only Coinbase serves the cdp_ charge methods. On 2026-10-07 api.commerce.coinbase.com returned HTTP 503 and commerce.coinbase.com returned 502 to curl. Judgment call: we score 1 and not 0, because anchor 0 says single-vendor, and the protocol documents that anyone can register as an operator. No operator code exists to self-host, so it cannot be 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/transfers/Transfers.sol#L79-L132",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/transfers/Transfers.sol",
              "detail": "The only per-payment checks are the operator signature, deadline, non-zero recipient, replay and operator registration; a search of contracts/ for blocklist, sanction, deny, allowlist or country finds nothing.",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/coinbase/commerce-onchain-payment-protocol/tarball/d891289bd1f41bb95f749af537f2b6a36b17f889 | tar -xzO --include='*/contracts/*' | grep -ciE 'blacklist|blocklist|sanction|allowlist|country'",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/README.md#L60-L65",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "README.md",
              "detail": "The README discloses that the operator signature lets an operator be selective about which payments to allow based on internal policies, legal requirements or other reasons.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
              "archive": "data/archive/coinbase-commerce-terms.txt",
              "detail": "Commerce Terms (last updated 2025-10-29) bar embargoed countries and persons on the SDN, Denied Persons, Unverified and Entity lists and HM Treasury's sanctions regime.",
              "checked_at": "2026-10-07",
              "quote": "Specially Designated Nationals List",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement contract has no address or geographic filter. Filtering sits at the edge: Coinbase, as operator, can refuse to sign an intent. The README says this power exists, and the Terms name the sanctions lists Coinbase applies to merchants. A payee who acts as its own operator bypasses it (C2). The cell misses 3 for two reasons. The disclosure in the repo does not name a list source; only the Terms do. And the API and signer that apply the filter are closed, so we cannot see what they screen in practice, including payer screening. No trace was run.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/README.md#L10-L24",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "README.md",
              "detail": "Deployments are enumerated per chain (Ethereum, Polygon, Base, plus testnets); L5-L7 says payers may use any token with Uniswap liquidity.",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/coinbase/commerce-onchain-payment-protocol/contents/README.md?ref=d891289bd1f41bb95f749af537f2b6a36b17f889 --jq .content | base64 -d | sed -n 10,24p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/checkout/constants.ts#L49-L55",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/checkout/constants.ts",
              "detail": "The SDK checkout hardcodes USDC on Base (0x833589fcd6edb6e08f4c7c32d4f71b54bda02913) and the approve plus transferTokenPreApproved methods.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Chains and Transfers addresses are listed in the repo, and the SDK checkout's settlement token, USDC on Base, is in code. The hosted checkout's accepted-token list lives only in the closed API. Nothing in the repo, the SDK, or the Terms tells payees that Circle can freeze USDC or that Base runs a centralized sequencer. Judgment call: we score 2 and not 1, because the enumeration for the public path is in code. The hosted checkout's list being API-only is the listed common failure, and it keeps the cell from 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "address": "0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "chain_id": 8453,
              "block_number": 52285285,
              "detail": "Sourcify exact_match (creation and runtime, solc 0.8.17, verified 2024-10-20); its Transfers.sol differs from the repo by a permit nonce check and PermitCallFailed error that exist only in the Sourcify sources.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://sourcify.dev/server/v2/contract/8453/0x03059433BCdB6144624cC2443159D9445C32b7a8"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "address": "0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "chain_id": 8453,
              "block_number": 52285285,
              "detail": "Sourcify exact_match (creation and runtime, verified 2024-08-09); sources identical to the repo at d891289.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/README.md#L26-L31",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "README.md",
              "detail": "The repo has no foundry.toml, hardhat config, package.json or remappings; the README says Permit2 must be copied in by hand to compile.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Both Base Transfers contracts are exact matches on Sourcify. The cell misses 3 because the repo has no build script that reproduces the bytecode. The contract that carried most Base payments (0x0305…b7a8) was built from source that was never pushed to the repo; that source is public only through Sourcify. We did not check Basescan verification, because Basescan blocks automated requests.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/tree/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts",
              "detail": "The protocol repo holds only Transfers.sol, Sweepable.sol and three interfaces; no deploy scripts, tests, operator service, API or indexer.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/README.md#L1-L3",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "README.md",
              "detail": "OnchainKit, the public checkout SDK, is marked deprecated and unmaintained; the GitHub repo is archived and npm marks @coinbase/onchainkit deprecated.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The contracts, a now-deprecated SDK checkout component, and the old API client libraries are public. The Charge API, the operator signer, the hosted checkout page, the merchant dashboard and any indexer are closed. The Commerce API reference has been removed from Coinbase's docs. Judgment call: we score 1 and not 0, because the public contracts can be used without the closed stack (C2).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/README.md#L33-L65",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "README.md",
              "detail": "The README explains operators, TransferIntent fields and signing, and lists addresses (L10-L24), but gives no build, deploy or operator-service steps.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The docs are enough to operate the deployed contract as your own operator, though you would have to write the signing and frontend code yourself. They are not enough to rebuild Coinbase Commerce. Reproduction not attempted, so the cap is 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/interfaces/ITransfers.sol#L43-L76",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/interfaces/ITransfers.sol",
              "detail": "The Transferred, OperatorRegistered and OperatorUnregistered events and the TransferIntent struct (L19-L30) are defined in source; no ABI JSON is committed.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.cdp.coinbase.com/coinbase-business/checkout-apis/migrate-from-commerce/overview",
              "detail": "The only surviving Charge API description is the hosted migration mapping; no OpenAPI file and no payee export format is in any Commerce repo.",
              "checked_at": "2026-10-07",
              "quote": "Change base URL From api.commerce.coinbase.com",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ABIs can be derived from the verified source, and the events are in the repo. No repo has an API schema; the Charge API was only ever described on hosted docs, which are now replaced by a migration page. We found no payee data export in any format. Judgment call: we score 1, because the API schema is not in the repo.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/LICENSE.md",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "LICENSE.md",
              "detail": "The repo LICENSE.md is Apache License 2.0, but every Solidity file starts with SPDX-License-Identifier UNLICENSED (Transfers.sol L1, Sweepable.sol L1, ITransfers.sol L1).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Three required components are closed: the Charge API, the operator signer and the merchant backend. A closed component cannot be forked, so the cell is 0. The public contracts also carry mixed signals: the repo license is Apache-2.0, but every source file is tagged UNLICENSED. OnchainKit and the client libraries are MIT.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/tree/d891289bd1f41bb95f749af537f2b6a36b17f889/",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "/",
              "detail": "The repo root holds only .gitignore, LICENSE.md, README.md and contracts/; there is no CONTRIBUTING, CLA or license-stability statement. Merged PR",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/LICENSE.md",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "LICENSE.md",
              "detail": "LICENSE.md has a single commit (fb5e8a2, 2023-11-16 public release); no relicense event.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/coinbase/commerce-onchain-payment-protocol/commits?path=LICENSE.md\" --jq '.[].sha'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "We found no CLA and no relicensing event. The repo makes no written commitment to keep the license stable. The UNLICENSED SPDX headers are an ambiguity, not a relicense, and are noted under F1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/core/network/getRPCUrl.ts#L7-L16",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/core/network/getRPCUrl.ts",
              "detail": "The checkout's charge calls throw \"API Key Unset\" without a Coinbase Developer Platform API key or rpcUrl, and only Coinbase serves the cdp_ charge methods.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/transfers/Transfers.sol#L780-L798",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/transfers/Transfers.sol",
              "detail": "The contract itself runs with any registered operator, so the onchain core needs no proprietary component.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A Coinbase Commerce deployment needs the hosted Charge API and Coinbase's operator key, and no open alternative is published. The settlement contract does not need them, since any operator can use it. Judgment call: we score 1 and not 0, because the core contract can run without proprietary parts. A merchant would still have to write their own operator and checkout code, because none exists in the open.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/checkout/components/CheckoutProvider.tsx#L236-L240",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/checkout/components/CheckoutProvider.tsx",
              "detail": "On pay, the checkout sends a checkoutInitiated event with the payer address, amount and productId; analyticsService.ts L11-L47 posts it with apiKey, sessionId, page origin and document.title to https://api.developer.coinbase.com/analytics.",
              "checked_at": "2026-10-07",
              "package": {
                "name": "@coinbase/onchainkit",
                "version": "1.1.3",
                "integrity": "sha512-DoMHoR1DFC6AeQabf+OA9PEU0OVI+PCwbbnOU40TfrszoPIkgWomO/i3q6S4lvU8Po51l+LrUqkP25o9x3U+cA=="
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/core/types.ts#L10-L13",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/core/types.ts",
              "detail": "Telemetry defaults to enabled (OnchainKitProvider.tsx L83 analytics ?? true); the opt-out is described only in this type comment.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://commerce.coinbase.com/pay/test",
              "detail": "Steps run 2026-10-07: curl the page, then curl its two bundles /pay/static/main.3b876a63b31216f2b5a8.js and /pay/static/27849.279546bfef0c8b7f57c7.js and grep. The bundles initialise Amplitude (amplitudeApiKey a576ff6d…), the Sprig SDK (api.sprig.com, session-replay code), Bugsnag, Coinbase's as.coinbase.com analytics service and reCAPTCHA Enterprise.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260611115217/https://www.coinbase.com/en-ca/legal/commerce/privacy-policy",
              "archive": "data/archive/coinbase-commerce-privacy.txt",
              "detail": "The Commerce Privacy Policy (last updated 2024-12-03) discloses analytics providers and device and IP collection by category, without naming vendors.",
              "checked_at": "2026-10-07",
              "quote": "We receive information about your website usage and interactions from third party analytics providers.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Telemetry is on by default in both payment frontends. The SDK checkout sends the payer's address and amount to Coinbase's analytics endpoint unless the integrator sets analytics to false. The hosted checkout bundles Amplitude, Sprig (which includes session-replay code), Bugsnag and Coinbase's own analytics service. The privacy policy discloses analytics providers only by category. Judgment call: we score 1 and not 0, following the Daimo precedent: the policy disclosure covers analytics in general, even though it names no vendor. We found no fingerprinting library; the \"fingerprint\" matches are Bugsnag ID helpers and icon names.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/api/buildPayTransaction.ts#L21-L52",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/api/buildPayTransaction.ts",
              "detail": "The SDK charge request carries only the payer address and a chargeId or productId.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260611115217/https://www.coinbase.com/en-ca/legal/commerce/privacy-policy",
              "archive": "data/archive/coinbase-commerce-privacy.txt",
              "detail": "The policy lists device, browser, IP and cookie data collected automatically, blockchain analysis of wallet addresses, and personal information merchants choose to request from customers.",
              "checked_at": "2026-10-07",
              "quote": "Any personal information you choose to request from your customers as part of the transaction",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The public SDK request carries only what settlement needs. The privacy policy says Commerce also collects device, IP and cookie data. It analyses payers' wallet addresses on public chains, and it lets merchants collect further customer fields at checkout. All of this is disclosed only in the policy. The hosted checkout's form code is closed, so we could not see which fields are optional.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/interfaces/ITransfers.sol#L46-L60",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/interfaces/ITransfers.sol",
              "detail": "Transferred emits the operator (indexed), the 16-byte intent id, the recipient, the sender, the amount and the currency; README L110-L120 documents the same fields.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/tx/0xb20c670013eb85ce88ed2353acca655f0c1463552be8c39b335908fe2cbfe2fb",
              "address": "0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "chain_id": 8453,
              "block_number": 44134913,
              "detail": "The Transferred log in this swapAndTransferUniswapV3Native payment names operator 0x8fcCC78Dae0a8f93B0fE6799de888d4C57e273db, id 0x5e1eb104b16f4718bb6ef87845be984d, recipient 0xFf5680F0938B01b07952eF075B23082eB136E8Af and sender 0x33a7A26d9C6C799a02E4870137dE647674371FfC.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Every payment publishes payer, payee, amount and a per-charge id in a single event, with Coinbase's operator address indexed. Anyone can list all of a merchant's Commerce payers and revenue by filtering on the operator and recipient. The README documents the event fields. The protocol offers no fresh-address or privacy option, because the recipient is the merchant's fixed wallet.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/core/network/getChainPublicClient.ts#L5-L27",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/core/network/getChainPublicClient.ts",
              "detail": "Balance reads go to Coinbase's CDP node when an API key is set, otherwise to viem's default public RPC; the charge call and analytics go to api.developer.coinbase.com; insufficient balance opens keys.coinbase.com (CheckoutProvider.tsx L303-L309).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://commerce.coinbase.com/pay/test",
              "detail": "Steps run 2026-10-07: grep of the hosted checkout bundles (see P1) shows requests to api.commerce.coinbase.com, api.sprig.com, Amplitude, Bugsnag, as.coinbase.com, google.com/recaptcha and mainnet.base.org.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260611115217/https://www.coinbase.com/en-ca/legal/commerce/privacy-policy",
              "archive": "data/archive/coinbase-commerce-privacy.txt",
              "detail": "The policy discloses sharing with service providers and analytics providers by category only.",
              "checked_at": "2026-10-07",
              "quote": "We work with service providers, partners and other third-parties providers to help us provide our Services",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "In the SDK path, the only third party besides Coinbase is the RPC provider, and an integrator can replace the RPC. In the hosted path, Sprig, Amplitude, Bugsnag and Google reCAPTCHA see the payer's session, and nobody can swap them out. The policy discloses them only as categories. Judgment call: we score 1 and not 0, because the vendors appear in shipped code and are covered by the category disclosure. They are not named in any document.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/core/network/getRPCUrl.ts#L7-L16",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/core/network/getRPCUrl.ts",
              "detail": "rpcUrl overrides the CDP endpoint, and analyticsUrl overrides the analytics endpoint (analyticsService.ts L38); defaultPublicClients overrides the read client.",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/coinbase/onchainkit/contents/packages/onchainkit/src/core/network/getRPCUrl.ts?ref=3ecbd8fd28bf65002a4ad97092bfd0b157310e22 --jq .content | base64 -d",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK's endpoints can be changed in code, but not in a UI. The charge methods only work against Coinbase, and no indexer code is public, so payment data cannot stay inside the integrator's own perimeter. The hosted checkout has no endpoint setting at all.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/transfers/Transfers.sol#L720-L737",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/transfers/Transfers.sol",
              "detail": "Inside the payer's own transaction, the contract pulls exactly recipientAmount+feeAmount (L189-L214) and immediately sends recipientAmount to the intent's recipient and feeAmount to the operator's fee destination; if any step fails, the transaction reverts.",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/coinbase/commerce-onchain-payment-protocol/contents/contracts/transfers/Transfers.sol?ref=d891289bd1f41bb95f749af537f2b6a36b17f889 --jq .content | base64 -d | sed -n 720,737p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/utils/Sweepable.sol#L34-L79",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/utils/Sweepable.sol",
              "detail": "The owner can appoint a sweeper, who can move any balance resting in the contract to any address.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "address": "0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "chain_id": 8453,
              "block_number": 52285285,
              "detail": "sweeper() is the zero address at block 52285285; the contract nonetheless holds 4,578.07 USDC (0xeADE…4971 holds 1,673.48 USDC) that did not arrive through a completed payment and that an owner-appointed sweeper could move.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x9189a59e",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A completed payment moves from payer to merchant inside one atomic transaction, so funds are never held across blocks. The Commerce Terms state that Coinbase does not store the crypto merchants receive (see S4). Once a merchant has been paid, the provider cannot redirect the money. The recipient is fixed in the operator-signed intent, which the payer's wallet shows before signing. The contract does hold residual balances, about 6,250 USDC across the two Base contracts. These are most likely tokens sent to the contract directly by mistake, and the owner EOA can sweep them through a sweeper it appoints. Judgment call: we score 3, because the sweep reaches only stray balances and never funds in an in-progress payment.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "address": "0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "chain_id": 8453,
              "block_number": 52285285,
              "detail": "The EIP-1967 implementation and admin slots both read zero at block 52285285; the verified source has no delegatecall, upgradeTo or selfdestruct.",
              "checked_at": "2026-10-07",
              "recheck": "cast storage 0x03059433BCdB6144624cC2443159D9445C32b7a8 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://mainnet.base.org --block 52285285",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "address": "0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "chain_id": 8453,
              "block_number": 52285285,
              "detail": "The EIP-1967 implementation slot reads zero at block 52285285.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/README.md#L23-L24",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "README.md",
              "detail": "The README states that the contract is non-upgradeable and that new versions are deployed at new addresses.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Neither Base Transfers contract can be upgraded. Coinbase changes behaviour by deploying a new contract and pointing its API at it. It has done this at least six times on Base, and the new address carries no notice to anyone integrating directly. Integrators who call a fixed address keep the old code. The pause power is scored under C1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/checkout/utils/getCommerceContracts.ts#L10-L41",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/checkout/utils/getCommerceContracts.ts",
              "detail": "The SDK batches approve(transfersContract, recipientAmount + feeAmount), an exact amount, with transferTokenPreApproved.",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/coinbase/onchainkit/contents/packages/onchainkit/src/checkout/utils/getCommerceContracts.ts?ref=3ecbd8fd28bf65002a4ad97092bfd0b157310e22 --jq .content | base64 -d | sed -n 10,41p",
              "package": {
                "name": "@coinbase/onchainkit",
                "version": "1.1.3",
                "integrity": "sha512-DoMHoR1DFC6AeQabf+OA9PEU0OVI+PCwbbnOU40TfrszoPIkgWomO/i3q6S4lvU8Po51l+LrUqkP25o9x3U+cA=="
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/transfers/Transfers.sol#L169-L217",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/transfers/Transfers.sol",
              "detail": "The Permit2 path requires requestedAmount == recipientAmount+feeAmount and uses a SignatureTransfer permit with deadline; subsidizedTransferToken (L505-L536) uses an EIP-2612 permit for the exact amount, expiring at the intent deadline.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK asks for an exact-amount approval to the Transfers contract. The contract's other token paths use Permit2 or EIP-2612 permits for the exact amount, with a deadline. The hosted checkout bundles the Permit2 SDK. Its one-time token approval to Permit2 is not readable from the minified code, and that approval may be unbounded. Permit2 still enforces the per-payment amount and expiry.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/blob/d891289bd1f41bb95f749af537f2b6a36b17f889/contracts/transfers/Transfers.sol#L720-L737",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "contracts/transfers/Transfers.sol",
              "detail": "Merchant funds land in the recipient address inside the payment transaction, so nothing remains to withdraw afterwards.",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/coinbase/commerce-onchain-payment-protocol/contents/contracts/transfers/Transfers.sol?ref=d891289bd1f41bb95f749af537f2b6a36b17f889 --jq .content | base64 -d | sed -n 720,737p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "address": "0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "chain_id": 8453,
              "block_number": 52285285,
              "detail": "The README-documented contract is non-upgradeable (implementation slot zero) and unpaused at block 52285285, so the self-operator path from C2 stays usable if Coinbase disappears with the contract unpaused.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
              "archive": "data/archive/coinbase-commerce-terms.txt",
              "detail": "The Commerce Terms state that Coinbase does not store merchants' received crypto.",
              "checked_at": "2026-10-07",
              "quote": "We do not store the cryptocurrency you receive as payment.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=3, C2=3, C3=1 and O3=1. Payees already hold their funds, which arrive in their own wallet atomically (S1). Settlement can continue in principle: a payee can register as operator and sign intents against the unpaused, non-upgradeable contract (C2). No public frontend or operator service exists to do this (C3, O3), and the public SDK only works against Coinbase's API. That fails the anchor-3 condition of a public frontend build. A paused contract would also stay paused if the owner key were lost (C1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/coinbase-commerce-php/blob/c258b69d5bb6d4dd45fdc68fee3b60c4a75247d2/src/Webhook.php#L29-L36",
              "commit": "c258b69d5bb6d4dd45fdc68fee3b60c4a75247d2",
              "path": "src/Webhook.php",
              "detail": "The reference client verifies the webhook signature as HMAC-SHA256 over the raw payload with a constant-time comparison (Util::hashEqual); the API key goes only in a server-side X-CC-Api-Key header (ApiClient.php L214-L224).",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/coinbase/coinbase-commerce-php/contents/src/Webhook.php?ref=c258b69d5bb6d4dd45fdc68fee3b60c4a75247d2 --jq .content | base64 -d | sed -n 29,36p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/onchainkit/blob/3ecbd8fd28bf65002a4ad97092bfd0b157310e22/packages/onchainkit/src/core/network/getRPCUrl.ts#L13-L16",
              "commit": "3ecbd8fd28bf65002a4ad97092bfd0b157310e22",
              "path": "packages/onchainkit/src/core/network/getRPCUrl.ts",
              "detail": "The browser bundle embeds a CDP client API key in the RPC URL path and in analytics payloads; that key is a client key meant to be public and authorises the cdp_ charge and RPC calls.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Merchant API keys stay on the server, and the reference code verifies webhooks. The SDK puts a CDP client key in the browser. That key is meant to be public, but it does authorise charge creation for productId checkouts. No repo describes key scoping or rotation, and the PHP client was last changed in 2021.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/commerce-onchain-payment-protocol/tree/d891289bd1f41bb95f749af537f2b6a36b17f889/",
              "commit": "d891289bd1f41bb95f749af537f2b6a36b17f889",
              "path": "/",
              "detail": "The repo has no audit report, no tests and no SECURITY file at this commit; a GitHub code search for a Commerce onchain protocol audit returns nothing.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/coinbase/.github/blob/a9f35b0168a1bf0e1ebf4835e3484fd96fe1a722/SECURITY.md#L1-L3",
              "commit": "a9f35b0168a1bf0e1ebf4835e3484fd96fe1a722",
              "path": "SECURITY.md",
              "detail": "The org-wide security policy points to the Coinbase HackerOne program; no scope covering the Transfers contracts is stated in any repo.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "We found no audit report for any Transfers deployment. The live Base contract (0x0305…b7a8) carries a fix that is not in the repo. Coinbase runs a bug bounty on HackerOne, but no repo states its scope.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "blocklist",
        "countries": [
          "CU",
          "IR",
          "KP",
          "SD",
          "SY"
        ],
        "note": "The Commerce Terms (last updated 2025-10-29, read from a Wayback snapshot because coinbase.com returns 403 to curl) bar merchants who are in, controlled by, or nationals or residents of Cuba, Iran, North Korea, Sudan or Syria, and bar supplying the Services to those countries or their nationals or residents. They also bar \"any other country subject to United States embargo or HM Treasury's financial sanctions regime\" without naming more; only the five named countries are listed. The Terms are addressed to merchants; payers reach the product through a merchant, and the supply clause covers them. Protocol level: the Transfers contract has no geographic filter, and a payee acting as its own operator can sign intents without Coinbase (see C2, C4). No first-party allowlist of merchant countries was found (help.coinbase.com returns 403; no Wayback copy of a supported-countries page). The product is being retired in favour of Coinbase Business Checkouts.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
            "archive": "data/archive/coinbase-commerce-terms.txt",
            "detail": "Commerce Terms (last updated 2025-10-29), export controls and sanctions clause, names Cuba, Iran, North Korea, Sudan and Syria plus any other country under US embargo or HM Treasury sanctions.",
            "checked_at": "2026-10-09",
            "quote": "national or resident of Cuba, Iran, North Korea, Sudan, or Syria",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Scope is the Commerce Onchain Payment Protocol (Transfers) on Base, as used by Coinbase Commerce charges. The product appears to be winding down. Sampled eth_getLogs on all six Base Transfers addresses DefiLlama tracks show the last Transferred event on 2026-04-01 (block 44134913) and none since. Ethereum and Polygon windows were also empty. On 2026-10-07, api.commerce.coinbase.com returned 503 and commerce.coinbase.com returned 502; www.coinbase.com/commerce now redirects to /business. CDP docs carry only a \"Migrate from Commerce\" guide, and OnchainKit was deprecated on 2026-09-22. Onchain reads are pinned to Base block 52285285; repo reads to commerce-onchain-payment-protocol@d891289, onchainkit@3ecbd8fd (equal to npm 1.1.3 except README) and coinbase-commerce-php@c258b69. No browser traces were run; the hosted checkout was inspected by curling its JS bundles. Search log: docs/research/coinbase-commerce.md.",
      "context": "Coinbase Commerce is offered to merchants by Coinbase Bermuda Technologies Limited under the Commerce Terms of Service (last updated 2025-10-29), which apply UK, Bermuda, Singapore and US sanctions rules and allow Coinbase to suspend accounts without notice. The Commerce Privacy Policy is dated 2024-12-03. Successor product: Coinbase Business Checkouts API (USDC on Base).",
      "audits": {
        "searched": "The coinbase/commerce-onchain-payment-protocol repo (no audits folder, SECURITY file or tests; GitHub code and commit searches for \"audit\" return nothing), the coinbase/.github security policy (HackerOne bug bounty, not an audit), Coinbase's Commerce protocol announcement and docs, web searches for a Transfers contract audit, and auditor portfolios (Trail of Bits publications, Spearbit portfolio, OpenZeppelin, Nethermind). No published audit of any Transfers deployment was found. The separate Commerce Payments Protocol (AuthCaptureEscrow) is a different contract set and is not the assessed path.",
        "checked_at": "2026-10-13",
        "reports": []
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1"
          ]
        },
        "P": {
          "score": 1,
          "limiting": [
            "P1",
            "P2",
            "P3",
            "P4"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 11,
        "short": 12,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "curvy",
      "name": "Curvy",
      "type": "transfer",
      "website": "https://curvy.box",
      "primary_chain": {
        "name": "Arbitrum One",
        "chain_id": 42161,
        "basis": "The contracts README (0xCurvy/contracts@e996fe71 README.md L35-L36) says the production aggregator chain is Arbitrum, and that Base, BSC, Ethereum, Gnosis, Linea, Optimism, Polygon, Tempo and Robinhood run portals only. Unit: the Arbitrum CurvyAggregatorAlphaV2 proxy 0xE519…cbB1, the CurvyVaultV2 proxy 0xcC8d…4f00, PortalFactory 0x4f32…1389 and the registered verifiers. Excluded: portal-only chains, Solana, the V1 contracts, and the testnet and staging deployments."
      },
      "repos": [
        {
          "url": "https://github.com/0xCurvy/contracts",
          "role": "contracts",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/0xCurvy/sdk",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/0xCurvy/rs-core",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/0xCurvy/payments-sdk",
          "role": "sdk",
          "license": "none"
        },
        {
          "url": "https://github.com/0xCurvy/docs",
          "role": "docs",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0xE51924cEF003a654EC9735c4d97f5D4862cBcbB1",
          "chain_id": 42161,
          "role": "CurvyAggregatorAlphaV2 proxy (UUPS)",
          "verified": "none"
        },
        {
          "address": "0x855de6C7A698ea870fc53DE755D612Ed977d3F0A",
          "chain_id": 42161,
          "role": "CurvyAggregatorAlphaV2 implementation",
          "verified": "sourcify"
        },
        {
          "address": "0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
          "chain_id": 42161,
          "role": "CurvyVaultV2 proxy (UUPS, holds funds)",
          "verified": "none"
        },
        {
          "address": "0xBf38e322f4009aeEF390669DfDD05a43c7eaeEb0",
          "chain_id": 42161,
          "role": "CurvyVaultV2 implementation",
          "verified": "sourcify"
        },
        {
          "address": "0x4f32082C5647F8fE0f0Fb567b98F2a5516361389",
          "chain_id": 42161,
          "role": "PortalFactory (deploys per-recipient portals)",
          "verified": "sourcify"
        },
        {
          "address": "0xEFf85079AfF7c3AEe250066eC4AD51ce163dD044",
          "chain_id": 42161,
          "role": "Withdrawal verifier (maxInputs 2)",
          "verified": "none"
        },
        {
          "address": "0xDB3bf26Bdc9d204029722eFaB9c9B4a69e7ab804",
          "chain_id": 42161,
          "role": "Aggregation verifier (2 in, 3 out)",
          "verified": "none"
        },
        {
          "address": "0xFEedE9784EB9DB6358d3D9952Fb832Ebe3677A73",
          "chain_id": 42161,
          "role": "Pending-notes commitment verifier (batch 5)",
          "verified": "none"
        },
        {
          "address": "0xB2c10d9e523B6d7792F1825f4Bb2552860f64b9F",
          "chain_id": 42161,
          "role": "Safe 4-of-6 (owner and AUTHORITY_ROLE)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "CurvyAggregatorAlphaV2 and CurvyVaultV2 (UUPS proxies)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Safe 4-of-6 0xB2c1…4b9F (AUTHORITY_ROLE, no timelock)",
          "required": true,
          "repo": "https://github.com/0xCurvy/contracts"
        },
        {
          "name": "PortalFactory and per-recipient Portal clones",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "OPERATOR_ROLE 0xE679…06d2 (EIP-7702 EOA); AUTHORITY Safe",
          "required": true,
          "repo": "https://github.com/0xCurvy/contracts"
        },
        {
          "name": "Groth16 verifiers (snarkjs-generated)",
          "role": "contracts",
          "public": true,
          "license": "GPL-3.0",
          "operator": "replaceable by AUTHORITY_ROLE",
          "required": true,
          "repo": "https://github.com/0xCurvy/contracts"
        },
        {
          "name": "Portal Broadcaster (operator that deploys shield portals)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Curvy",
          "required": true
        },
        {
          "name": "Curvy API (network registry, auth, notes sync, relay, portal records)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Curvy (api.curvy.box)",
          "required": true
        },
        {
          "name": "Global Ledger address risk scoring",
          "role": "oracle",
          "public": false,
          "license": "proprietary",
          "operator": "Global Ledger via Curvy Portal Broadcaster",
          "required": true
        },
        {
          "name": "Circuit keys host (protocol s3:// paths, circuitKeysBaseUrl)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Curvy",
          "required": true
        },
        {
          "name": "Curvy SDK (@0xcurvy/curvy-sdk)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/0xCurvy/sdk"
        },
        {
          "name": "rs-core (Rust/WASM prover and cryptography)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/0xCurvy/rs-core"
        },
        {
          "name": "Arbitrum One and a JSON-RPC endpoint",
          "role": "ledger",
          "public": true,
          "license": "BUSL-1.1",
          "operator": "Offchain Labs sequencer; RPC configurable",
          "required": true,
          "repo": "https://github.com/OffchainLabs/nitro"
        },
        {
          "name": "Curvy web app (app.curvy.box)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Curvy",
          "required": false
        },
        {
          "name": "LI.FI bridging for portal-only chains",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "LI.FI",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/src/v2/portal/PortalFactory.sol#L160-L185",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "evm/src/v2/portal/PortalFactory.sol",
              "detail": "deployShieldPortal is onlyRole(OPERATOR_ROLE), and it is the only route by which a payee's portal funds enter the pool. The aggregator's portalShield accepts only a portal authorised during that call.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xCurvy/contracts/contents/evm/src/v2/portal/PortalFactory.sol?ref=e996fe719580f4d82ff34f06ee8a0916df65a613\" --jq .content | base64 -d | sed -n 160,185p"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/42161/0x4f32082C5647F8fE0f0Fb567b98F2a5516361389",
              "address": "0x4f32082C5647F8fE0f0Fb567b98F2a5516361389",
              "block_number": 513140605,
              "detail": "hasRole(OPERATOR_ROLE, 0xE679…06d2) on PortalFactory returns true at block 513140605. That address is an EIP-7702-delegated EOA (code 0xef0100…). The Safe granted the role and revoked its own OPERATOR_ROLE in the same block, 0x1dadba35.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x91d1485497667070c54ef182b0f5858b034beac1b6f3089aa2d3188bb1e8929f4fa9b929000000000000000000000000e6793916368eebf5c686d07480480c3b738a06d2",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xE51924cEF003a654EC9735c4d97f5D4862cBcbB1",
              "address": "0xE51924cEF003a654EC9735c4d97f5D4862cBcbB1",
              "block_number": 513140605,
              "detail": "directShieldEnabled() returns false, so deposits that bypass portals are switched off. AUTHORITY_ROLE, which can toggle that switch, swap verifiers, rewire the vault and upgrade, is held by Safe 0xB2c1…4b9F (4-of-6, no timelock).",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xE51924cEF003a654EC9735c4d97f5D4862cBcbB1 \"directShieldEnabled()(bool)\" --rpc-url https://arb1.arbitrum.io/rpc",
              "check": {
                "call": "0x33df2d6a",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Shielding a payment into the pool needs the operator. That role is held by a single EIP-7702-delegated EOA, and per the docs it acts only after Global Ledger screening, so it can refuse individual portals without notice. Direct shielding is disabled. AUTHORITY_ROLE (Safe 4-of-6, no timelock) can switch it on or off, replace verifiers and rewire or upgrade the vault and aggregator. Withdrawals and portal recovery have no pause. Scored 0: an EOA-held role that can target individual payees.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol#L518-L557",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol",
              "detail": "submitWithdrawalRequest is permissionless. It checks a known notes root and a Groth16 proof, then pays the destination encoded in the proof. commitPendingNotes (L274) is permissionless too.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xCurvy/contracts/contents/evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol?ref=e996fe719580f4d82ff34f06ee8a0916df65a613\" --jq .content | base64 -d | sed -n 518,557p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/src/v2/portal/PortalFactory.sol#L267-L286",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "evm/src/v2/portal/PortalFactory.sol",
              "detail": "Anyone can call deployRecoveryEntryPortal. Portal.recover then sends a portal's whole balance to any address, provided tx.origin is the portal's recovery address (Portal.sol L21-L24, L139).",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/42161/0x855de6C7A698ea870fc53DE755D612Ed977d3F0A",
              "address": "0xE51924cEF003a654EC9735c4d97f5D4862cBcbB1",
              "block_number": 513140605,
              "detail": "The aggregator proxy's EIP-1967 implementation slot points to 0x855d…3F0A. Its Sourcify source matches contracts@e996fe71 (develop) apart from a trailing newline; it does not match main.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x000000000000000000000000855de6c7a698ea870fc53de755d612ed977d3f0a"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer completes a payment with a plain transfer to the payee's portal address. Moving those funds into the shielded pool needs Curvy's operator (C1), because direct shielding is disabled. The payee can withdraw from the pool, or recover funds stuck at a portal, by calling the contracts directly. Withdrawing also needs notes-tree data and circuit keys that Curvy hosts (C3). Scored 1: settlement into the private pool depends on the provider, while recovery and withdrawal are direct.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/src/config/createCurvyConfig.ts#L32-L57",
              "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
              "path": "src/config/createCurvyConfig.ts",
              "detail": "The SDK takes apiBaseUrl, indexerBaseUrl, relayerBaseUrl and circuitKeysBaseUrl (configurable), and submissionMode defaults to \"relay\". At L112-L114 it loads the network registry and protocol parameters from the API before any action can run.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xCurvy/sdk/contents/src/config/createCurvyConfig.ts?ref=75ce11eda3ea9521f6ed81f0019787eee0a9080c\" --jq .content | base64 -d | sed -n 32,57p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/src/http/index.ts#L47-L50",
              "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
              "path": "src/http/index.ts",
              "detail": "The default API base is https://api.curvy.box. No repository in github.com/0xCurvy contains the API, the indexer, the relayer or the Portal Broadcaster.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Several closed services that only Curvy runs are required. Shielding needs the Portal Broadcaster operator. The SDK needs the API for the network registry and protocol parameters, auth and notes sync. Proofs need circuit keys from Curvy's host. The SDK lets an integrator point these URLs elsewhere and submit planner transactions from its own wallet. But no self-host code is published, and the operator role is onchain and cannot be replaced by config. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/for-the-curious/compliance-model.md#L16-L20",
              "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
              "path": "docs/for-the-curious/compliance-model.md",
              "detail": "The docs repo says Global Ledger scores each address, and the Curvy-operated Portal Broadcaster uses that score to decide whether a portal is deployed and its funds shielded.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xCurvy/docs/contents/docs/for-the-curious/compliance-model.md?ref=73d17acd6a35d0aa4ba4c15f3717fcef3895d5df\" --jq .content | base64 -d | sed -n 16,20p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol#L253-L267",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol",
              "detail": "The contracts hold no address list, but the only open entry, portalShield, requires an operator-deployed portal. directShield reverts while directShieldEnabled is false.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Edge screening (Global Ledger, run by the Curvy-operated broadcaster) is disclosed in a versioned docs repo, and the contracts contain no address or country list. The screening cannot be bypassed: entry to the pool is operator-gated onchain, and the direct entry is disabled. A screened-out payee can only recover funds publicly through the portal recovery path. The list source is named, but the scoring rules live in a closed backend. Judgment call: the settlement layer is not neutral, because entry depends on a screened operator, so we score 1 rather than 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
              "address": "0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
              "block_number": 513140605,
              "detail": "The vault registry lists 6 tokens. getTokenAddress(1..6) returns native ETH, USDC 0xaf88…5831, USD₮0 0xFd08…Cbb9, SOL 0x2bcC…0c07, WETH 0x82aF…Bab1 and WBTC 0x2f2a…5B0f. The vault held 14,013 USDC and 2.87 ETH at this block.",
              "checked_at": "2026-10-09",
              "recheck": "for i in 1 2 3 4 5 6; do cast call 0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00 \"getTokenAddress(uint256)(address)\" $i --rpc-url https://arb1.arbitrum.io/rpc; done",
              "check": {
                "call": "0x67ccdf380000000000000000000000000000000000000000000000000000000000000002",
                "expect": "0x000000000000000000000000af88d065e77c8cc2239327c5edb3a432268e5831"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Supported tokens are enumerated onchain in the vault registry, and the SDK reads them from the API. A search of the docs repo finds no statement that USDC or USD₮0 can freeze the vault address, and nothing on Arbitrum sequencer or forced-inclusion assumptions. Scored 2: enumerated in code, assumptions not stated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/42161/0xBf38e322f4009aeEF390669DfDD05a43c7eaeEb0",
              "address": "0xBf38e322f4009aeEF390669DfDD05a43c7eaeEb0",
              "block_number": 513140605,
              "detail": "Sourcify results on Arbitrum. Vault implementation 0xBf38…eEb0 and PortalFactory 0x4f32…1389 are exact_match. Aggregator implementation 0x855d…3F0A is a partial match. The two ERC1967 proxies and the three registered verifiers (0xEFf8…d044, 0xDB3b…b804, 0xFEed…7A73) have no Sourcify record.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0xBf38e322f4009aeEF390669DfDD05a43c7eaeEb0 0x855de6C7A698ea870fc53DE755D612Ed977d3F0A 0x4f32082C5647F8fE0f0Fb567b98F2a5516361389 0xEFf85079AfF7c3AEe250066eC4AD51ce163dD044; do curl -s https://sourcify.dev/server/v2/contract/42161/$a | jq -r .match; done"
            }
          ],
          "finding": "The vault, factory and aggregator logic is verified on Sourcify (two exact matches and one partial). The verifiers every proof goes through, and the proxies, are not on Sourcify. Arbiscan and Arbitrum Blockscout served a bot challenge, which we did not bypass, so explorer verification was not checked. The verified source matches the develop branch, not main, and deployed_addresses.json lists older implementations. Scored 1: some contracts verified.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/README.md#L1-L5",
              "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
              "path": "README.md",
              "detail": "The SDK is public (MIT) and marked closed beta. The contracts, rs-core prover and docs are public. The org has no repository for the API, the indexer, the relayer, the Portal Broadcaster or the web app.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Public: contracts, SDK, Rust prover, payments SDK and docs. Not public: the API, indexer, relayer and Portal Broadcaster, all required, and the app.curvy.box frontend. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/README.md#L1-L40",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "evm/README.md",
              "detail": "The evm README documents the Hardhat 3 and Ignition deploy and upgrade layout (ignition/, scripts/deploy-v2.ts) for the contracts only.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Contract deployment is documented. The backend services needed to operate the rail are not published. Reproduction not attempted. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/src/v2/aggregator-alpha/ICurvyAggregatorAlpha.sol#L55-L64",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "evm/src/v2/aggregator-alpha/ICurvyAggregatorAlpha.sol",
              "detail": "Event definitions (PendingNotes, CommittedNotes, CommittedNullifiers) are in the repo, and the README says ABIs are extracted into the SDK.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "ABIs and events are in the repo, and the SDK carries a typed client for the API. No API schema (OpenAPI or equivalent) is published, and there is no payee export. Judgment call: the required API has no schema in the repo, so we take the lower anchor, 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/LICENSE",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "LICENSE",
              "detail": "The contracts are Apache-2.0 at the repo root, with per-file SPDX headers (verifiers GPL-3.0, ICurvyVerifiers.sol BUSL-1.1). The SDK and rs-core are MIT.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The public repositories carry OSI licences. The exception is ICurvyVerifiers.sol, an interface file under BUSL-1.1. The API, the Portal Broadcaster and the circuit-key host are required and closed. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/README.md#L63-L80",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "README.md",
              "detail": "The README's licensing section lists the licence per file. The root tree (LICENSE, LICENSES, NOTICE, THIRD-PARTY-NOTICES.md, audit, evm, solana) has no CLA or CONTRIBUTING file.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xCurvy/contracts/git/trees/e996fe719580f4d82ff34f06ee8a0916df65a613\" --jq '.tree[].path'"
            }
          ],
          "finding": "No CLA and no licence-stability commitment. The licence files were added in commit 13d578d0 (2026-09-25); we did not check whether the code carried other terms before that. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/src/config/createCurvyConfig.ts#L112-L126",
              "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
              "path": "src/config/createCurvyConfig.ts",
              "detail": "SDK start-up needs GetNetworks and GetProtocol from the Curvy API, and shielding needs the onchain operator.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Deposits cannot be shielded without the closed Portal Broadcaster holding OPERATOR_ROLE, and the SDK cannot start without the closed API. The core cannot run on public components alone. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/package.json#L268-L287",
              "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
              "path": "package.json",
              "detail": "The SDK's runtime dependencies include no analytics, telemetry or error-reporting package. A grep of src/ for posthog, sentry, mixpanel, amplitude, gtag and datadog finds nothing.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://curvy.box/privacy-policy",
              "detail": "The privacy policy says the website and web application collect basic analytics data and use anonymous analytics tools.",
              "checked_at": "2026-10-09",
              "quote": "Anonymous analytics tools",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The public SDK ships no analytics. The web app is closed, and the policy discloses basic analytics on the site and app. Scored 1: present and disclosed in policy, and the app code cannot be inspected.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://curvy.box/privacy-policy",
              "detail": "The policy lists portal configuration metadata, compliance status flags, aggregator execution metadata and risk scoring by third-party analytics providers.",
              "checked_at": "2026-10-09",
              "quote": "Transactions routed through certain Curvy Portals may be screened using third-party blockchain analytics providers",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Beyond settlement data, the flow involves a Curvy ID handle registered through the API, an auth signature, compliance flags from Global Ledger, and portal metadata held by Curvy. The canonical app does no KYC. This is disclosed in policy only. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol#L218-L251",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol",
              "detail": "When shielding, PendingNotes emits the note id, token and net amount in plaintext (isPlaintext true). The note's ownerHash is passed in calldata. Withdrawals reveal amount, token and destination.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xCurvy/contracts/contents/evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol?ref=e996fe719580f4d82ff34f06ee8a0916df65a613\" --jq .content | base64 -d | sed -n 218,251p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/for-programmers/portals-and-recovery.md#L8-L28",
              "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
              "path": "docs/for-programmers/portals-and-recovery.md",
              "detail": "Each receipt goes to a fresh, deterministic per-recipient portal address that the backend derives. The portal record feed is public and anonymous.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Payers send to fresh portal addresses, so no stable payee address appears onchain. Transfers inside the pool emit encrypted note fields. Entry amounts are plaintext in PendingNotes. The ownerHash sits in shield calldata, and we did not verify from code whether it changes for each note. Exits reveal amount and destination. Amount and timing matching are behavioural and not scored. Judgment call: stealth-style receipt fits anchor 3, but the plaintext entry data and the unverified ownerHash freshness hold it at 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/for-the-curious/compliance-model.md#L16-L20",
              "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
              "path": "docs/for-the-curious/compliance-model.md",
              "detail": "Global Ledger scores each portal's address before shielding. LI.FI is a dependency of the SDK for bridging.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Curvy's API and broadcaster see every payment, and Global Ledger scores each depositing address. Both are named in a docs repo, but the screening vendor sits in the closed broadcaster and cannot be swapped. LI.FI joins bridged routes. Scored 1: third parties are disclosed in docs and not swappable.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/src/config/createCurvyConfig.ts#L32-L57",
              "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
              "path": "src/config/createCurvyConfig.ts",
              "detail": "The API, metadata, indexer (also per chain id), relayer and circuit-key URLs are all parameters of createCurvyConfig.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xCurvy/sdk/contents/src/config/createCurvyConfig.ts?ref=75ce11eda3ea9521f6ed81f0019787eee0a9080c\" --jq .content | base64 -d | sed -n 32,57p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Endpoints, including the indexer, can be configured in code. The indexer code is not public, so the 3 anchor's public-indexer condition fails. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/src/v2/vault/CurvyVaultV2.sol#L131-L240",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "evm/src/v2/vault/CurvyVaultV2.sol",
              "detail": "The vault is UUPS, and _authorizeUpgrade requires AUTHORITY_ROLE (L131). setCurvyAggregatorAddress (L237-L240) lets AUTHORITY name the contract allowed to call withdraw.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xCurvy/contracts/contents/evm/src/v2/vault/CurvyVaultV2.sol?ref=e996fe719580f4d82ff34f06ee8a0916df65a613\" --jq .content | base64 -d | sed -n 237,240p"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
              "address": "0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
              "block_number": 513140605,
              "detail": "The vault proxy's implementation slot is 0xBf38…eEb0, upgraded at block 0x1dadba35. hasRole(AUTHORITY_ROLE, Safe 0xB2c1…4b9F) is true.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x000000000000000000000000bf38e322f4009aeef390669dfdd05a43c7eaeeb0"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Funds in transit sit in an upgradeable vault. Its authority (Safe 4-of-6, no timelock) can upgrade it or rewire which aggregator may withdraw, either of which could redirect funds. Before shielding, funds wait at the payee's portal, recoverable only by the portal's recovery key. Upgradeability is visible in the public source and README. Judgment call: anchor 1 (upgradeable escrow, disclosed) rather than 0. The same power could redirect funds, but it is disclosed in code, not hidden.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xB2c10d9e523B6d7792F1825f4Bb2552860f64b9F",
              "address": "0xB2c10d9e523B6d7792F1825f4Bb2552860f64b9F",
              "block_number": 513140605,
              "detail": "Safe 1.4.1, getThreshold() 4 with 6 owners. getModulesPaginated returns none, and the guard slot is zero. It holds AUTHORITY_ROLE on the vault and aggregator and owns the PortalFactory. The Upgraded events at block 0x1dadba35 came straight from this Safe, with no timelock in between.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xB2c10d9e523B6d7792F1825f4Bb2552860f64b9F \"getThreshold()(uint256)\" --rpc-url https://arb1.arbitrum.io/rpc",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000004"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xB2c10d9e523B6d7792F1825f4Bb2552860f64b9F",
              "address": "0xB2c10d9e523B6d7792F1825f4Bb2552860f64b9F",
              "block_number": 513140605,
              "detail": "The Safe guard slot is zero.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A 4-of-6 Safe with no modules or guard can upgrade the vault and aggregator directly, with no timelock. We found no disclosure of the signers. Scored 1: multisig admin, no timelock.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/src/actions/aggregator/directShield.ts#L140-L157",
              "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
              "path": "src/actions/aggregator/directShield.ts",
              "detail": "The only approval call in the SDK sets the vault's allowance to exactly the deposit amount, after resetting any non-zero allowance first. The default receive flow is a plain transfer to a portal, with no approval.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xCurvy/sdk/contents/src/actions/aggregator/directShield.ts?ref=75ce11eda3ea9521f6ed81f0019787eee0a9080c\" --jq .content | base64 -d | sed -n 140,157p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Payers fund a portal by plain transfer. The optional direct-shield path, currently disabled onchain, approves exactly the amount. That fits anchor 3 in substance, but we have no package or trace evidence for the published build, and npm latest (0.0.7) lags the pinned source (0.0.8-rc.2). Judgment call: scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/for-programmers/portals-and-recovery.md#L55-L76",
              "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
              "path": "docs/for-programmers/portals-and-recovery.md",
              "detail": "The docs give the recovery path for funds stuck at a portal, an onchain call signed by the recipient's recovery key.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=1, C2=1, C3=0 and O3=1. Funds still at a portal can be recovered by a documented manual contract call. Funds already shielded need a proof built from notes-tree data and circuit keys that Curvy hosts, and they sit in a vault the Safe can upgrade. Settlement into the pool stops without the operator. Scored 1: retrievable only through a documented manual call, and for shielded funds only while the keys remain available.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/audit/Curvy%202026%20Audit%20Report%20Final.pdf",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "audit/Curvy 2026 Audit Report Final.pdf",
              "detail": "The Ethernal audit (23 March to 15 April 2026) pins commit 5f6e43cf, which exists in the repo. It covers CurvyAggregatorAlphaV6, CurvyVaultV6, PortalFactory, Portal and SolanaPortal, and lists fix commits.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "An audit pinned to 5f6e43cf exists, with findings marked fixed. The README says the audited contracts are the V1 stack. The deployed contracts are the greenfield V2 rewrite (develop @e996fe71), which the report does not cover. We found no bug bounty. Scored 1: an audit of a previous version.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "The deployed Arbitrum contracts have no country check, and the public SDK has no country or geolocation gate (a grep of src/ finds none). We found no first-party terms page that lists countries; curvy.box has a privacy policy but no terms. Address screening by Global Ledger can refuse individual portals; that filters addresses, not countries. Judgment call: the closed app.curvy.box and api.curvy.box could geoblock by IP, and we could not inspect them.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol#L518-L557",
            "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
            "path": "evm/src/v2/aggregator-alpha/CurvyAggregatorAlphaV2.sol",
            "detail": "Withdrawal checks only the root, the proof and the nullifiers. No contract has a caller-country or geolocation check.",
            "checked_at": "2026-10-09"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/src/http/index.ts#L47-L50",
            "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
            "path": "src/http/index.ts",
            "detail": "The SDK HTTP client sends requests to the configured API base. A grep of src/ for country, geolocation and jurisdiction finds no country gate.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: the Arbitrum aggregator, vault, portal factory and verifiers. Reads at Arbitrum block 513140605 (role history from eth_getLogs in 10M-block windows from block 488600000). The deployed implementations match the develop branch (e996fe71) and not main (0afe6c80); deployed_addresses.json in both branches lists earlier implementations, 0xE884…C193 and 0x8c0D…3cAF. Live use: getCurrentNoteIndex 3159 and 1369 nullifier batches. Portal-only chains, Solana and V1 are out of scope. The SDK is in closed beta. The audit PDF was read by stream extraction. No transactions, UI runs, traces or self-host attempts were made.",
      "audits": {
        "searched": "The audit/ folder of github.com/0xCurvy/contracts (main and develop), the contracts README security section, the Audit link on docs.curvy.box and the \"Independently audited\" badge on curvy.box (both point to the same PDF), and the 0xCurvy sdk, rs-core, payments-sdk and docs repos (no audits). solana/REPORT.md is a developer guide, not an audit. No audit of the V2 contracts, the circuits, rs-core, the SDK or the Curvy API was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Ethernal",
            "date": "2026-05",
            "type": "audit",
            "scope": "Curvy V1 contracts (CurvyAggregatorAlphaV6, CurvyVaultV6, PortalFactory, Portal, SolanaPortal)",
            "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/audit/Curvy%202026%20Audit%20Report%20Final.pdf",
            "commit": "5f6e43cf153c0402bab7d1c041978ac8cf7a384b",
            "repo": "https://github.com/0xCurvy/contracts",
            "covers_deployed": "no",
            "findings": "0 critical, 0 high, 6 medium, 10 low, 6 informational; all addressed and fixes verified",
            "note": "Engagement 23 March to 15 April 2026; the cover date reads 05/08/2026 (taken as May; fix commits are dated 28 April). The README says the audited code is the V1 stack; the Arbitrum deployment assessed is the V2 rewrite on develop (e996fe71), which the report does not cover."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C3"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F3"
          ]
        },
        "P": {
          "score": 1,
          "limiting": [
            "P1",
            "P2",
            "P4"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S5"
          ]
        }
      },
      "tally": {
        "holds": 5,
        "short": 17,
        "unk": 1,
        "total": 23
      }
    },
    {
      "slug": "daimo-pay",
      "name": "Daimo Pay",
      "type": "checkout",
      "website": "https://daimo.com",
      "primary_chain": {
        "name": "Base",
        "chain_id": 8453,
        "basis": "The SDK has no default chain (the merchant sets the destination chain per session), so the unit rests on other evidence. The docs' session example (docs.daimo.com/guides/payment-methods) uses chainId 8453 with Base USDC; packages/contract/broadcast/DeployDepositAddressManager.s.sol/8453/run-latest.json exists at the pinned commit; the sampled live session (tx 0x8d3d409f…bd00) settled on Base. Excluded: the 15 other chains with broadcasts, and the older DaimoPay/PayIntent contracts that @daimo/sdk 1.8.x does not use. Judgment call: settlement volume by chain was not compared."
      },
      "repos": [
        {
          "url": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk",
          "role": "sdk",
          "license": "BSD-2-Clause"
        },
        {
          "url": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract",
          "role": "contracts",
          "license": "GPL-3.0-or-later"
        },
        {
          "url": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/script",
          "role": "deploy",
          "license": "GPL-3.0-or-later"
        }
      ],
      "contracts": [
        {
          "address": "0xfca14E46d74d7673168e95b5f625bf2847B009b6",
          "chain_id": 8453,
          "role": "DepositAddressManager (escrow, relayer allowlist)",
          "verified": "explorer"
        },
        {
          "address": "0xE91788B67c2535D609b74F558c59786fC1C6a36A",
          "chain_id": 8453,
          "role": "DepositAddressFactory (CREATE2 deposit addresses)",
          "verified": "sourcify"
        },
        {
          "address": "0x23EE5dD38d902caBBA4F0229532f1EB1B0346673",
          "chain_id": 8453,
          "role": "DepositAddress implementation (per-session vault)",
          "verified": "sourcify"
        },
        {
          "address": "0xc9b29db51142b00E697385092b80efc57402a2b6",
          "chain_id": 8453,
          "role": "DaimoPayExecutor (swap and call executor)",
          "verified": "explorer"
        },
        {
          "address": "0xA8DCDF1f1D624d37949b54c34E9A85394c72936a",
          "chain_id": 8453,
          "role": "DaimoPayPricer (signed-price validator)",
          "verified": "sourcify"
        },
        {
          "address": "0x59dc13C4317CfFEEBD77cdd295C3d7981eAc1264",
          "chain_id": 8453,
          "role": "DepositAddressBridger (bridge adapter router)",
          "verified": "sourcify"
        },
        {
          "address": "0xc88fd3c032406F64C70a6c1aAc9831602362eE04",
          "chain_id": 8453,
          "role": "DaimoPayRelayer (operator wrapper, authorized relayer)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "DepositAddress contracts (manager, factory, vault, executor, pricer, bridger)",
          "role": "contracts",
          "public": true,
          "license": "GPL-3.0-or-later",
          "operator": "Daimo (owner EOA 0xd4cFb1c3…b131)",
          "required": true,
          "repo": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract"
        },
        {
          "name": "@daimo/sdk (React modal, client, React Native frame)",
          "role": "sdk",
          "public": true,
          "license": "BSD-2-Clause",
          "operator": "Daimo",
          "required": true,
          "repo": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk"
        },
        {
          "name": "Daimo API (api.daimo.com; sessions, DA params, payment options, webhooks)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Daimo",
          "required": true
        },
        {
          "name": "Daimo relayer service (calls start, sameChainFinish, claim on the manager)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Daimo (allowlisted EOA 0xA9C38348…4E2f and wrapper 0xc88fd3c0…eE04)",
          "required": true
        },
        {
          "name": "Daimo price signer (trustedSigner key for DaimoPayPricer)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Daimo (EOA 0xE1432f86…AA25)",
          "required": true
        },
        {
          "name": "Daimo indexer (deposit detection and balance lookup behind the API)",
          "role": "indexer",
          "public": false,
          "license": "proprietary",
          "operator": "Daimo",
          "required": true
        },
        {
          "name": "DaimoPayRelayer wrapper contract (source in repo, deployed bytecode unverified)",
          "role": "contracts",
          "public": true,
          "license": "GPL-3.0-or-later",
          "operator": "Daimo",
          "required": false,
          "repo": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/relayer"
        },
        {
          "name": "Hosted deposit flow (daimo.com, loaded by DaimoFrame / DaimoFrameRN)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Daimo",
          "required": false
        },
        {
          "name": "Privy embedded wallet and auth (account/fiat flows only)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Privy",
          "required": false
        },
        {
          "name": "Fiat onramps (Coinbase onramp, Stripe onramp; fiat flows only)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Coinbase, Stripe",
          "required": false
        },
        {
          "name": "KYC partner (Sumsub per docs; fiat ramps only)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub",
          "required": false
        },
        {
          "name": "Bridge/swap routes (CCTP, Across, Relay, Stargate, USDT0, Axelar, 0x)",
          "role": "other",
          "public": false,
          "license": "various",
          "operator": "Third parties",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L1124-L1127",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "setRelayer(address,bool) is onlyOwner and is the only admin function; no pause, freeze, or blacklist function exists in DepositAddressManager, DepositAddress, DepositAddressFactory, DaimoPayExecutor, or DaimoPayPricer at this commit.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L203-L207",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "onlyRelayer gates start, sameChainFinish, fastFinish, claim, hopStart and refundFulfillment (L258, L406, L483, L569, L697, L876), so de-authorizing relayers halts all forwarding to payees.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "address": "0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "owner() of DepositAddressManager is 0xd4cFb1c394DaCc70F0cB6D7b36806328e0ECb131, which has no code at block 52280426 (EOA, not a Safe; getThreshold() reverts).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000d4cfb1c394dacc70f0cb6d7b36806328e0ecb131"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "address": "0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "relayerAuthorized(0xA9C38348C35Baf44aA269D52cDfafc3aFe274E2f) returns true; that relayer is an EOA (no code) and is also DEFAULT_ADMIN_ROLE on the DaimoPayRelayer wrapper 0xc88fd3c032406F64C70a6c1aAc9831602362eE04.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x1e473a74000000000000000000000000a9c38348c35baf44aa269d52cdfafc3afe274e2f",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xd4cFb1c394DaCc70F0cB6D7b36806328e0ECb131",
              "address": "0xd4cFb1c394DaCc70F0cB6D7b36806328e0ECb131",
              "chain_id": 8453,
              "block_number": 52280426,
              "eoa": true,
              "detail": "The manager owner 0xd4cFb1c394DaCc70F0cB6D7b36806328e0ECb131 has empty code (no EIP-7702 delegation) and nonce 173 at block 52280426, so it is an EOA; there is no Safe whose modules or guard could be read.",
              "checked_at": "2026-10-07",
              "recheck": "cast code 0xd4cFb1c394DaCc70F0cB6D7b36806328e0ECb131 --rpc-url https://mainnet.base.org --block 52280426 (returns 0x) && cast nonce 0xd4cFb1c394DaCc70F0cB6D7b36806328e0ECb131 --rpc-url https://mainnet.base.org --block 52280426 (returns 173)"
            }
          ],
          "finding": "There is no pause, freeze, or blacklist function in the settlement contracts. The contracts do hold a control the C1 anchors name explicitly: a relayer allowlist that a single EOA owner sets through setRelayer, with no timelock. Only allowlisted relayers can forward a deposit to the payee. The owner can stop all settlement by removing every relayer. Any relayer can decline a single deposit address, or refund it early to its refundAddress, without notice. Funds in an unforwarded deposit address can still be refunded by anyone once expiresAt passes. Under the updated anchor the cell is 0 on two counts: the role is EOA-held (the owner has no code, so there is no Safe, module, guard, or signer set to read), and relayers can act on individual deposit addresses with no notice.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L400-L460",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "sameChainFinish (and start for cross-chain) is onlyRelayer and requires PriceData signed by the pricer's trustedSigner (L413-L418); a payer or payee cannot call it.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L829-L860",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "refundDepositAddress is callable by anyone after params.expiresAt and sends the deposit address balance only to params.refundAddress; this is the sole permissionless entrypoint.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xA8DCDF1f1D624d37949b54c34E9A85394c72936a",
              "address": "0xA8DCDF1f1D624d37949b54c34E9A85394c72936a",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "DaimoPayPricer trustedSigner() is 0xE1432f86d711925d788bba98CfC006516188AA25 (no code, nonce 0, offchain signing key) with maxPriceAge() 300 seconds.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xf74d5480",
                "expect": "0x000000000000000000000000e1432f86d711925d788bba98cfc006516188aa25"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer pays with a plain ERC-20 transfer to a deposit address, which needs no provider. Delivery from that address to the payee does need the provider. Every forwarding entrypoint is relayer-only and also needs a price signed by Daimo's key within the last 300 seconds. Neither party can finish settlement by calling the contracts directly. The direct path that does exist is a refund to the payer's refundAddress once the deposit address expires. Settlement to the payee has no direct path.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/web/hooks/DaimoClientContext.tsx#L6-L16",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/web/hooks/DaimoClientContext.tsx",
              "detail": "DaimoSDKProvider defaults to https://api.daimo.com (apiUrl prop overrides it); every session, deposit-address, and payment-method call goes to this API.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DaimoPayPricer.sol#L12-L58",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DaimoPayPricer.sol",
              "detail": "validatePrice accepts only EIP-191 signatures from the immutable trustedSigner; there is no fallback oracle.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "address": "0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "relayerAuthorized(0xc88fd3c032406F64C70a6c1aAc9831602362eE04) returns true; this DaimoPayRelayer wrapper's bytecode is unverified on Basescan and Sourcify.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x1e473a74000000000000000000000000c88fd3c032406f64c70a6c1aac9831602362ee04",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Each payment depends on three services that only Daimo runs: the Daimo API, which creates sessions and deposit-address parameters; the relayer, which is allowlisted by the owner EOA; and the price signer. No repository in the daimo-eth org contains code for the API, the relayer service, or the price signer. Self-hosting would not help even if that code were published, because a third-party relayer must first be added to the allowlist by Daimo. The SDK lets an integrator change the API URL, but no alternative backend exists to point it at.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/web/api/index.ts#L69-L75",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/web/api/index.ts",
              "detail": "The SDK renders a \"server-effective location\" and a nav tree built by the API; a search of packages/sdk/src for sanction, OFAC, blocklist, geoblock, chainalysis, and TRM returns nothing.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/guides/payment-methods",
              "detail": "Docs state payment methods are localized per user country server-side, and that deposit addresses and self-custody wallets are available everywhere.",
              "checked_at": "2026-10-07",
              "quote": "Daimo localizes the deposit experience to the user",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L203-L207",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "The settlement contracts contain no list or country check, but every forwarding entrypoint is onlyRelayer, so which deposits settle is decided by Daimo's closed relayer service; neutrality of the settlement path cannot be shown from code.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/terms-of-use",
              "detail": "Terms of use (last updated 2025-04-01; linked from the SDK account flow at packages/sdk/src/web/components/account/AccountOtpPage.tsx L61) reserve the right to deny access to anyone for any reason, including by blocking IP addresses; no list source is named.",
              "checked_at": "2026-10-07",
              "quote": "deny access to and use of the services (including blocking certain ip addresses), to any person for any reason or for no reason",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Re-assessed under the updated anchor (neutral settlement plus disclosed, bypassable edge filtering). The SDK contains no address or geographic filtering. The closed API decides which payment methods a user sees by country, and the docs disclose this. The terms reserve a blanket right to deny access, including by IP, without naming any list. The settlement contracts hold no list, but only Daimo's allowlisted relayers can forward a deposit, so whether settlement is neutral cannot be shown from code, and there is no direct path to bypass edge filtering (C2 = 0). Both of those facts match anchor 1. Judgment call: we score 1 and not 0 because the only filtering we can see is disclosed in docs and terms, and we have no evidence of undisclosed screening; we could not rule it out either, because the API and relayer are closed. A trace or provider statement showing screening not covered by those documents would lower this to 0. A 3 is not reachable while required components are closed and no trace exists.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/common/token.ts#L945-L966",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/common/token.ts",
              "detail": "knownTokens enumerates per-chain token lists (USDC, USDT, USDT0, DAI, EURC and others) for 16 chains; supportedChains is at packages/sdk/src/common/chain.ts L145-L162.",
              "checked_at": "2026-10-07",
              "recheck": "gh api 'repos/daimo-eth/sdk/contents/packages/sdk/src/common/token.ts?ref=ac0a71453ac249aa991d71059c621e2424322d61' -H 'Accept: application/vnd.github.raw' | sed -n '945,966p'   # 16 chain entries in knownTokensByChain",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/script/Constants.s.sol#L48-L70",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/script/Constants.s.sol",
              "detail": "Deploy constants pin USDC, DAI, and USDT addresses per chain, including Base USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/supported-chains",
              "detail": "Supported-chains page lists destination chains and USDC addresses but says nothing about issuer freeze powers or sequencer assumptions.",
              "checked_at": "2026-10-07",
              "quote": "deposits can be delivered to any of these chains",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens and chains are listed in code and in the docs. Neither the repo nor docs.daimo.com tells payees that USDC, USDT, and EURC issuers can freeze balances. Neither tells them that Base and the other L2 destinations depend on a centralized sequencer. A search of SDK, docs, and README for freeze, blacklist, and sequencer found nothing.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "address": "0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "Sourcify returns match \"match\" (partial, runtime only, metadata hash differs) for DepositAddressManager; Basescan shows Source Code Verified (Exact Match).",
              "checked_at": "2026-10-07",
              "recheck": "for a in 0xfca14E46d74d7673168e95b5f625bf2847B009b6 0xE91788B67c2535D609b74F558c59786fC1C6a36A 0x23EE5dD38d902caBBA4F0229532f1EB1B0346673 0xA8DCDF1f1D624d37949b54c34E9A85394c72936a 0x59dc13C4317CfFEEBD77cdd295C3d7981eAc1264 0xc9b29db51142b00E697385092b80efc57402a2b6; do curl -s https://sourcify.dev/server/v2/contract/8453/$a | jq -r .match; done   # expect match, exact_match x4, null (executor not on Sourcify)"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xc9b29db51142b00E697385092b80efc57402a2b6#code",
              "address": "0xc9b29db51142b00E697385092b80efc57402a2b6",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "Basescan shows DaimoPayExecutor Source Code Verified (Exact Match); https://sourcify.dev/server/v2/contract/8453/0xc9b29db51142b00E697385092b80efc57402a2b6 returns 404 (not on Sourcify).",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xE91788B67c2535D609b74F558c59786fC1C6a36A",
              "address": "0xE91788B67c2535D609b74F558c59786fC1C6a36A",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "Sourcify exact_match for DepositAddressFactory; also exact_match for DepositAddress impl 0x23EE5dD38d902caBBA4F0229532f1EB1B0346673, DaimoPayPricer 0xA8DCDF1f1D624d37949b54c34E9A85394c72936a, and DepositAddressBridger 0x59dc13C4317CfFEEBD77cdd295C3d7981eAc1264.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/foundry.toml#L1-L12",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/foundry.toml",
              "detail": "Foundry config pins solc 0.8.26, via_ir, optimizer_runs 999999, evm london; the Makefile build target is forge install && forge build.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "All six settlement contracts have source verified on Basescan or Sourcify. Four are exact matches on Sourcify. DepositAddressManager is only a partial match on Sourcify, and DaimoPayExecutor is verified on the explorer only, so the cell cannot reach 3. A pinned Foundry build config exists, but we did not try to reproduce the deployed bytecode from it. The DaimoPayRelayer wrapper at 0xc88f…eE04 is an authorized relayer and is not verified anywhere. Judgment call: we class it as operator tooling rather than a settlement contract, which keeps the score at 2. If it counted as a settlement contract, the score would be 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/packages",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages",
              "detail": "The only live, non-archived product repo is daimo-eth/sdk, containing packages/sdk (client and React modal) and packages/contract (Solidity plus deploy scripts and broadcasts); gh repo list daimo-eth shows no backend, relayer, indexer, or hosted-flow repo.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/openapi.json",
              "detail": "An OpenAPI 3.1.0 spec (10 paths) for the merchant API is published on the hosted docs site, not in the repo.",
              "checked_at": "2026-10-07",
              "quote": "create deposit sessions, manage payment methods, and check session status",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The contracts, the deploy scripts, the SDK, and its embeddable React modal are public. The Daimo API, the relayer, the price signer, the indexer, and the hosted deposit flow that DaimoFrame loads from daimo.com are all private. The SDK cannot run without those private services. Judgment call: we score 1 and not 2, because the frontend and indexer are closed as well as the backend. We score 1 and not 0, because the public contracts and deploy scripts are more than a client shell.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/README.md#L19-L51",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/README.md",
              "detail": "The contracts README covers only installing Foundry, make full, make test, and make coverage; the SDK README covers pnpm add @daimo/sdk; neither documents running a relayer, price signer, or API.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Re-assessed under the updated anchor; the score is unchanged. No README can get a stranger to a working deployment, because the relayer, the price signer, the indexer, and the API are closed required components (see `components` and O2). The relayer slot is also owner-gated (see C1). The repo has no deploy script that completes a test payment. We did not attempt a reproduction. Anchor 1 (\"docs exist; reproduction not attempted\") would apply if the docs described a path; judgment call: we score 0 (\"No path\"), because the documented steps only build and test contracts and stop short of anything that settles a payment.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L121-L197",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "Event schemas (Start, FastFinish, Claim, SameChainFinish, FinalCallExecuted, HopStart, RefundDepositAddress, RefundFulfillment) are defined in source; no generated ABI JSON is committed and the Makefile codegen target references a root npm script that does not exist.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/common/api.ts#L28-L105",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/common/api.ts",
              "detail": "Zod schemas cover the client-side session endpoints only (payment method, check, token options, nav logging); merchant endpoints such as create session and webhooks are absent.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/openapi.json",
              "detail": "The full merchant API schema exists only as a hosted OpenAPI file, not versioned with the code; no payee data export format is documented in repo or docs.",
              "checked_at": "2026-10-07",
              "quote": "create deposit sessions, manage payment methods, and check session status",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ABIs can be derived from the verified source, and the event schemas are in the repo. The repo's API schema covers only the endpoints the browser uses. The full merchant API is described only in a hosted OpenAPI file, which is the documented common failure. No payee data export exists in any format. Judgment call: we score 1 and not 2, because the API schema is not in the repo.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/license.txt#L1-L25",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "license.txt",
              "detail": "Root license.txt is BSD 2-Clause (Copyright 2026 Daimo, Inc.); packages/sdk/package.json L6 declares BSD-2-Clause.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L1-L2",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "All 32 Solidity files under packages/contract/src carry SPDX-License-Identifier GPL-3.0-or-later.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every public repo needed for the product carries an OSI-approved license: the SDK is BSD-2-Clause and the contracts are GPL-3.0-or-later. The product also needs four closed components that carry no license a third party can use: the Daimo API, the relayer service, the price signer, and the indexer (see `components`). Under the updated rule a closed required component counts as unlicensed, because it cannot be forked, so F1 is 0. The public repos alone would score 3. Two housekeeping issues remain: the root LICENSE file is a symlink to packages/connectkit/LICENSE, a path that does not exist at any commit, and the root BSD text does not mention the GPL headers on the contracts, so GitHub reports the license as NOASSERTION. Neither restricts forking the public code.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/.github",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": ".github",
              "detail": "The repo has no CONTRIBUTING, CLA, or SECURITY file at any path outside vendored lib/ (only .github/PULL_REQUEST_TEMPLATE/release.md and assets).",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/license.txt",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "license.txt",
              "detail": "git log -- license.txt shows two commits, f4ff7c83 (2025-05-27, added BSD-2) and 4a32d7b4 (2026-02-28, copyright line only); no relicense event.",
              "checked_at": "2026-10-07",
              "recheck": "gh api 'repos/daimo-eth/sdk/commits?path=license.txt&sha=ac0a71453ac249aa991d71059c621e2424322d61' --jq '.[] | .sha[0:8] + \" \" + .commit.author.date'   # expect 4a32d7b4 2026-02-28, f4ff7c83 2025-05-27; and gh api 'repos/daimo-eth/sdk/git/trees/ac0a71453ac249aa991d71059c621e2424322d61?recursive=1' --jq '[.tree[].path | select(test(\"(?i)(contributing|cla|security)\") and (test(\"/lib/\")|not))]' returns []",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The repo has no CLA and we found no CLA bot. The license has never changed in substance. The repo makes no written commitment to keep the license stable.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L248-L272",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "start requires an authorized relayer and two prices signed by the pricer's trustedSigner; no code path settles without both.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/README.md#L24-L33",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/README.md",
              "detail": "The README requires a server-side Daimo API key to create sessions; the SDK has no mode that works without the hosted API.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A production deployment cannot run without services only Daimo runs: the API (an API key is required), the allowlisted relayer, and the price-signing key. The open SDK and contracts do not work without them.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/web/hooks/navEvent.ts#L63-L77",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/web/hooks/navEvent.ts",
              "detail": "createNavLogger fires-and-forgets UI events (nav_open/close/select, flow_amount_continue with amountUsd, copy_address with the address, qr_toggle, error_shown, coinbase_widget_error) to POST /v1/sessions/{id}/internal/nav (createDaimoClient.ts L493-L498); no opt-out flag exists.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/package.json#L40-L52",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/package.json",
              "detail": "Runtime dependencies include no Sentry, PostHog, Segment, Mixpanel, Amplitude, Datadog, or fingerprinting package; @privy-io/react-auth is a dependency. The committed package-lock.json is stale (1.0.0-rc.1, no Privy), so transitive deps are not locked.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/privacy",
              "detail": "Privacy notice (last updated 2026-02-28) says usage information, IP, device characteristics, and \"how and when you use our Services\" are collected for internal analytics.",
              "checked_at": "2026-10-07",
              "quote": "for our internal analytics and reporting purposes",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK has no third-party analytics package, but it does ship first-party UI telemetry. That telemetry is on by default and sends navigation steps, amounts, copied addresses, and errors to Daimo's API. The privacy notice discloses analytics in general terms, which fits anchor 1. We did not review Privy's transitive dependencies or the hosted daimo.com flow, because the lockfile is stale and no trace was run. Without a trace this cell cannot reach 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/common/api.ts#L28-L63",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/common/api.ts",
              "detail": "The crypto payment-method request carries only method type, amountUsd, and (for Solana) wallet address and token mint; fiat is a separate payment-method type.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/web/components/account/formSchemas.ts#L3-L52",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/web/components/account/formSchemas.ts",
              "detail": "Fiat/account flows collect legal first and last name, email, date of birth, and SSN last 4 (Apple Pay verification), plus phone OTP via Privy.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/privacy",
              "detail": "Policy says crypto-to-crypto needs no personal information but IP, OS, device, country, and usage data are collected automatically; fiat ramps require KYC via a third-party partner, which the policy says is required by applicable law.",
              "checked_at": "2026-10-07",
              "quote": "we may store limited technical information related to api usage",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Re-assessed under the updated anchor; the score is unchanged. In code, the crypto deposit flow asks only for what settlement needs. The privacy notice says IP, device, and location data are collected on every flow. That is collection beyond settlement needs, it is not legally required, and it is disclosed only in the policy, which is anchor 1. KYC applies only to fiat flows, which the code keeps separate. The policy says that KYC is required by applicable law, but it names no specific requirement, and neither the basis nor the limit appears in code or a versioned repo document, so the KYC fields alone could not reach 2 either. Following the common-failures note, we do not treat that KYC as undisclosed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L121-L197",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "Every Start/Claim/SameChainFinish/Refund event emits the full DAParams, including toAddress (payee), refundAddress (normally the payer), and finalCallData.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/tx/0x8d3d409f5ca6bef78bf3b88f48bc92cf085cc192ee04399b2b7323edf417bd00",
              "address": "0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "chain_id": 8453,
              "block_number": 52280330,
              "detail": "SameChainFinish for deposit address 0x392d3A24FAE804e7fbe5BED599A723348070b846 emits toAddress 0xba343479d98a1ed333899999d95a7343b808a76f, refundAddress 0x8944E0Ef7197675C86Bee1233B4C15ae8f798465, and finalCallData containing the ASCII strings \"megapot:web\" and \"bc_a360xqro\".",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/privacy",
              "detail": "The policy states that crypto transactions are processed on public blockchains using smart contracts.",
              "checked_at": "2026-10-07",
              "quote": "transactions are processed on public blockchains using smart contracts",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Each session gets a fresh CREATE2 deposit address. That freshness does not protect privacy, because the manager's events publish the payee, the refund address (usually the payer), and any integrator calldata together in one log. Anyone can join payer to payee from a single event. The sample transaction also shows integrator tags in plaintext onchain. Judgment call: we score 1 and not 0, because the event definitions are in public verified source and the policy says payments are onchain. No user-facing document describes this linkage.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/web/components/account/AccountFlowProvider.tsx#L57-L58",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/web/components/account/AccountFlowProvider.tsx",
              "detail": "Account flows mount PrivyProvider with a privyAppId supplied by the API response (web/api/index.ts L37-L40), not by integrator config; Coinbase onramp iframe (useCoinbaseWalletPayWidget.ts) and Stripe onramp popup (StripeOnrampPage.tsx) are also wired in.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/web/hooks/useWalletFlow.ts#L648-L668",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/web/hooks/useWalletFlow.ts",
              "detail": "The EVM wallet path talks only to the user's injected EIP-1193 provider; balances and token options come from the Daimo API (tokenOptions with evmAddress), not a client-side RPC.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/privacy",
              "detail": "Policy says technical API-usage data may be shared with unnamed third parties \"such as for log aggregation\" and fiat identity data with a third-party KYC partner and ramp provider.",
              "checked_at": "2026-10-07",
              "quote": "with specific third parties in specific situations, such as for log aggregation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "In the crypto wallet flow, the client talks only to Daimo's API and the user's wallet. The API receives the payer's address in order to list balances. The fiat and account flows name Privy, Coinbase, and Stripe in code, and Sumsub in the docs. An integrator cannot replace any of them through config. The backend's own vendors, such as indexers, price sources, and log aggregation, are not visible to us, and the policy names them only by category. No trace was run. Judgment call: we score 1 and not 0, because the third parties that are visible are named and disclosed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/web/hooks/DaimoClientContext.tsx#L6-L16",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/web/hooks/DaimoClientContext.tsx",
              "detail": "apiUrl prop overrides the default https://api.daimo.com; DaimoFrame/DaimoFrameRN accept a baseUrl overriding https://daimo.com; the SDK uses the wallet's own RPC and ships no RPC URL of its own.",
              "checked_at": "2026-10-07",
              "recheck": "gh api 'repos/daimo-eth/sdk/contents/packages/sdk/src/web/hooks/DaimoClientContext.tsx?ref=ac0a71453ac249aa991d71059c621e2424322d61' -H 'Accept: application/vnd.github.raw' | sed -n '6,16p'   # apiUrl ?? \"https://api.daimo.com\"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "An integrator can change the API and hosted-flow endpoints in code, so traffic can go through the integrator's own proxy. The UI offers no endpoint setting. The indexer and API code are not public, so the integrator can reroute data but cannot keep it inside their own perimeter.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddress.sol#L79-L134",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddress.sol",
              "detail": "Each deposit address holds funds and releases them only via sendBalance called by params.escrow (the manager), with no upgrade function.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DaimoPayExecutor.sol#L36-L113",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DaimoPayExecutor.sol",
              "detail": "The executor runs arbitrary relayer-supplied calls on the payer's funds and only checks that the payee receives at least minOutputAmount; any surplus goes to the relayer (execute L73-L77).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/SwapMath.sol#L31-L80",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/SwapMath.sol",
              "detail": "minOutputAmount is computed solely from the two Daimo-signed USD prices and params slippage bps (sample session used 100/10/500 bps).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xA8DCDF1f1D624d37949b54c34E9A85394c72936a",
              "address": "0xA8DCDF1f1D624d37949b54c34E9A85394c72936a",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "maxPriceAge() is 300 seconds; the price signer and relayers are Daimo-held EOAs (see C2, C1).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x1584410a",
                "expect": "0x000000000000000000000000000000000000000000000000000000000000012c"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A deposit sits in a per-session contract that cannot be upgraded. It can only be released to the fixed payee, or refunded to the fixed refund address. Even so, the provider can take funds in flight. The payee's minimum is computed from prices that Daimo's own key signs. The relayer runs arbitrary calls on the funds and keeps any surplus. A relayer working with the signer can push the minimum close to zero and take the difference, and an honest relayer can still keep up to the slippage bound. Funds bridged cross-chain sit in fulfillment contracts that only relayers can release (see S4).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "address": "0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "EIP-1967 implementation slot of DepositAddressManager reads zero at block 52280426 (not a proxy; deployed directly via CREATE3 per DeployDepositAddressManager.s.sol L38-L51).",
              "checked_at": "2026-10-07",
              "recheck": "cast storage 0xfca14E46d74d7673168e95b5f625bf2847B009b6 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://mainnet.base.org --block 52280426 (zero) && cast storage 0x392d3A24FAE804e7fbe5BED599A723348070b846 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://mainnet.base.org --block 52280426 (0x23ee5dd3…6673) && cast storage 0x392d3A24FAE804e7fbe5BED599A723348070b846 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103 --rpc-url https://mainnet.base.org --block 52280426 (zero)",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x392d3A24FAE804e7fbe5BED599A723348070b846",
              "address": "0x392d3A24FAE804e7fbe5BED599A723348070b846",
              "chain_id": 8453,
              "block_number": 52280426,
              "detail": "Sample deposit address is an ERC1967Proxy whose implementation slot holds 0x23EE5dD38d902caBBA4F0229532f1EB1B0346673 and whose admin slot is zero; the implementation has no upgradeTo or UUPS function.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x00000000000000000000000023ee5dd38d902cabba4f0229532f1eb1b0346673"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressFactory.sol#L15-L53",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressFactory.sol",
              "detail": "The factory's depositAddressImpl is immutable; the executor's escrow and the pricer's signer and maxPriceAge are immutable; DepositAddressBridger has no owner (owner() reverts).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Re-assessed under the updated anchor; the score is unchanged because the first branch of anchor 3 (non-upgradeable) applies, so the Safe, module, guard, and timelock conditions do not arise. None of the settlement contracts can be upgraded. Each deposit address uses an ERC-1967 proxy, but its implementation exposes no upgrade function and the admin slot is empty. Daimo can deploy new manager versions and have the API point new sessions at them. A deposit address that already exists stays bound to its original escrow, so this does not change open sessions. The bridge protocols used for cross-chain routes, such as CCTP and Stargate, have their own admin keys, which are outside this cell.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/web/hooks/useWalletFlow.ts#L648-L668",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/src/web/hooks/useWalletFlow.ts",
              "detail": "The EVM payment is a single ERC-20 transfer(depositAddress, amount) or native value send via eth_sendTransaction; a search of packages/sdk/src finds no approve, permit, or maxUint call.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddress.sol#L158-L180",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddress.sol",
              "detail": "The contract also supports pullFromPermit with an EIP-2612 permit whose spender is the deposit address itself and which carries a deadline; the SDK does not use it.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@daimo/sdk/1.8.8",
              "detail": "The latest published @daimo/sdk (1.8.8; the pinned commit is 1.8.9-dev) was read from its registry tarball. dist/web/hooks/useWalletFlow.js L520-L525 encodes only ERC-20 transfer(destAddr, tokenAmount) (L511-L518 is the native send); a grep of every non-test .js file in dist for approve, permit, and maxUint256 finds no approval call.",
              "checked_at": "2026-10-07",
              "quote": "sha512-KSB6kGwPZjxfhj7jjEvUBwLR8UpeyB7jBDiemx562YvfTxdXECmQzGgdLdFi7ZX0lNCy7fy6t1hm+IT0g5Rmsw==",
              "package": {
                "name": "@daimo/sdk",
                "version": "1.8.8",
                "integrity": "sha512-KSB6kGwPZjxfhj7jjEvUBwLR8UpeyB7jBDiemx562YvfTxdXECmQzGgdLdFi7ZX0lNCy7fy6t1hm+IT0g5Rmsw=="
              },
              "recheck": "npm view @daimo/sdk@1.8.8 dist.integrity && curl -sL https://registry.npmjs.org/@daimo/sdk/-/sdk-1.8.8.tgz | tar xzO package/dist/web/hooks/useWalletFlow.js | grep -n 'functionName'   # only line 522 \"transfer\"; then grep -rniE 'approve|permit|maxuint' over the extracted package/dist/*.js finds no approval call outside tests",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/guides/payment-methods",
              "detail": "Fiat rails, the only flows that use the Privy account wallet, are off unless the merchant's org enables them.",
              "checked_at": "2026-10-07",
              "quote": "fiat rails appear only when enabled for your org",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Re-assessed under the updated anchor; the score is unchanged and now rests on the distributed package as well as the source. In the default crypto flow the SDK asks for no token allowance: the payer sends the exact amount straight to the session's deposit address, both at the pinned commit and in the published @daimo/sdk 1.8.8 bundle. The only other route in the contracts, pullFromPermit, uses EIP-2612 with a deadline and the deposit address as spender. Limit: the optional fiat/account flow (off unless the merchant enables fiat) has the Daimo-provisioned Privy wallet sign server-supplied EIP-712 \"routing authorization\" data or send a server-supplied sponsored transaction (packages/sdk/src/common/account.ts L857-L876, web/hooks/useDraftDeposit.ts L231-L256); the scope of those authorizations is set by the closed API and cannot be read from client code. Judgment call: a default flow with no approval at all is stricter than the anchor-3 bar of exact-amount approvals, so we score it 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L870-L925",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "refundFulfillment and claim (L561-L569) are onlyRelayer; DAFulfillment.pull (L1169-L1179) is callable only by the manager, so bridged funds have no permissionless exit.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src/DepositAddressManager.sol#L829-L860",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src/DepositAddressManager.sol",
              "detail": "refundDepositAddress lets anyone return an expired deposit address's balance to its refundAddress, but only if the caller knows the full DAParams (held by the Daimo API, or recoverable from a prior event).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Re-assessed under the updated anchor; the score is unchanged, because anchor 2 needs a verified withdrawal path that works without the provider and none exists for funds in flight. Derived from S1=0, C2=0, C3=0, and O3=0. If Daimo disappeared, payees would keep funds already delivered, but no new payment could settle (C2, C3). A payer whose deposit has not been forwarded can get it back after expiry through refundDepositAddress. That call needs the full DAParams, which the API holds and which are not emitted onchain until Daimo acts on the session. Funds already bridged to a destination-chain fulfillment contract can only be claimed or refunded by an allowlisted relayer, so they depend on Daimo staying live.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/README.md#L24-L33",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/sdk/README.md",
              "detail": "README instructs integrators to keep the Daimo API key on their backend; the browser receives only a session-scoped clientSecret (common/session.ts L233-L234), a session-scoped Stripe onramp client secret (common/api.ts L172-L176), and a publishable privyAppId.",
              "checked_at": "2026-10-07",
              "recheck": "gh api 'repos/daimo-eth/sdk/contents/packages/sdk/README.md?ref=ac0a71453ac249aa991d71059c621e2424322d61' -H 'Accept: application/vnd.github.raw' | sed -n '24,33p'   # \"never expose that key in browser code\"",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/guides/webhooks",
              "detail": "Webhooks are signed with a Daimo-Signature header (HMAC-SHA256 over t.rawBody) and the docs give a timingSafeEqual verification snippet; no verification helper exists in the repo and secret rotation is not described.",
              "checked_at": "2026-10-07",
              "quote": "every webhook delivery includes a daimo-signature header for verifying authenticity",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The client bundle contains no long-lived secrets. Webhooks are HMAC-signed, but the only verification reference code is on the hosted docs, not in the repo. Neither the repo nor the docs describe API-key scoping or rotation. Judgment call: we score 2 and not 3, because the reference verification is not in the repo and rotation is not shown.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/audit/NM-0585-Daimo-final-report.pdf",
              "detail": "Nethermind NM-0585 (final 2025-07-31) covers UniversalAddressBridger/Factory/Manager, SharedConfig, UniversalAddress, and TokenUtils at commits ef97c77f to 80312d47; 2 Low and 1 Best Practices findings, all marked fixed with commit hashes.",
              "checked_at": "2026-10-07",
              "quote": "Initial Commit ef97c77fe68f8ff12a98087f2f74e2cd12fc39c1",
              "archive": "data/archive/daimo-pay-nm0585-audit.txt"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/src",
              "detail": "None of the audited files exist at this commit; UA code was deleted in 99c3f248 (2026-01-08) and the deployed DepositAddress* contracts were added in c990a190 (2025-12-17). The audited and fix commits (80312d47, b40d727e, 4bf78a65) return 422 from the GitHub API for daimo-eth/sdk.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The only audit in the repo covers the earlier Universal Address contracts. Those files were deleted in January 2026, and the audited commits are not in the public repo. We found no audit of the deployed DepositAddressManager, DepositAddress, or DaimoPayExecutor. We found no bug bounty in the repo, the docs, or daimo.com/.well-known/security.txt (404); the NatSpec lists a security@daimo.com contact. Judgment call: we score 0 and not 1, because an audit of a previous version does not cover the deployed contracts, which is the listed common failure.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "The docs say crypto deposits (self-custody wallets and deposit addresses) are offered everywhere; the deposit-address contracts and the SDK contain no country or sanctions check. Fiat rails are a regional variant, enabled per organization: Apple Pay, ACH and Google Pay (US), Interac (CA), SEPA (Europe), JPYC (JP, SG, KR, PH), ARS (AR) and Bre-B (CO). The terms of use name no countries, only that the Services are not intended for use where it would be contrary to law. Judgment call: the hosted API that builds the payment-method list is closed, so a server-side country gate cannot be ruled out from code; global rests on the docs statement plus the contracts.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.daimo.com/guides/payment-methods",
            "detail": "Payment Methods guide lists localized methods by country and states that self-custody wallets and deposit addresses are offered in every country.",
            "checked_at": "2026-10-09",
            "quote": "plus self-custody wallets and deposit addresses everywhere",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.daimo.com/guides/fiat",
            "detail": "Fiat guide's supported-rails table gives each fiat rail's region (US, Canada, Europe (SEPA), Japan/Singapore/South Korea/Philippines, Argentina, Colombia); users in other countries see crypto, exchange and wallet methods.",
            "checked_at": "2026-10-09",
            "quote": "Users in a country with no enabled fiat rail see crypto, exchange, and wallet",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/daimo-eth/sdk/tree/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/src",
            "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
            "path": "packages/contract/src",
            "detail": "The deposit-address contracts contain no country or sanctions check; GitHub code search of packages/contract/src for sanction, country, OFAC, blacklist and blocked returns no results, and the 2026-10-07 read at this commit found no pause, blacklist or freeze logic.",
            "recheck": "gh api -X GET search/code -f q='sanction repo:daimo-eth/sdk path:packages/contract/src' --jq .total_count",
            "checked_at": "2026-10-09"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Primary chain Base (8453): the docs' examples use Base USDC, and the repo has Base broadcasts for every deposit-address contract. The repo also has broadcasts for 15 other chains, which we did not assess. Scope is the deposit-address system (DepositAddressManager and related contracts), which @daimo/sdk 1.8.x uses. The older DaimoPay/PayIntent order contracts are still in the repo; we did not score them. Contract addresses were resolved with CREATE3Factory.getDeployed(deployer 0x723a63fb50da50a26997fb99a2eb151e4f8c5227, salt) at 0x37922885311bc9d18e136e4fe6654409d3f45ffd. The pricer and bridger addresses come from the DAParams of a live session (tx 0x8d3d409f…bd00). We did not enumerate the full relayer set, because public Base RPCs limit eth_getLogs ranges. The two relayers listed were confirmed with direct relayerAuthorized() reads. All onchain reads are pinned to block 52280426. All repo reads are pinned to daimo-eth/sdk@ac0a71453ac249aa991d71059c621e2424322d61. No browser or network traces were run. Migrated to the post-red-team evidence rules on 2026-10-07 (components, quotes, rechecks, package evidence); score changes are listed in docs/research/daimo-pay.md.",
      "audits": {
        "searched": "The audit/ folder of github.com/daimo-eth/sdk (packages/contract/audit, one report), GitHub code and commit searches of the daimo-eth org for \"audit\", the audits/ folders of daimo-eth/daimo and daimo-eth/p256-verifier, docs.daimo.com (no security or audits page; /security and /audits return 404), and Nethermind's public report repo (NethermindEth/PublicAuditReports, no Daimo entry). Commit 76bc7df8 (2025-04-03, \"NM-0500 audit fixes\") shows an earlier Nethermind review of the DaimoPay/PayIntent contracts, but no NM-0500 report is published. The 2023 Veridise reports in daimo-eth/daimo and p256-verifier cover the Daimo wallet account and P256 verifier, which are not in the Daimo Pay payment path, so they are not listed.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Nethermind",
            "date": "2025-07-31",
            "type": "review",
            "scope": "NM-0585 \"Daimo Universal Address\" security review: UniversalAddressBridger, UniversalAddressFactory, UniversalAddressManager, SharedConfig, UniversalAddress and TokenUtils (730 LoC) in packages/contract/src.",
            "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/audit/NM-0585-Daimo-final-report.pdf",
            "commit": "80312d47e98a21b7daa4078d89ffe0e43bf8b1eb",
            "repo": "https://github.com/daimo-eth/sdk",
            "covers_deployed": "no",
            "findings": "2 low, 1 best practices; all marked fixed (initial report 2025-07-21, final 2025-07-31)",
            "note": "Initial commit ef97c77f, final commit 80312d47; neither commit is in the public repo (GitHub API returns 422). The Universal Address files were deleted in 99c3f248 (2026-01-08). The deployed DepositAddressManager, DepositAddress, DaimoPayExecutor, pricer and bridger on Base were added later (c990a190, 2025-12-17) and are not in this report's scope."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F3"
          ]
        },
        "P": {
          "score": 1,
          "limiting": [
            "P1",
            "P2",
            "P3",
            "P4"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S4",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 7,
        "short": 16,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "deblock-card",
      "name": "Deblock Card",
      "type": "incumbent",
      "website": "https://deblock.com",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Deblock app (iOS, Android, app.deblock.com)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Deblock SAS",
          "required": true
        },
        {
          "name": "Deblock current account and card ledger (e-money)",
          "role": "ledger",
          "public": false,
          "license": "proprietary",
          "operator": "Deblock SAS (EMI)",
          "required": true
        },
        {
          "name": "Deblock card issuing (direct Visa member)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Deblock SAS",
          "required": true
        },
        {
          "name": "Visa",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "KYC provider (not identified)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        },
        {
          "name": "Self-custodial crypto wallet (seed-phrase keys on device; not in the card path)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "user, app by Deblock SAS",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://deblock.com/en/legal-notice",
              "detail": "Deblock SAS is the authorised electronic money institution behind the current account the card spends from.",
              "quote": "Deblock SAS is authorised as an electronic money institution by the French Prudential Supervision and Resolution Authority",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://deblock.com/en/cards",
              "detail": "The cards page says Deblock is itself a direct Visa member.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The card is a Visa debit card on Deblock's own e-money ledger, with Deblock as issuer. Settlement happens only inside Deblock and Visa, so there is no direct path.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://deblock.com/en/legal-notice",
              "detail": "Deblock operates the e-money account and, per its cards page, the card issuing; no other operator exists in the card path.",
              "quote": "Deblock SAS is authorised as an electronic money institution by the French Prudential Supervision and Resolution Authority",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card payment depends on Deblock's closed ledger and issuing systems and on Visa. Closed, single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://deblock.com/en/legal-notice",
              "detail": "The legal notice reserves all software and databases as Deblock's exclusive property.",
              "quote": "remain the exclusive property of Deblock SAS or its licensors",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "All required components (app, ledger, issuing) are closed and proprietary. Nothing can be forked.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://deblock.com/en/legal-notice",
              "detail": "Card funds are e-money held by Deblock SAS as the authorised electronic money institution.",
              "quote": "Deblock SAS is authorised as an electronic money institution by the French Prudential Supervision and Resolution Authority",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card spends a balance that Deblock holds as e-money. That is a disclosed provider-held balance, so 1. The self-custodial crypto wallet is a separate product and not in the card path.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://deblock.com/en/legal-notice",
              "detail": "The card balance exists only on Deblock's e-money ledger.",
              "quote": "Deblock SAS is authorised as an electronic money institution by the French Prudential Supervision and Resolution Authority",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1 = 1 (provider-held e-money), C2 = 0 and C3 = 0. Card funds and access depend on Deblock operating; any recovery would go through EMI safeguarding (see context), not through a path the user controls. Crypto in the self-custodial wallet is outside the card rail.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. Deblock SAS (Lille, RCS 948 264 163) is authorised as an electronic money institution by the ACPR (interbank code 17748) and as a crypto-asset service provider by the AMF (number A2025-001) for exchange and order execution; complaints about personal data go to the CNIL (https://deblock.com/en/legal-notice). The cards page says Deblock is a direct Visa member (https://deblock.com/en/cards). I could not read the Terms or privacy policy (see notes), so safeguarding, liability and data-sharing terms are not cited.",
      "notes": "Incumbent: no verified contract or public repository needed to run the product was found. The card is a Visa debit card on Deblock's own e-money account. The self-custodial crypto wallet uses seed-phrase keys generated on the device (self-custody page), with no smart contract in the card path. Searched: GitHub (org DeblockApp exists with 0 public repos and nothing linking it to Deblock; other org names do not exist; repo search \"deblock\" returns only image-deblocking projects); deblock.com sitemap, legal notice, legal agreements, cards, self-custody and FAQ pages; the app.deblock.com bundle (Sentry enabled outside localhost, Intercom, Google Tag Manager, Fireblocks key-format helpers; no contract addresses). The Terms, privacy policy and complaints policy render client-side from a Deblock API that needs a bearer token embedded in the page script. I did not use that token, so those documents were not read and the cells that depend on them (C1, C4, P1, P2, P4) are unknown.",
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle"
          },
          {
            "symbol": "EURC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle"
          },
          {
            "symbol": "BTC",
            "class": "native"
          },
          {
            "symbol": "ETH",
            "class": "native"
          },
          {
            "symbol": "SOL",
            "class": "native"
          }
        ],
        "conversion": "at_top_up",
        "note": "The card spends only from the user's euro e-money current account at Deblock; it cannot spend crypto directly (Deblock's help centre says this feature is not yet available). Crypto held in the self-custodial Deblock wallet reaches the card only by selling it into euros in the app, and the help centre lists SOL, BTC, ETH, USDC and EUROC (Circle's EURC) as sellable for euros. All card payments are settled in euros, with Visa converting to the merchant's currency.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/8911372-can-i-make-card-payments-directly-with-my-cryptocurrencies",
            "detail": "Deblock's help centre says card payments cannot yet be made directly with crypto and are always settled in euros.",
            "quote": "your card payments will always be settled in Euros and the card issuer will instantly perform the necessary currency exchanges",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/10365208-what-crypto-pairs-can-i-sell",
            "detail": "The help centre says crypto can be sold only for euros and lists SOL, BTC, ETH, USDC and EUROC.",
            "quote": "Currently, the only fiat currency you can sell crypto in is € Euro",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://deblock.com/en/cards",
            "detail": "The cards page says every card draws on the user's current account.",
            "quote": "Every Deblock card is tied to your current account",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "deblock.com (cards, self-custody, legal notice, legal agreements and FAQ pages; no security or audits page), the Deblock help centre, GitHub (org DeblockApp has no public repos), web searches for Deblock security audits and penetration tests, and the public portfolios of Hacken, CertiK, Cure53, Trail of Bits and Zellic. No published code audit or penetration test of the Deblock app, card ledger or wallet was found. The card runs on Deblock's own closed e-money ledger with no smart contract in the path.",
        "checked_at": "2026-10-13",
        "reports": []
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C4",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P2",
            "P3",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 5,
        "unk": 18,
        "total": 23
      }
    },
    {
      "slug": "ethena-pay",
      "name": "Ethena Pay",
      "type": "card",
      "website": "https://pay.ethena.fi",
      "primary_chain": {
        "name": "Avalanche C-Chain",
        "chain_id": 43114,
        "basis": "Ethena Pay names no chain or contract in any document, so the unit rests on onchain evidence plus its own terms. The FAQ pays cashback in AVAX and the boost daily in USDe; the Card Terms name Rain as program manager. On Avalanche, Rain collateral 0x6070848b... (receiving per-wallet USDe card spends) and wallet factory 0xAc66ca9A... (12335 passkey wallets with USDe/USDC daily limits) share owner Safe 0xdD2332Ca... (block 96949020). Judgment call: attribution is inferred, not stated by Ethena Pay. Excluded: the Card Terms' generic Supported Blockchains list."
      },
      "repos": [],
      "contracts": [
        {
          "address": "0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
          "chain_id": 43114,
          "role": "Wallet factory proxy (facet registry, executor)",
          "verified": "explorer"
        },
        {
          "address": "0x5fe7e734378d1f531cDaeC42b6592EeF55c0810a",
          "chain_id": 43114,
          "role": "Wallet factory implementation (unverified)",
          "verified": "none"
        },
        {
          "address": "0xdDaFfdB1c5f0774ee734cF3491AaFd4f0A678127",
          "chain_id": 43114,
          "role": "ProxyAdmin of the wallet factory",
          "verified": "explorer"
        },
        {
          "address": "0xc831Ea25DEB7654679a438C78c4C5D1C313c8448",
          "chain_id": 43114,
          "role": "UpgradeableBeacon for user wallets (owner = factory)",
          "verified": "sourcify"
        },
        {
          "address": "0xb4446DA2e3970776DCfD44e78b034C8243F91C75",
          "chain_id": 43114,
          "role": "WalletDiamond implementation (user wallet)",
          "verified": "explorer"
        },
        {
          "address": "0x74bd26adac5661dc02a7ecBFfEB2dEfd3E928ee4",
          "chain_id": 43114,
          "role": "AllowanceFacet (executor-signed daily spends)",
          "verified": "explorer"
        },
        {
          "address": "0xbAdea7a22BC59E4E17DE82fbfD476a02057ca56f",
          "chain_id": 43114,
          "role": "WithdrawalFacet (executor and direct-mode withdrawals)",
          "verified": "explorer"
        },
        {
          "address": "0x6c6c8FF5c03C1774e8d781038be77A901d2CC5Ce",
          "chain_id": 43114,
          "role": "DirectModeFacet (user takeover after 1h)",
          "verified": "explorer"
        },
        {
          "address": "0xea1a564bc943986b5682b4CdaAad917372D0cbd8",
          "chain_id": 43114,
          "role": "RecoveryFacet",
          "verified": "explorer"
        },
        {
          "address": "0x8B6b0fBd3a27641343a73f4da8Cdb14b69eE2dFd",
          "chain_id": 43114,
          "role": "AuthFacet (signer management)",
          "verified": "explorer"
        },
        {
          "address": "0x27f6358aaa8b0F400Ef09135f9Bdf267c7b2Fc28",
          "chain_id": 43114,
          "role": "BatchExecutor (relays card spends; pause, blocklist)",
          "verified": "explorer"
        },
        {
          "address": "0x6070848bd19C37488d0516058f2933Dd992733dE",
          "chain_id": 43114,
          "role": "Rain collateral (BeaconProxy) receiving card spends",
          "verified": "explorer"
        },
        {
          "address": "0xD71Fd74187f81a42e322E0A33945F9C263E37624",
          "chain_id": 43114,
          "role": "RainCollateral implementation",
          "verified": "explorer"
        },
        {
          "address": "0xdD2332Ca4A4f8842EF7a4722ec087A236732b985",
          "chain_id": 43114,
          "role": "Owner Safe 1.4.1 (5-of-10) of factory and executor",
          "verified": "explorer"
        },
        {
          "address": "0x6455888e603177016cb1B266CFe86A0f7898C623",
          "chain_id": 43114,
          "role": "Sample user wallet (BeaconProxy)",
          "verified": "none"
        },
        {
          "address": "0xD0Ec8CC7414f27CE85f8dEce6B4a58225F273311",
          "chain_id": 43114,
          "role": "USDe payout Safe (3-of-10), presumed daily boost",
          "verified": "explorer"
        }
      ],
      "components": [
        {
          "name": "User wallet contracts (WalletDiamond beacon proxies and facets)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "Ethena Pay (owner Safe 0xdD2332Ca...)",
          "required": true
        },
        {
          "name": "Wallet factory implementation (facet registry, executor, global pause)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Ethena Pay (owner Safe 0xdD2332Ca...)",
          "required": true
        },
        {
          "name": "BatchExecutor (relays executor-signed card spends)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "Ethena Pay (owner Safe 0xdD2332Ca...)",
          "required": true
        },
        {
          "name": "Ethena Pay executor co-signer (EOA 0xe0EcdCc8...)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Ethena Pay",
          "required": true
        },
        {
          "name": "Ethena Pay relayer (authorized caller EOA 0x3219FAe3... and others)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Ethena Pay",
          "required": true
        },
        {
          "name": "Ethena Pay app and backend (iOS/Android app, card authorisation, rewards)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Ethena Pay Ltd (Malta)",
          "required": true
        },
        {
          "name": "Rain program management and collateral controller",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Signify Holdings, Inc. d/b/a Rain",
          "required": true
        },
        {
          "name": "RainCollateral contracts (collateral proxy and implementation)",
          "role": "contracts",
          "public": true,
          "license": "Unlicense",
          "operator": "Rain (controller) / Ethena Pay (owner Safe)",
          "required": true
        },
        {
          "name": "Third National (card issuer)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Third National",
          "required": true
        },
        {
          "name": "Visa (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Sumsub (identity verification and screening)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub Tech Ltd.",
          "required": true
        },
        {
          "name": "Privy (authentication, login, embedded wallet)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Horkos, Inc. d.b.a. Privy",
          "required": true
        },
        {
          "name": "Iron (fiat IBAN and on/off ramp; not in the card path)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Iron",
          "required": false
        }
      ],
      "context": "Per its legal hub, Ethena Pay Ltd. is a Maltese private limited company (C 114576) that says it is not a bank or money services business and does not hold customer funds. The Card Terms say the card is issued by Third National under license from Visa and the program is managed by Signify Holdings, Inc. d/b/a Rain; the card is offered only to non-U.S. persons. The site states digital assets are not covered by the FDIC, the UK FSCS, the Maltese Depositor Compensation Scheme or any investor compensation scheme. A complaints procedure with external escalation routes is published.",
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0x74bd26adac5661dc02a7ecBFfEB2dEfd3E928ee4",
              "address": "0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
              "block_number": 96949020,
              "detail": "Factory getFacet(spendDailyAllowance 0x764c53bd) = AllowanceFacet 0x74bd26ad..., whose verified source requires an executor co-signature (LibAuth.verifyExecutorSignature against factory.executor() = EOA 0xe0EcdCc8185A392baB2E23721eAdb65c8cC90fFC) for every allowance spend; the executor can withhold it for any wallet.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x112b6a67764c53bd00000000000000000000000000000000000000000000000000000000",
                "expect": "0x00000000000000000000000074bd26adac5661dc02a7ecbffeb2defd3e928ee4"
              },
              "recheck": "cast call 0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f \"executor()(address)\" --block 96949020 --rpc-url https://api.avax.network/ext/bc/C/rpc",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/address/0x27f6358aaa8b0F400Ef09135f9Bdf267c7b2Fc28",
              "address": "0x27f6358aaa8b0F400Ef09135f9Bdf267c7b2Fc28",
              "block_number": 96949020,
              "detail": "BatchExecutor (source verified on Routescan) has owner-only pause(), addBlocked() recipient blocklist and approvedRecipients allowlist; owner() = Safe 0xdD2332Ca4A4f8842EF7a4722ec087A236732b985, threshold 5 of 10 EOAs, no modules, no guard, no timelock.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000dd2332ca4a4f8842ef7a4722ec087a236732b985"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/address/0xdD2332Ca4A4f8842EF7a4722ec087A236732b985",
              "address": "0xdD2332Ca4A4f8842EF7a4722ec087A236732b985",
              "block_number": 96949020,
              "detail": "Owner Safe (v1.4.1) getThreshold() = 5, ten EOA owners (0xe5721209..., 0x62c0273B..., 0x20FB64B5..., 0x7be65cdC..., 0x12F97475..., 0x07b39671..., 0x3F117002..., 0x8740c944..., 0x467f264F..., 0x91660Fbb...), getModulesPaginated(0x1,10) empty, guard slot zero.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000005"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/card-terms",
              "quote": "reserve the right to block and terminate transactions and suspend access to your Account",
              "detail": "Card Terms s5 let Ethena Pay and the Issuer block and terminate transactions and suspend account access at any time and for any reason.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card spend needs a co-signature from Ethena Pay's executor EOA, and the BatchExecutor that relays spends has an owner pause and recipient blocklist held by a 5-of-10 Safe with undisclosed signers and no timelock. The Card Terms let Ethena Pay and the issuer block transactions for any reason, so an individual cardholder can be cut off with no notice. The user's own funds are not frozen by these powers (direct mode, see S4), but the payment path is. Judgment call: as for other card products, the documented per-account block meets anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/tx/0xec33bce0ee908346478eff573fac1f9263c591333fa9b2996d561137e823de9e",
              "address": "0x6455888e603177016cb1B266CFe86A0f7898C623",
              "block_number": 96938483,
              "detail": "Sample card spend tx 0xec33bce0...de9e was sent by relayer EOA 0x3219FAe3e8b2E6AF9a482937dE752b2Af656B78b to BatchExecutor 0x27f6358a... (batchExecute 0x80c3da8d) and moved 2.25 USDe from wallet 0x6455888e... to Rain collateral 0x6070848b... via spendDailyAllowance.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0x74bd26adac5661dc02a7ecBFfEB2dEfd3E928ee4",
              "address": "0x74bd26adac5661dc02a7ecBFfEB2dEfd3E928ee4",
              "block_number": 96949020,
              "detail": "AllowanceFacet.spendDailyAllowance (verified source, L113-L153) checks LibAuth.verifyExecutorSignature over (token, to, amount, nonce, deadline); without the Ethena Pay executor's signature no spend can occur.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Merchants are paid by Visa and the issuer offchain. The only onchain settlement step, moving USDe from the cardholder's wallet to the Rain collateral, requires an Ethena Pay executor signature and is relayed by Ethena Pay. Neither payer nor payee can settle a card payment by calling the contracts directly. The direct-mode withdrawal is an exit, not settlement.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/address/0x27f6358aaa8b0F400Ef09135f9Bdf267c7b2Fc28",
              "address": "0x27f6358aaa8b0F400Ef09135f9Bdf267c7b2Fc28",
              "block_number": 96949020,
              "detail": "BatchExecutor authorizedCallers(0x3219FAe3...) = true and approvedRecipients(0x6070848b...) = true; batchExecute reverts NotAuthorized for any other caller.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xdead610a0000000000000000000000006070848bd19c37488d0516058f2933dd992733de",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/card-terms",
              "quote": "The card program is managed by Signify Holdings, Inc. d/b/a Rain",
              "detail": "Card Terms name Rain as program manager and Third National as issuer under license from Visa.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A card payment needs Ethena Pay's closed backend (authorisation, executor co-signer, relayer), Rain, Third National and Visa. No component of that path is public or has a fallback. Ethena Pay publishes no repository at all.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/terms",
              "quote": "identity verification, sanctions screening, transaction monitoring, fraud screening",
              "detail": "Terms of Use s4.8 subject access to identity verification, sanctions screening and transaction monitoring; s4.6 lists Restricted Jurisdictions and lets Ethena Pay refuse access for any reason.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0x27f6358aaa8b0F400Ef09135f9Bdf267c7b2Fc28",
              "address": "0x27f6358aaa8b0F400Ef09135f9Bdf267c7b2Fc28",
              "block_number": 96949020,
              "detail": "BatchExecutor source carries an owner-managed recipient blocklist (addBlocked) and allowlist (approvedRecipients) applied to spend destinations; it does not screen the paying wallet.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Sanctions and jurisdiction screening exists and is disclosed in the Terms; it runs in Ethena Pay's closed backend and at Sumsub, so the neutrality of the settlement layer cannot be shown from code. The relayer contract's recipient allowlist restricts where card spends can go, not who can pay. Screening cannot be bypassed because there is no direct settlement path (C2 = 0). Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/address/0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
              "address": "0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
              "block_number": 96949020,
              "detail": "Factory getDefaultDailyLimits() returns tokens [USDe 0x5d3a1Ff2b6BAb83b63cd9AD0787074081a52ef34, USDC 0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E] with 10000e18 and 10000e6 per day; the same limits are set on sample wallet 0x6455888e....",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f \"getDefaultDailyLimits()(address[],uint256[])\" --block 96949020 --rpc-url https://api.avax.network/ext/bc/C/rpc"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/address/0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E",
              "address": "0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E",
              "block_number": 96949020,
              "detail": "Avalanche USDC blacklister() = 0x00fEC99eF111911F4C84e8a3C0BBa93f3891D572 and pauser() = 0x303F2f7D963d13C12bA3a03FdAdbb88277b106Dd.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xbd102430",
                "expect": "0x00000000000000000000000000fec99ef111911f4c84e8a3c0bba93f3891d572"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/card-terms",
              "quote": "means the Ethereum Blockchain, Polygon Blockchain, Optimism Blockchain, Arbitrum Blockchain",
              "detail": "The Card Terms' Supported Blockchains list omits Avalanche, where the collateral actually sits; neither the Terms nor the FAQ state issuer freeze powers or chain assumptions.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Spendable tokens (USDe and USDC) are enumerated in verified onchain factory config. USDC carries Circle's blacklister and pauser, and payees are not told about these powers or about Avalanche's validator set. The Card Terms' Supported Blockchains list does not name Avalanche (it reserves the right to add others). Judgment call: onchain config read from a verified-source factory counts as \"enumerated in code\"; the generic chain list is not treated as a misstatement because it is explicitly open-ended. 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0x5fe7e734378d1f531cDaeC42b6592EeF55c0810a",
              "address": "0x5fe7e734378d1f531cDaeC42b6592EeF55c0810a",
              "block_number": 96949020,
              "detail": "The factory implementation (EIP-1967 implementation slot of 0xAc66ca9A...) returns no source on Routescan, no Sourcify match, and Snowscan shows it Unverified.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0xb4446DA2e3970776DCfD44e78b034C8243F91C75",
              "address": "0xb4446DA2e3970776DCfD44e78b034C8243F91C75",
              "block_number": 96949020,
              "detail": "WalletDiamond, all ten facets returned by getAllSelectors()/getFacet(), BatchExecutor and RainCollateral are verified on Routescan (Snowtrace) only; Sourcify has only the UpgradeableBeacon 0xc831Ea25... (match); Snowscan shows them Unverified.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The wallet logic is verified on one explorer (Routescan), but the factory implementation, which maps every wallet selector to its facet and holds the executor and global pause, is unverified anywhere. Nothing is on Sourcify apart from the beacon, and there is no public repo or build script. Some contracts verified, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0xb4446DA2e3970776DCfD44e78b034C8243F91C75",
              "address": "0xb4446DA2e3970776DCfD44e78b034C8243F91C75",
              "block_number": 96949020,
              "detail": "The only public code is explorer-verified contract source (wallet diamond, facets, BatchExecutor); gh search for ethenapay/ethena-pay/pay.ethena.fi and the ethena-labs org (13 repos) found no Ethena Pay SDK, app, backend or contract repository.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Contract source is public through explorer verification; the app, backend, executor, relayer, API and indexer are not, and no API schema is published. Judgment call: explorer-verified source counts as \"contracts only\" (1) rather than \"nothing\" (0).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0xb4446DA2e3970776DCfD44e78b034C8243F91C75",
              "address": "0xb4446DA2e3970776DCfD44e78b034C8243F91C75",
              "block_number": 96949020,
              "detail": "No repository, README or deploy instructions exist; the verified sources depend on an unverified factory implementation.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "There is no README, repo or deploy script, and the factory that wires the wallets together is unverified, so no self-host path exists. Reproduction not attempted.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0x74bd26adac5661dc02a7ecBFfEB2dEfd3E928ee4",
              "address": "0x74bd26adac5661dc02a7ecBFfEB2dEfd3E928ee4",
              "block_number": 96949020,
              "detail": "Facet ABIs and events (AllowanceSpent, DirectWithdrawal, DirectModeInitiated) are available only from explorer verification; there is no repo, no API schema and no payee export.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "ABIs and event definitions can be pulled from the explorer for the wallet facets, but nothing is versioned in a repo, there is no API schema, and no export format is published. Judgment call: explorer ABIs are more than \"none\" but less than repo files, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0x5fe7e734378d1f531cDaeC42b6592EeF55c0810a",
              "address": "0x5fe7e734378d1f531cDaeC42b6592EeF55c0810a",
              "block_number": 96949020,
              "detail": "Factory implementation source is unpublished; executor, relayer, backend and app are closed; there is no repository carrying any license.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Explorer-verified facets carry SPDX MIT headers, but required components (factory implementation, executor co-signer, relayer, backend, Rain, issuer) are closed and there are no repos. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0x74bd26adac5661dc02a7ecBFfEB2dEfd3E928ee4",
              "address": "0x74bd26adac5661dc02a7ecBFfEB2dEfd3E928ee4",
              "block_number": 96949020,
              "detail": "spendDailyAllowance, executorTokenWithdrawal, executorExternalCall and externalApprove all require LibAuth.verifyExecutorSignature from the factory's executor, an Ethena Pay key.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The card product cannot run without Ethena Pay's proprietary executor service, backend and Rain's program; there is no open alternative.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/privacy",
              "quote": "government-issued photo identification and related information",
              "detail": "Privacy Policy lists name, address, date of birth, government ID, taxpayer ID, proof of address, source of funds and biometric or liveness data, plus device and usage data, shared with KYC/AML providers, card issuers and networks.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Collection goes well beyond settlement needs (identity, biometrics, source of funds, device data). It is disclosed in the privacy policy, with GDPR lawful bases for EEA/UK users, but not in any code or versioned repo document, so the documented cap applies: 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/tx/0xec33bce0ee908346478eff573fac1f9263c591333fa9b2996d561137e823de9e",
              "address": "0x6455888e603177016cb1B266CFe86A0f7898C623",
              "block_number": 96938483,
              "detail": "The card spend emits Transfer and AllowanceSpent(token, to, amount) from the long-lived user wallet to the shared Rain collateral 0x6070848b...; no merchant or order data appears onchain.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/privacy",
              "quote": "identity verification and KYC/AML service providers",
              "detail": "The privacy policy describes collecting public wallet addresses from public blockchain networks but does not tell users that card spends are publicly visible and linkable to their wallet.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No merchant data goes onchain, but every card spend is a public transfer from one long-lived wallet to a known Ethena Pay/Rain collateral address, so anyone can read a cardholder's spend amounts and timing; daily USDe boost payouts from a single Safe tag the wallet further. No fresh addresses. Judgment call: linkage is minimal but not documented to users, so below 2; it is not plaintext metadata, so 1 rather than 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/terms",
              "quote": "The Sumsub Identity Verification Services Terms",
              "detail": "Terms incorporate third-party terms for Sumsub (identity verification), Privy (authentication and embedded wallet) and Iron (fiat), and the Card Terms name Rain, Third National and Visa.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Rain, Third National, Visa, Sumsub and Privy all see payment or identity data; they are disclosed in the Terms only and cannot be swapped by the user. The app is closed, so further third parties (analytics, RPC) cannot be inventoried.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/address/0x6455888e603177016cb1B266CFe86A0f7898C623",
              "address": "0x6455888e603177016cb1B266CFe86A0f7898C623",
              "block_number": 96949020,
              "detail": "Sample wallet dailyLimit(USDe) = 10000e18 (and USDC 10000e6); AllowanceFacet.spendDailyAllowance transfers up to that amount per UTC day to any `to` address on the executor's signature alone, with no user signature.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xf3f514150000000000000000000000005d3a1ff2b6bab83b63cd9ad0787074081a52ef34",
                "expect": "0x00000000000000000000000000000000000000000000021e19e0c9bab2400000"
              },
              "recheck": "cast call 0x6455888e603177016cb1B266CFe86A0f7898C623 \"dailyLimit(address)(uint256)\" 0x5d3a1Ff2b6BAb83b63cd9AD0787074081a52ef34 --block 96949020 --rpc-url https://api.avax.network/ext/bc/C/rpc",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0xD71Fd74187f81a42e322E0A33945F9C263E37624",
              "address": "0x6070848bd19C37488d0516058f2933Dd992733dE",
              "block_number": 96949020,
              "detail": "Card spends land in Rain collateral 0x6070848b... (holding 372898.73 USDe); RainCollateral.withdrawAsset is onlyController (Rain), and owner() is Safe 0xdD2332Ca....",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000dd2332ca4a4f8842ef7a4722ec087a236732b985"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://pay.ethena.fi/faq",
              "quote": "Ethena Pay does not hold, manage, custody, or have access to your funds",
              "detail": "The FAQ states Ethena Pay has no access to user funds.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Balances sit in the user's own wallet contract, but the Ethena Pay executor key can move up to 10,000 USDe and 10,000 USDC per wallet per day to an arbitrary address without the user's signature; the relayer contract's recipient allowlist does not bind direct calls to the wallet. At spend, funds pass to a Rain-controlled collateral pool. This contradicts the FAQ's \"no access\" statement. The provider can redirect funds (bounded per day), so 0.",
          "disputed": true,
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/address/0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
              "address": "0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
              "block_number": 96949020,
              "detail": "Factory is a TransparentUpgradeableProxy whose EIP-1967 admin slot holds ProxyAdmin 0xdDaFfdB1c5f0774ee734cF3491AaFd4f0A678127; ProxyAdmin owner() = Safe 0xdD2332Ca... (5-of-10, no modules, no guard). The factory's own UPGRADE_DELAY() = 172800 s covers its scheduleUpgrade path only; ProxyAdmin.upgradeAndCall has no delay.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x000000000000000000000000ddaffdb1c5f0774ee734cf3491aafd4f0a678127"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/43114/0xc831Ea25DEB7654679a438C78c4C5D1C313c8448",
              "address": "0xc831Ea25DEB7654679a438C78c4C5D1C313c8448",
              "block_number": 96949020,
              "detail": "Wallet beacon owner() = factory 0xAc66ca9A..., implementation() = WalletDiamond 0xb4446DA2...; every wallet's fallback resolves facets through factory.getFacet(), so replacing the factory implementation changes all 12335 wallets at once.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x5c60da1b",
                "expect": "0x000000000000000000000000b4446da2e3970776dcfd44e78b034c8243f91c75"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "All wallet logic is upgradeable through the factory, which a 5-of-10 Safe with undisclosed EOA signers can upgrade instantly via its ProxyAdmin; the 48-hour UPGRADE_DELAY inside the factory does not bind that path. The factory implementation is unverified. Multisig admin, no effective timelock, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://snowscan.xyz/address/0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
              "address": "0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
              "block_number": 96949020,
              "detail": "getDefaultDailyLimits() sets 10000 USDe and 10000 USDC per UTC day on every new wallet at initialization (WalletDiamond._applyDefaultAllowances); the allowance is not bound to a receiver.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "There are no ERC-20 approvals; the wallet grants Ethena Pay's executor a refilling daily allowance of 10,000 USDe and 10,000 USDC by default, spendable to any address. Judgment call: bounded and refilling, but not limited to one receiver and not disclosed to users outside verified source, so the lower anchor 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0xbAdea7a22BC59E4E17DE82fbfD476a02057ca56f",
              "address": "0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
              "block_number": 96949020,
              "detail": "Factory getFacet(directTokenWithdrawal 0x35f48b04) = WithdrawalFacet 0xbAdea7a2..., which transfers tokens on a wallet-owner signature alone once direct mode is active; DirectModeFacet.initiateDirectMode (owner signature only) activates after 1 hour and is not blocked by global pause.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x112b6a6735f48b0400000000000000000000000000000000000000000000000000000000",
                "expect": "0x000000000000000000000000badea7a22bc59e4e17de82fbfd476a02057ca56f"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "S1: funds sit in the user's wallet contract. C2: no direct settlement path (0). C3: closed single-vendor backend (0). O3: no self-host path. If Ethena Pay disappears, the card stops, but a user can enter direct mode and withdraw with their own key after 1 hour, by calling the verified facets manually (no public frontend or documented procedure exists). The path depends on facet mappings the admin Safe can change instantly (S2). Judgment call: a working exit exists only as a manual contract call, so 1, not 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "notes": "Ethena Pay launched on 2026-09-03. It publishes no repository, contract address or chain; the Avalanche deployment was found from USDe Transfer logs (Ethena Pay's FAQ pays boost in USDe daily and cashback in AVAX) and tied together through shared owner Safe 0xdD2332Ca.... Attribution to Ethena Pay is an inference, recorded as a judgment call in primary_chain.basis. All reads pinned to Avalanche block 96949020. Explorer citations use the Routescan API (snowtrace.io and routescan.io pages return 403 to curl). A third-party audit list (crypticdefense/audits) mentions private Guardian audits of an \"EthenaPay Wallet\" and \"EthenaSafeGuard\"; no report is public, so S6 is unknown.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "AR",
          "BZ",
          "BO",
          "BR",
          "CO",
          "CR",
          "EC",
          "GT",
          "GY",
          "HN",
          "MX",
          "PA",
          "PY",
          "PE",
          "SR",
          "UY",
          "BS",
          "BB",
          "KY",
          "DM",
          "DO",
          "GD",
          "KN",
          "LC",
          "VC",
          "TT",
          "TC",
          "HK",
          "JP",
          "MY",
          "PH",
          "SG",
          "TH",
          "AE",
          "CI",
          "EG",
          "GH",
          "KE",
          "SN",
          "ZA",
          "UG",
          "ZM",
          "NZ"
        ],
        "note": "The Terms of Use (s4.5) make the Services available only where Ethena Pay has expressly authorized them, and Appendix 1 (Country-Specific Terms) has sections for 47 countries. The list here is those 47, less four where Appendix 1 withholds the card or digital-asset services by default. Australia: the Spend Card is \"not generally available\" unless offered through a local issuer. El Salvador, Pakistan and Morocco: digital-asset services are unavailable unless Ethena Pay confirms them at onboarding, and the card spends stablecoin balances. Japan is kept, but Appendix 1 limits Japanese users to functions that are not regulated crypto or electronic-payment services. The /jurisdictions page lists 48 live countries; it adds Antigua and Barbuda, which has no section in Appendix 1, so AG is left out as the more restrictive reading. The Spend Card is not offered to US persons. s4.6 Restricted Jurisdictions (always excluded) include Crimea and the Donetsk and Luhansk regions of Ukraine, Abkhazia, South Ossetia, Northern Cyprus and Somaliland. \"Live soon\": USA, EU, United Kingdom, Switzerland, Canada, Taiwan, South Korea.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/terms",
            "detail": "Terms of Use s4.5. The Services are offered only in expressly authorized jurisdictions, which Appendix 1 lists country by country.",
            "quote": "a jurisdiction where we have expressly authorized them to be available to residents",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/terms",
            "detail": "Appendix 1 s5.1 (Australia) withholds the Spend Card by default.",
            "quote": "The Ethena Pay Spend Card is not generally available to Australian users unless expressly offered through a local issuer",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/terms",
            "detail": "Appendix 1 s3.4 (Pakistan) withholds digital-asset services by default. s4.5 (Morocco) and s1.8 (El Salvador) say the same.",
            "quote": "Services involving transactions in virtual currencies or other digital assets are not available to Pakistani users",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/terms",
            "detail": "s4.6 Restricted Jurisdictions, which are never served regardless of Appendix 1.",
            "quote": "Afghanistan; Abkhazia; Belarus; Burma (Myanmar); Burundi; Central African Republic; Crimea; Cuba",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/jurisdictions",
            "detail": "The Available Jurisdictions page lists 48 live countries by region. It is the same as Appendix 1 plus Antigua and Barbuda.",
            "quote": "Ethena Pay is live in 48 countries across Latin America, the Caribbean, Asia & the Middle East, Africa, and Oceania",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/faq",
            "detail": "The card is not offered to US persons.",
            "quote": "The Ethena Pay Spend Card is offered only to non-U.S. persons",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDe",
            "class": "stablecoin",
            "backing": "synthetic",
            "issuer": "Ethena (affiliate of Ethena Pay)",
            "default": true,
            "chain_id": 43114,
            "address": "0x5d3a1Ff2b6BAb83b63cd9AD0787074081a52ef34"
          },
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "chain_id": 43114,
            "address": "0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E"
          }
        ],
        "conversion": "at_spend",
        "note": "The card is a secured account: tokens in the user's Avalanche wallet contract are the Collateral, and each card spend moves USDe (or USDC) from that wallet to a Rain collateral pool, while Rain and the issuer pay the merchant in dollars over Visa. The wallet factory sets daily spend allowances for exactly two tokens, USDe and USDC. USDe is marked default because the sampled card spend and the Rain pool's balance are in USDe, and the Daily Boost is paid in USDe; no Ethena Pay document names a default. USDe is Ethena's synthetic dollar, so the card's main balance is issued within the provider's own ecosystem (the Terms list \"Ethena USDe\" among Ethena Pay's or its affiliates' marks). Cashback is paid separately in AVAX. Ethena Pay names no chain or token contract in its documents; the chain and addresses come from onchain reads.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://snowscan.xyz/address/0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
            "address": "0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
            "chain_id": 43114,
            "block_number": 96949020,
            "detail": "Wallet factory getDefaultDailyLimits() returns tokens [USDe 0x5d3a1Ff2b6BAb83b63cd9AD0787074081a52ef34, USDC 0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E] with 10000e18 and 10000e6 per day, the only tokens the executor can spend for card payments.",
            "checked_at": "2026-10-12"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://snowscan.xyz/tx/0xec33bce0ee908346478eff573fac1f9263c591333fa9b2996d561137e823de9e",
            "address": "0x6455888e603177016cb1B266CFe86A0f7898C623",
            "chain_id": 43114,
            "block_number": 96938483,
            "detail": "Sample card spend moved 2.25 USDe from wallet 0x6455888e... to Rain collateral 0x6070848b... via spendDailyAllowance, relayed by Ethena Pay's BatchExecutor.",
            "checked_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/terms",
            "detail": "Terms of Use s2 say balances are denominated in or backed by supported digital assets, including USDe or third-party stablecoins.",
            "quote": "might be denominated in, referenced to, or backed by one or more supported Digital Assets, including USDe or stablecoin tokens issued by third parties",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/card-terms",
            "detail": "Card Terms s3 make the wallet's tokens the Collateral securing card charges, liquidated by Ethena Pay or the issuer if unpaid.",
            "quote": "Either your primary Linked Wallet or any Additional Wallets may provide the collateral that will secure the Charges made by you on any Card",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "Guardian's public report repo (github.com/GuardianAudits/Audits, Ethena folder), the crypticdefense/audits list (which still marks the EthenaPay Wallet and EthenaSafeGuard audits private), web searches for Ethena Pay audits, the Sherlock report repo for Rain, Rain's security page (audits under NDA, Sherlock named), and the docs/ audit folder of github.com/safe-fndn/safe-smart-account for the owner Safe. Guardian's April 2026 Execution Guard (EthenaSafeGuard) review is not listed: the owner Safe's guard slot is zero. Ethena's SOC 2 Type II report is not a code audit.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Guardian",
            "date": "2026-07-06",
            "type": "audit",
            "scope": "Ethena Pay wallet updates: UserProxyFactoryBeacon, BatchExecutor, WalletDiamond facets (Auth, Recovery, Allowance, Withdrawal, DirectMode, ExecutorExternalCall, ExternalApprove, ERC1271) and libraries",
            "url": "https://github.com/GuardianAudits/Audits/blob/main/Ethena/2026-07-06_Ethena_Pay_Updates.pdf",
            "covers_deployed": "unknown",
            "findings": "3 high, 14 medium, 39 low, 25 informational over two rounds; 25 resolved, 11 partly, 45 acknowledged",
            "note": "Review window 10-29 June 2026, before the September launch. The report names no commit, and the factory implementation on Avalanche is unverified, so the audited code was not tied to the deployment. Guardian rated confidence 3 of 5."
          },
          {
            "auditor": "Guardian",
            "date": "2026-04-15",
            "type": "audit",
            "scope": "Ethena Pay wallet contracts: UserProxyFactoryBeacon, WalletDiamond, AllowanceFacet, AuthFacet, DirectModeFacet, RecoveryFacet, WithdrawalFacet and libraries (14 files)",
            "url": "https://github.com/GuardianAudits/Audits/blob/main/Ethena/2026-04-15_Ethena_Pay_Review.pdf",
            "commit": "9122473f5310",
            "covers_deployed": "unknown",
            "findings": "3 medium, 7 low, 24 informational; 18 resolved, 16 acknowledged",
            "note": "Repository chainnodesorg/ethenapay-wallet-contracts (not public); remediation commit 498c18fb29c0. Superseded in part by the July 2026 updates review."
          },
          {
            "auditor": "Sherlock",
            "date": "2025-02-11",
            "type": "contest",
            "scope": "Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest",
            "url": "https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2025.02.11%20-%20Final%20-%20Rain%20Private%20Best%20Efforts%20Audit%20Contest%20Report.pdf",
            "commit": "6f578d5b9c9fa35bbe857959a50fa5aab4fa611a",
            "repo": "https://github.com/SignifyHQ/collateral-contract-evm-v2",
            "covers_deployed": "unknown",
            "findings": "0 high, 2 medium (statement payoff rounding; missing Chainlink min/max answer check)",
            "note": "Contest ran 2-8 December 2024 on b432939a; 6f578d5 is the fix commit. The Rain repo is private and the RainCollateral implementation on Avalanche was not compared with it."
          },
          {
            "auditor": "Ackee Blockchain",
            "date": "2023-03-28",
            "type": "audit",
            "scope": "Shared component: Safe smart account v1.4.0 core contracts, used by the 5-of-10 owner Safe of the factory and executor",
            "url": "https://github.com/safe-fndn/safe-smart-account/blob/main/docs/Safe_Audit_Report_1_4_0.pdf",
            "commit": "eb93dbb0f62e2dc1b308ac4c110038062df0a8c9",
            "repo": "https://github.com/safe-fndn/safe-smart-account",
            "covers_deployed": "partly",
            "findings": "2 medium, 1 low, 6 warnings, 2 info; one warning fixed, the rest acknowledged",
            "note": "Owner Safe 0xdD2332Ca... proxies the canonical SafeL2 v1.4.1 singleton 0x29fcB43b... (slot 0 read 2026-10-13). Safe says 1.4.1 added one ERC-4337 opcode bugfix after this audit and was not re-audited."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 1,
        "short": 17,
        "unk": 5,
        "total": 23
      }
    },
    {
      "slug": "etherfi-cash",
      "name": "ether.fi Cash",
      "type": "card",
      "website": "https://etherfi.gitbook.io/etherfi/products/cash",
      "primary_chain": {
        "name": "OP Mainnet",
        "chain_id": 10,
        "basis": "Optimism is the Cash core chain: ether.fi's deployed-contracts page says Cash v3 contracts are deployed on Optimism, the technical docs name it the core chain, and the April 2026 account upgrade moved Safes from Scroll. cash-v3 a5024d0 keeps the live roles and timelocks for chain 10 only (deployments/mainnet/10/roles.json#L1-L80); every read is pinned to OP block 157880645. Excluded: Scroll (534352, legacy core, no Spend events in the last 50,000 blocks) and the top-up chains (Ethereum, Base, Arbitrum, HyperEVM)."
      },
      "repos": [
        {
          "url": "https://github.com/etherfi-protocol/cash-v3",
          "role": "contracts",
          "license": "none"
        },
        {
          "url": "https://github.com/etherfi-protocol/cash-v3/tree/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/scripts",
          "role": "deploy",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0",
          "chain_id": 10,
          "role": "CashModule (UUPS proxy; spend, withdraw)",
          "verified": "sourcify"
        },
        {
          "address": "0x5C1E3D653fcbC54Ae25c2AD9d59548D2082C687B",
          "chain_id": 10,
          "role": "RoleRegistry (UUPS proxy; all roles)",
          "verified": "sourcify"
        },
        {
          "address": "0xF4e147Db314947fC1275a8CbB6Cde48c510cd8CF",
          "chain_id": 10,
          "role": "EtherFiSafeFactory (UUPS proxy; owns Safe beacon)",
          "verified": "sourcify"
        },
        {
          "address": "0x48e1630278D8310c86650405ebfbc110CdF3D1ec",
          "chain_id": 10,
          "role": "UpgradeableBeacon for all user Safes",
          "verified": "sourcify"
        },
        {
          "address": "0x79A6d20280e4b564ea1d8f5369C6544887F7397e",
          "chain_id": 10,
          "role": "EtherFiSafe implementation (beacon target)",
          "verified": "sourcify"
        },
        {
          "address": "0xDC515Cb479a64552c5A11a57109C314E40A1A778",
          "chain_id": 10,
          "role": "EtherFiDataProvider (default modules, recovery signers)",
          "verified": "sourcify"
        },
        {
          "address": "0x5D3c4f5CF2208bB54e8fd129730d01D82d4611b3",
          "chain_id": 10,
          "role": "EtherFiHook (pre/post module hook)",
          "verified": "sourcify"
        },
        {
          "address": "0x50A233C4a0Bb1d7124b0224880037d35767a501C",
          "chain_id": 10,
          "role": "SettlementDispatcherRain (card settlement)",
          "verified": "sourcify"
        },
        {
          "address": "0x9623e86Df854FF3b48F7B4079a516a4F64861Db2",
          "chain_id": 10,
          "role": "SettlementDispatcherReap (card settlement)",
          "verified": "sourcify"
        },
        {
          "address": "0x0078C5a459132e279056B2371fE8A8eC973A9553",
          "chain_id": 10,
          "role": "DebtManager (legacy credit; impl explorer-only)",
          "verified": "explorer"
        },
        {
          "address": "0x380B2e96799405be6e3D965f4044099891881acB",
          "chain_id": 10,
          "role": "CashEventEmitter (impl explorer-only)",
          "verified": "explorer"
        },
        {
          "address": "0x9106cD76E10Ac60D1dd16144243416EbD2C64434",
          "chain_id": 10,
          "role": "Upgrade timelock (2 days), RoleRegistry owner",
          "verified": "sourcify"
        },
        {
          "address": "0x9AEb8eaa982084219d1A938D8F7B5040a1d47849",
          "chain_id": 10,
          "role": "Operating timelock (8 h), ADMIN_TIMELOCK_ROLE",
          "verified": "explorer"
        },
        {
          "address": "0xA6cf33124cb342D1c604cAC87986B965F428AAC4",
          "chain_id": 10,
          "role": "Cash governance Safe (3-of-6), ADMIN_ROLE",
          "verified": "explorer"
        },
        {
          "address": "0x1DcE164910A972F8AD755cb737E280143d593e76",
          "chain_id": 10,
          "role": "Sample user Safe (beacon proxy)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "cash-v3 contracts (Safe, CashModule, modules, dispatchers)",
          "role": "contracts",
          "public": true,
          "license": "none",
          "operator": "ether.fi (upgradeable via 2-day timelock)",
          "required": true,
          "repo": "https://github.com/etherfi-protocol/cash-v3"
        },
        {
          "name": "ether.fi app and web app (Cash tab)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "ether.fi",
          "required": true
        },
        {
          "name": "ether.fi card authorisation backend (ETHER_FI_WALLET_ROLE EOAs)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "ether.fi",
          "required": true
        },
        {
          "name": "Turnkey owner-key enclave (user signer)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Turnkey",
          "required": true
        },
        {
          "name": "Settlement bridger (SETTLEMENT_DISPATCHER_BRIDGER_ROLE)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "ether.fi",
          "required": true
        },
        {
          "name": "Rain / Reap card programme (BIN sponsors named in code)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Rain, Reap",
          "required": true
        },
        {
          "name": "Third National (card issuer per cardholder agreements)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Third National",
          "required": true
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "KYC vendor (not named in any policy found)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        },
        {
          "name": "Price oracles (Chainlink and others in config)",
          "role": "oracle",
          "public": true,
          "license": "proprietary",
          "operator": "Chainlink and others",
          "required": false
        },
        {
          "name": "Aave v4 lend market (credit mode)",
          "role": "contracts",
          "public": true,
          "license": "source-available",
          "operator": "ether.fi deployment of Aave v4",
          "required": false
        },
        {
          "name": "Settlement tokens (USDC by Circle, USDT, EURC)",
          "role": "contracts",
          "public": true,
          "license": "proprietary",
          "operator": "Circle, Tether",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x5C1E3D653fcbC54Ae25c2AD9d59548D2082C687B",
              "address": "0x5C1E3D653fcbC54Ae25c2AD9d59548D2082C687B",
              "block_number": 157880645,
              "detail": "RoleRegistry roleHolders(PAUSER) = governance Safe 0xA6cf...AAC4 (3-of-6), EOA 0x9AF1298993DC1f397973C62A5D47a284CF76844D, and Safe 0x427989Bb12f4A390D11e7647d467DeA02b9d2eE3 with threshold 1 of 6; hasRole(PAUSER, 0x9AF1...844D) returns true.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d14854539440820030c4994db4e31b6b800deafd503688728f932addfe7a410515c14c0000000000000000000000009af1298993dc1f397973c62a5d47a284cf76844d",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0x5C1E3D653fcbC54Ae25c2AD9d59548D2082C687B \"roleHolders(bytes32)(address[])\" $(cast keccak PAUSER) --rpc-url https://mainnet.optimism.io --block 157880645",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x9AF1298993DC1f397973C62A5D47a284CF76844D",
              "address": "0x9AF1298993DC1f397973C62A5D47a284CF76844D",
              "block_number": 157880645,
              "eoa": true,
              "detail": "The PAUSER key 0x9AF1...844D has no code at block 157880645 (an EOA).",
              "checked_at": "2026-10-07",
              "recheck": "cast codesize 0x9AF1298993DC1f397973C62A5D47a284CF76844D --rpc-url https://mainnet.optimism.io --block 157880645"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/utils/UpgradeableProxy.sol#L89-L101",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/utils/UpgradeableProxy.sol",
              "detail": "pause() needs only PAUSER and unpause() needs UNPAUSER; CashModuleCore.spend (L391) and SettlementDispatcherV2.settle/bridge are whenNotPaused, so one pauser key halts every card settlement at once.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/modules/cash/CashModuleSetters.sol#L109-L163",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/modules/cash/CashModuleSetters.sol",
              "detail": "ADMIN_ROLE (the 3-of-6 Safe, no timelock) can remove an asset from the withdrawable list (configureWithdrawAssets) and set the withdrawal delay to any value (setDelays) in one transaction.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international",
              "detail": "Cardholder terms let ether.fi and the issuer suspend or cancel the card or deny any transaction at their discretion.",
              "checked_at": "2026-10-07",
              "quote": "with or without cause and with or without giving you notice",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A pause key that halts all card settlement is held by an EOA (and by a 1-of-6 Safe) with no timelock. No contract role can blacklist a single Safe onchain; per-card blocking happens offchain, where the cardholder terms let ether.fi and the issuer deny transactions without notice. ADMIN_ROLE, a 3-of-6 Safe with no timelock, can also de-list a withdrawable asset or raise the withdrawal delay at once. An EOA-held role scores 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/modules/cash/CashModuleCore.sol#L391-L407",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/modules/cash/CashModuleCore.sol",
              "detail": "spend() is onlyEtherFiWallet (role check at CashModuleStorageContract.sol L223-L226), so only an ether.fi key can move funds from a Safe to a settlement dispatcher.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/tx/0xdb50399e77874358090b384be2d0057478ad32a2c777a2a2eda922ef05b4f565",
              "address": "0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0",
              "block_number": 157880145,
              "detail": "Sample card spend, tx 0xdb50399e...f565, was sent by EOA 0xdC45DB93c3fC37272f40812bBa9C4Bad91344b46 (an ETHER_FI_WALLET_ROLE holder) to CashModule.spend, which borrowed USDT through the Aave v4 spoke and sent it to SettlementDispatcherRain 0x50A2...501C.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/settlement-dispatcher/SettlementDispatcherV2.sol#L941-L977",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/settlement-dispatcher/SettlementDispatcherV2.sol",
              "detail": "The dispatcher pays the issuer-side recipient only through settle() and bridge(), which are restricted to SETTLEMENT_DISPATCHER_BRIDGER_ROLE.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Merchants are paid by Visa and the issuer offchain. Both onchain steps are role-gated: spend() needs an ether.fi wallet key, and settle()/bridge() need the bridger role. Neither payer nor payee can settle a card payment by calling the contracts. The user's own withdrawal path is exit, not settlement (see S4).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x5C1E3D653fcbC54Ae25c2AD9d59548D2082C687B",
              "address": "0x5C1E3D653fcbC54Ae25c2AD9d59548D2082C687B",
              "block_number": 157880645,
              "detail": "roleHolders(ETHER_FI_WALLET_ROLE) = EOAs 0xdC45DB93c3fC37272f40812bBa9C4Bad91344b46 and 0xB42833d6edd1241474D33ea99906fD4CBE893730 (both without code); these keys submit every spend.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d14854182c09b9a75f816507b9c63a8f7abb8b772664ed74508c2e3b084f4a604e2067000000000000000000000000dc45db93c3fc37272f40812bba9c4bad91344b46",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/README.md#L32-L85",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "README.md",
              "detail": "The only public repo is the contracts repo (Forge tests and deploy scripts). The etherfi-protocol and ether-fi GitHub orgs publish no app, backend, card authorisation or relayer code.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/cash-modules",
              "detail": "The Cash Modules docs say spend requires the caller to hold ether.fi's wallet role.",
              "checked_at": "2026-10-07",
              "quote": "Requires the caller to have the ETHER_FI_WALLET_ROLE",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Each card payment needs ether.fi's closed authorisation backend and wallet keys, its settlement bridger, the Turnkey enclave that holds the user's key, the Rain or Reap card programme, the issuer Third National, and Visa. None of these is public, and none has a fallback. The payment path is closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/modules/cash/CashModuleCore.sol#L409-L436",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/modules/cash/CashModuleCore.sol",
              "detail": "Spend validation checks only token, amounts, txId reuse and the spending limit. A search of src/ found no blacklist, sanctions or country logic; the only \"frozen\" hits are Aave reserve states.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international",
              "detail": "The cardholder agreement excludes persons blocked or sanctioned by the US (OFAC). The Terms of Use exclude UN-sanctioned and listed jurisdictions.",
              "checked_at": "2026-10-07",
              "quote": "You are not a person who is blocked or sanctioned by the United States Government",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement contracts contain no address or geographic filtering. Sanctions and country screening is disclosed in the Terms and cardholder agreements, and it runs in the closed KYC/backend and at the issuer. It cannot be bypassed, since C2 = 0, and it is not disclosed in code or a versioned repo document. Edge filtering disclosed in docs only = 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/deployments/mainnet/10/config.json#L17-L46",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "deployments/mainnet/10/config.json",
              "detail": "Collateral, borrow and withdrawable tokens for OP are enumerated in config, among them usdc, usdt, eurc, weth, weETH, fraxusd, the liquid vault tokens and op.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85",
              "address": "0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85",
              "block_number": 157880645,
              "detail": "Native USDC on OP (the main spend/borrow token) has blacklister() = 0x551e855B7355C98534175879A300972856C04d7C and pauser() = 0xb8015408bcBA72BCBb34775c81361FB496051c9B.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xbd102430",
                "expect": "0x000000000000000000000000551e855b7355c98534175879a300972856c04d7c"
              },
              "recheck": "cast call 0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85 \"blacklister()(address)\" --rpc-url https://mainnet.optimism.io --block 157880645",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/resources/ether.fi-whitepaper/risks",
              "detail": "The risks page mentions only generic \"restrictions on a specific token\" and chain outages. It does not name issuer freeze powers or Optimism's single sequencer.",
              "checked_at": "2026-10-07",
              "quote": "Card payments and transfers depend on third-party payment infrastructure",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens and the chain are enumerated in versioned config. USDC carries Circle's blacklist and pause powers, and Optimism runs a single sequencer. Neither is stated to cardholders; the risks page stays generic. Enumerated in code, assumptions not stated = 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/10/0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0",
              "address": "0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0",
              "block_number": 157880645,
              "detail": "Sourcify v2 gives match (partial, not exact_match) for the proxies and current implementations of CashModule (impl 0xea20f2df...), RoleRegistry, SafeFactory, DataProvider, Hook, both settlement dispatchers, the Safe beacon, the Safe impl 0x79A6...397e and the upgrade timelock. Not on Sourcify: DebtManager impl 0xec2215..., CashEventEmitter impl 0xeffdcf... and the operating timelock, which are explorer-verified (Blockscout is_verified true).",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x000000000000000000000000ea20f2dfab46f80b75c12bf0795045aee1438b33"
              },
              "recheck": "curl -s https://sourcify.dev/server/v2/contract/10/0xea20f2dfab46f80b75c12bf0795045aee1438b33 | jq .match",
              "confirmed_at": "2026-10-12",
              "drift": true
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/scripts/VerifyOptimismProdBytecode.s.sol#L30-L40",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "scripts/VerifyOptimismProdBytecode.s.sol",
              "detail": "A Forge script redeploys each implementation locally with the production constructor args and compares the bytecode to OP mainnet.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every settlement-path contract is verified on Sourcify or the explorer, but the Sourcify results are partial matches, not exact ones, and three contracts are explorer-only. The repo ships bytecode-comparison scripts, which is close to the reproducible-build bar, but I did not run them. Partial match = 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/README.md#L12-L31",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "README.md",
              "detail": "cash-v3 holds the contracts, deploy scripts and audits. The 23 etherfi-protocol repos and the ether-fi org (0 public repos) include no Cash app, web frontend, SDK, backend, indexer or API schema.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Only the contracts and their deploy scripts are public. The app, web frontend, card backend, settlement bridger and indexer are closed, and no API schema is published. \"SDK or contracts only\" = 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/README.md#L32-L85",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "README.md",
              "detail": "The README gives env vars, forge test and a Setup.s.sol deploy command for the contracts. Addresses are in deployments/mainnet/<chain>/deployments.json.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Contract build and deploy docs exist; reproduction was not attempted. Blockers visible from the repo alone: a working card product also needs the closed app, the card backend, a BIN sponsor and an issuer, and none of these can be self-hosted.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/modules/cash/CashEventEmitter.sol#L52-L149",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/modules/cash/CashEventEmitter.sol",
              "detail": "Event definitions (WithdrawalRequested, WithdrawalProcessed, Spend, and others) and interfaces under src/interfaces are in source. No ABI JSON, API schema or export format is committed.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/cash-modules",
              "detail": "The hosted docs list CashModule write/read methods and events.",
              "checked_at": "2026-10-07",
              "quote": "Identifier of the bin sponsor (Rain or Reap)",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://help.ether.fi/en/articles/685844-how-to-download-your-card-transaction-history",
              "detail": "The help centre says cardholders can download card history as CSV from the closed app.",
              "checked_at": "2026-10-07",
              "quote": "is a CSV (.csv) file"
            }
          ],
          "finding": "Event schemas and interfaces exist in source, so ABIs can be rebuilt. The method reference lives only on the hosted docs. There is no API schema, and the only export is a cardholder CSV from the closed app, with no payee export. Judgment call: ABIs are derivable but not committed and the API schema is absent, so this does not reach 2; it is \"documented only\" = 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/README.md#L1-L31",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "README.md",
              "detail": "The tree at a5024d0 has no LICENSE or COPYING file (GitHub license API returns 404). Source files carry SPDX MIT headers (164 files), with BUSL-1.1 on 6 vendored files (Aave CAPO adapters, IStargate).",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/etherfi-protocol/cash-v3/license",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The only public repo has no LICENSE file. Per-file SPDX headers are MIT, except six vendored BUSL-1.1 files. Required components (app, card backend, Turnkey, issuer, Visa, KYC) are closed, so F1 is 0 regardless.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/README.md#L28-L85",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "README.md",
              "detail": "At a5024d0 the repo has no CLA, CONTRIBUTING, CLA workflow (only certora-prover, recovery-hash and test workflows) or license-stability statement, and LICENSE has no commit history.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/etherfi-protocol/cash-v3/git/trees/a5024d0b6e81ac0e6f40335a08f697fc7aafde52?recursive=1\" --jq '.tree[].path' | grep -iE '^(LICEN|CONTRIB|CLA)|workflows/'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no CLA and no commitment, so 2 under the anchor. Judgment call: with no LICENSE at all, \"relicensing\" adds little risk on top of the F1 gap. I found no prior relicense event.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/modules/cash/CashModuleCore.sol#L391-L407",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/modules/cash/CashModuleCore.sol",
              "detail": "Card spends only run through ether.fi wallet keys driven by its closed card backend.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international",
              "detail": "The card is issued by Third National under a Visa licence.",
              "checked_at": "2026-10-07",
              "quote": "issued by Third National pursuant to a license from Visa",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The core product, card payment, cannot run without ether.fi's proprietary backend and keys, the Turnkey signer, the issuer and Visa.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/privacy-policy",
              "detail": "The Privacy Policy lists collection of a device fingerprint, network telemetry, typing and swiping biometric data, and behavioural signals such as copy/paste and mouse movements. It also lists analytics and marketing cookies.",
              "checked_at": "2026-10-07",
              "quote": "typing and swiping biometric data",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The app and web frontend are closed, so their manifests cannot be inspected. The provider's own privacy policy, however, discloses device fingerprinting and behavioural biometrics. The anchor puts fingerprinting at 0 whether disclosed or not. No trace was run.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/privacy-policy",
              "detail": "Policy table maps KYC/AML data (identification, IP, geolocation, transaction data) to the legal-obligation basis; it also lists fraud and personalisation data (device data, fingerprint, behavioural biometrics) and marketing use, under the contract basis.",
              "checked_at": "2026-10-07",
              "quote": "Ensuring compliance with legal obligations, including Know-Your-Customer (KYC) and Anti-Money Laundering (AML) checks",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC is legally required for the card and is disclosed with its basis, but only in the hosted policy, not in code or a repo document. Collection also goes beyond the KYC requirement (behavioural biometrics, device fingerprint, marketing). Disclosed in policy only = 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/modules/cash/CashEventEmitter.sol#L149",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/modules/cash/CashEventEmitter.sol",
              "detail": "Spend emits safe, txId (indexed card-transaction id), binSponsor, tokens, amounts, USD amounts and mode. Cashback and ReferrerCashback events link safes to spender and referrer addresses.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/tx/0xdb50399e77874358090b384be2d0057478ad32a2c777a2a2eda922ef05b4f565",
              "address": "0x380B2e96799405be6e3D965f4044099891881acB",
              "block_number": 157880145,
              "detail": "The sample Spend log has safe 0x1DcE...3e76, txId 0x72cd6c00...f7d4, and USDT moving to SettlementDispatcherRain.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "No merchant or order data goes onchain. Every purchase is still a public event from a long-lived Safe, carrying a per-transaction card id, the BIN sponsor and USD amounts. Referral cashback events publicly link two users' Safes. Judgment call: the txId works like an invoice id that the issuer side can join to merchant data; it is disclosed in the docs' event list. Disclosed tags = 1, not 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/interfaces/ICashModule.sol#L55-L60",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/interfaces/ICashModule.sol",
              "detail": "BinSponsor enum names Reap, Rain, PIX and CardOrder; settlement dispatchers per sponsor are set only by the upgrade timelock.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/vault",
              "detail": "The docs name Turnkey as the signer that owns every Vault.",
              "checked_at": "2026-10-07",
              "quote": "Turnkey signer is automatically created for your account",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international",
              "detail": "Issuer Third National and Visa receive transaction and personal data under the cardholder agreement.",
              "checked_at": "2026-10-07",
              "quote": "issued by Third National pursuant to a license from Visa",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A card payment is seen by ether.fi's backend, Rain or Reap, Third National and Visa. Signing goes through Turnkey, and the KYC vendor is not named. These parties are disclosed in docs or code, but none can be swapped by the user. No trace was run. Present and disclosed, not swappable = 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/settlement-dispatcher/SettlementDispatcherV2.sol#L783-L787",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/settlement-dispatcher/SettlementDispatcherV2.sol",
              "detail": "The settlement dispatcher holds spent funds until bridged. withdrawFunds() lets ADMIN_TIMELOCK_ROLE (the 8 h operating timelock) send them to any recipient.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x50A233C4a0Bb1d7124b0224880037d35767a501C",
              "address": "0x50A233C4a0Bb1d7124b0224880037d35767a501C",
              "block_number": 157880645,
              "detail": "SettlementDispatcherRain is a UUPS proxy (implementation slot 0x759fdbf7...4097), upgradeable by the RoleRegistry owner (upgrade timelock 0x9106...4434).",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x000000000000000000000000759fdbf74f34f66e0d1991e6edf55d1b828a4097"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x1DcE164910A972F8AD755cb737E280143d593e76",
              "address": "0x1DcE164910A972F8AD755cb737E280143d593e76",
              "block_number": 157880645,
              "detail": "Sample Safe has 1 owner, EOA 0xcb99F1F2D80141A0c8672EB0F99e50019Bbab20D (the Turnkey key). Recovery signers are the ether.fi governance Safe and 0x4F5eB42edEce3285B97245f56b64598191b5A58E, threshold 2, recovery delay 259200 s.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x96a5d35b000000000000000000000000a6cf33124cb342d1c604cac87986b965f428aac4",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "At rest, funds sit in the user's beacon-proxy Safe. When a card payment is made they move to an ether.fi-controlled, upgradeable settlement dispatcher, which the operating timelock can drain to any address. This is a provider-held escrow disclosed in code, so 1. Judgment call: the dispatcher's redirect power reads like the 0 anchor, but the funds are already the card payment owed to the issuer; scored 1 for consistency with Gnosis Pay's settlement Safe. By default, ether.fi plus an ether.fi-chosen third party can also take over a Safe through recovery after 3 days, unless the owner cancels.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x5C1E3D653fcbC54Ae25c2AD9d59548D2082C687B",
              "address": "0x5C1E3D653fcbC54Ae25c2AD9d59548D2082C687B",
              "block_number": 157880645,
              "detail": "RoleRegistry owner() = upgrade timelock 0x9106...4434. That address is the sole upgrader for every UUPS proxy (RoleRegistry.onlyUpgrader L270-L272) and for the Safe beacon, via SafeFactory.upgradeBeaconImplementation. EIP-1967 admin slots are zero (UUPS).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000009106cd76e10ac60d1dd16144243416ebd2c64434"
              },
              "recheck": "cast call 0x5C1E3D653fcbC54Ae25c2AD9d59548D2082C687B \"owner()(address)\" --rpc-url https://mainnet.optimism.io --block 157880645",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x9106cD76E10Ac60D1dd16144243416EbD2C64434",
              "address": "0x9106cD76E10Ac60D1dd16144243416EbD2C64434",
              "block_number": 157880645,
              "detail": "getMinDelay() = 172800 s (2 days). The proposer is governance Safe 0xA6cf...AAC4, and the executor role is not open.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xf27a0c92",
                "expect": "0x000000000000000000000000000000000000000000000000000000000002a300"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0xA6cf33124cb342D1c604cAC87986B965F428AAC4",
              "address": "0xA6cf33124cb342D1c604cAC87986B965F428AAC4",
              "block_number": 157880645,
              "detail": "Governance Safe (Safe 1.4.1) has getThreshold() = 3 of 6 owners. getModulesPaginated(0x1,10) returns none, and the guard slot is zero. Three owners (0xE63794CF..., 0x566E58ac..., 0x5c8c76F2...) appear in ether.fi's published Ethereum signer list; 0x4024380A..., 0x781C3EF0... and 0xD3107493... are not disclosed anywhere I found.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000003"
              },
              "recheck": "cast call 0xA6cf33124cb342D1c604cAC87986B965F428AAC4 \"getModulesPaginated(address,uint256)(address[],address)\" 0x0000000000000000000000000000000000000001 10 --rpc-url https://mainnet.optimism.io --block 157880645; cast storage 0xA6cf33124cb342D1c604cAC87986B965F428AAC4 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8 --rpc-url https://mainnet.optimism.io --block 157880645",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x48e1630278D8310c86650405ebfbc110CdF3D1ec",
              "address": "0x48e1630278D8310c86650405ebfbc110CdF3D1ec",
              "block_number": 157880645,
              "detail": "All user Safes are beacon proxies of this beacon. implementation() = 0x79A6...397e, and owner() = EtherFiSafeFactory 0xF4e1...d8CF (so the upgrade timelock controls it).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x5c60da1b",
                "expect": "0x00000000000000000000000079a6d20280e4b564ea1d8f5369c6544887f7397e"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/data-provider/EtherFiDataProvider.sol#L220-L223",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/data-provider/EtherFiDataProvider.sol",
              "detail": "Default modules, which are enabled on every Safe (ModuleManager.sol L187-L191) and can call execTransactionFromModule, are set by ADMIN_TIMELOCK_ROLE, the operating timelock with getMinDelay() = 28800 s (8 h).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every contract, including every user Safe through the beacon, can be upgraded by a 2-day timelock fed by a 3-of-6 Safe with no modules or guard. Default modules that act on all Safes change behind an 8 h timelock. Both delays exceed the 10 s withdrawal delay (S4), but half the Safe signers are undisclosed and no notice channel is named in the repo. Multisig plus timelock, with undisclosed signers and no notice channel = 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0",
              "address": "0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0",
              "block_number": 157880645,
              "detail": "getData(0x1DcE...3e76) gives spendingLimit dailyLimit 100000e6 and monthlyLimit 1000000e6 (USD, 6 decimals). getDelays() = (10, 10, 10) s for withdrawal, spend-limit and mode changes.",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0 \"getDelays()(uint64,uint64,uint64)\" --rpc-url https://mainnet.optimism.io --block 157880645"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/modules/cash/CashModuleCore.sol#L409-L436",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/modules/cash/CashModuleCore.sol",
              "detail": "No ERC-20 approve is used. Each spend decrements the Safe's user-set daily and monthly limit, and funds go only to the settlement dispatcher for the chosen BIN sponsor.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no token approval. Instead, ether.fi's wallet role can pull up to a refilling daily/monthly limit that the user sets, routed only to the settlement dispatchers. Judgment call: this is bounded and narrowly routed but not exact-amount, so 2 (the bounded-allowance anchor). The sample limit ($100k/day) is high, and any default module can move Safe funds outside this limit.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/src/modules/cash/CashModuleSetters.sol#L248-L260",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "src/modules/cash/CashModuleSetters.sol",
              "detail": "requestWithdrawal is callable by anyone with Safe-owner signatures, is not whenNotPaused, and only allows whitelisted withdraw assets. processWithdrawal (CashModuleCore L309-L311) is open to anyone after the delay.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0xDC515Cb479a64552c5A11a57109C314E40A1A778",
              "address": "0xDC515Cb479a64552c5A11a57109C314E40A1A778",
              "block_number": 157880645,
              "detail": "getRecoveryDelayPeriod() = 259200 s (3 days). The withdrawal delay on CashModule is 10 s, and 27 OP tokens are whitelisted for withdrawal.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xd42de6a2",
                "expect": "0x000000000000000000000000000000000000000000000000000000000003f480"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/vault",
              "detail": "The Vault owner key is a Turnkey signer reached through ether.fi app login.",
              "checked_at": "2026-10-07",
              "quote": "Turnkey signer is automatically created for your account",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Chain of reasoning: by S1, funds at rest stay in the user's Safe. By C2 = 0 and C3 = 0, card settlement stops if ether.fi disappears. By O3 = 1, there is no self-hostable frontend. The contract withdrawal path exists in verified source and works while paused. But it needs a signature from the Turnkey-held owner key, which is reached through ether.fi's app, and I found no documented key export. ADMIN_ROLE can also de-list assets instantly. Judgment call: retrieval without ether.fi is a manual contract call that depends on getting the key out of Turnkey, so 1, not 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/tree/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit",
              "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
              "path": "audit",
              "detail": "30 audit PDFs (Certora, Paladin, Nethermind). The Certora \"Cash Module + Safe\" report scopes cash-v3 PR 3 (45dc3ee to d6aa4845, final 12cbd745e029d1941f6f60b8e4ad9ff3d2528d4a) and names a fix commit per finding (e.g. 34546ae, ef608f4); the SettlementDispatcherV2 report cites fix commit 54150cc.",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/etherfi-protocol/cash-v3/commits/12cbd745e029d1941f6f60b8e4ad9ff3d2528d4a --jq .sha"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/etherfi-protocol/cash-v3/tree/34546ae1136fbc2c175976d917084f771042a133/src",
              "commit": "34546ae1136fbc2c175976d917084f771042a133",
              "path": "src",
              "detail": "The fix commit cited for M-01 in the Cash Module + Safe audit exists in the repo, titled \"fix hooks == address(0) case and CONFIGURE_MODULE_TYPEHASH to include moduleSetupData\".",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/security/security-and-risks/audits",
              "detail": "The docs point to an Immunefi bounty for the protocol's contracts. The bounty scope is not in the cash-v3 repo.",
              "checked_at": "2026-10-07",
              "quote": "runs a public bug bounty on",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Audits are pinned to commits and name per-finding fix commits; a live bounty exists. Two things are missing for 3: the bounty scope is not in the repo, and the deployed implementations (Oct 2026) are far past the audited commits, with later modules covered by separate reports I did not map one by one. Lower anchor taken = 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The cardholder agreements (Inc. U.S. and International) say the card is issued by Third National under a licence from Visa, and that the issuer does not hold or control the user's wallet. For Nigeria the card is marketed by BANEX Microfinance Bank, licensed by the Central Bank of Nigeria. ether.fi's own risks page states that ether.fi is not a regulated financial institution and that card use is governed by the cardholder agreement and the issuer's terms (https://etherfi.gitbook.io/etherfi/resources/ether.fi-whitepaper/risks, https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international). I found no primary source stating Third National's regulator.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "AD",
          "AE",
          "AG",
          "AO",
          "AR",
          "AT",
          "AU",
          "BB",
          "BD",
          "BE",
          "BG",
          "BH",
          "BO",
          "BR",
          "BS",
          "BZ",
          "CH",
          "CL",
          "CO",
          "CR",
          "CZ",
          "DE",
          "DK",
          "DM",
          "DO",
          "EC",
          "ES",
          "FR",
          "GB",
          "GG",
          "GI",
          "GR",
          "GT",
          "GY",
          "HK",
          "HN",
          "HU",
          "ID",
          "IE",
          "IM",
          "IS",
          "IT",
          "JE",
          "JP",
          "KN",
          "KR",
          "KY",
          "LC",
          "LI",
          "LT",
          "LU",
          "LV",
          "MC",
          "MT",
          "MV",
          "MX",
          "MY",
          "NG",
          "NO",
          "NZ",
          "OM",
          "PA",
          "PE",
          "PH",
          "PL",
          "PR",
          "PT",
          "PW",
          "PY",
          "RO",
          "SA",
          "SC",
          "SE",
          "SG",
          "SI",
          "SK",
          "SR",
          "SV",
          "TC",
          "TH",
          "TT",
          "TW",
          "US",
          "UY",
          "VC",
          "VG",
          "VU",
          "ZA"
        ],
        "note": "The help-centre article lists 88 countries where a physical card is available, plus Belgium and Ireland (eligible, virtual card only) and the United States. The article says that if a jurisdiction is not listed, you cannot apply. In the US, physical cards are limited to 30 states and DC; US residents contract under the separate U.S. Cardholder Agreements. The documents disagree on three countries, and we take the more restrictive reading. Canada is on the help list, but the Terms of Use say the Services are not available to residents or citizens of Canada, so it is excluded. Croatia and Cyprus are on the help list but also on the Prohibited Activities List's \"may include\" list of prohibited jurisdictions, so they are excluded. The Prohibited Activities List also bars Cuba, Iran, North Korea, Syria and the Crimea, Donetsk and Luhansk regions of Ukraine; none of these is on the allowlist. The International Cardholder Agreements name no countries.",
        "evidence": [
          {
            "tier": "claimed",
            "by": "provider",
            "kind": "document",
            "url": "https://help.ether.fi/en/articles/758780-in-which-countries-is-the-cash-card-available",
            "archive": "data/archive/etherfi-cash-card-countries.txt",
            "detail": "Help-centre article \"In which countries is the Cash card available?\" lists 88 physical-card countries, Belgium and Ireland as virtual-only, and the US states with physical cards.",
            "checked_at": "2026-10-09",
            "quote": "If your jurisdiction is not listed, you will not be able to apply for a Cash card at this time.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/terms-of-use",
            "archive": "data/archive/etherfi-cash-terms-of-use.txt",
            "detail": "Terms of Use section 1(c) exclude residents or citizens of Canada and of any Restricted Jurisdiction (UN-sanctioned, or where use would be illegal), and allow US residents to use Cash under the U.S. Cardholder Agreements.",
            "checked_at": "2026-10-09",
            "quote": "Specifically, these Services are not available to residents or citizens of Canada or any Restricted Jurisdiction",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-prohibited-activities-list",
            "archive": "data/archive/etherfi-cash-prohibited-activities.txt",
            "detail": "Prohibited Activities List (Jurisdictional Restrictions) bars Cuba, Iran, North Korea, Syria and the Crimea, Donetsk and Luhansk regions, and says prohibited jurisdictions may include 30 named countries, among them Croatia and Cyprus.",
            "checked_at": "2026-10-09",
            "quote": "The Crimea, Donetsk, and Luhansk regions of Ukraine",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Scored the Optimism core-chain deployment from cash-v3 at a5024d0 (2026-10-05); onchain reads are pinned to OP block 157880645, with a sample spend at 157880145. www.ether.fi sits behind a Vercel bot checkpoint (HTTP 429 to curl), so website and legal citations use ether.fi's GitBook (etherfi.gitbook.io), which serves the same Terms, Privacy Policy and cardholder agreements. The ether.fi app, card backend and Turnkey integration are closed, so P5 and S5 are unknown.",
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "chain_id": 10,
            "address": "0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85"
          },
          {
            "symbol": "USDT",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Tether",
            "chain_id": 10,
            "address": "0x94b008aA00579c1307B0EF2c499aD98a8ce58e58"
          },
          {
            "symbol": "EURC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "chain_id": 10
          }
        ],
        "conversion": "at_spend",
        "note": "The card spends from the user's own Safe on Optimism. In debit mode it transfers a spendable stablecoin; in credit mode it borrows one stablecoin against collateral (weETH, WETH, ETHFI, liquid vault tokens and others) and the collateral itself is not spent. Each spend sends the token to a settlement dispatcher for the card issuer (Rain or Reap), which settles the network in fiat. The OP config's spend and borrow list also includes frxUSD and three ether.fi Liquid vault tokens (liquidUSD, liquidReserve, liquidEUR); whether each is enabled under the current Aave v4 lending gateway was not read onchain, so only USDC, USDT and EURC are listed. The Terms name USDC as the borrowed asset, but the sample spend in C1 borrowed USDT, so no single default is marked. USDT is the bridged Tether token seen in that sample; the EURC contract address was not read.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/deployments/mainnet/10/config.json#L17-L46",
            "commit": "a5024d0b6e81ac0e6f40335a08f697fc7aafde52",
            "path": "deployments/mainnet/10/config.json",
            "detail": "The OP config lists borrowTokens usdc, fraxusd, liquidUsd, usdt, liquidReserve, eurc, liquidEUR; the legacy debit path reverts UnsupportedToken for any token that is not a borrow token (src/modules/cash/CashLendLib.sol).",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/terms-of-use",
            "archive": "data/archive/etherfi-cash-terms-of-use.txt",
            "detail": "The Terms say card purchases are funded from supported stablecoins in the user's non-custodial wallet, or by borrowing USDC against eligible crypto collateral.",
            "quote": "supported stablecoins, such as USDC, already held in your connected non-custodial wallet, or (2) using eligible crypto assets in their connected wallet as collateral to borrow USDC",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://explorer.optimism.io/tx/0xdb50399e77874358090b384be2d0057478ad32a2c777a2a2eda922ef05b4f565",
            "address": "0x94b008aA00579c1307B0EF2c499aD98a8ce58e58",
            "block_number": 157880145,
            "detail": "A sample card spend through CashModule.spend moved USDT (0x94b008aa...) through the lending spoke to SettlementDispatcherRain 0x50A233c4....",
            "checked_at": "2026-10-12"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "The audit/ folder of github.com/etherfi-protocol/cash-v3 at a5024d0 (26 PDFs: Certora and Paladin; the etherfi-protocol/cash-v2 repo holds the same set), the audits/ folder of the earlier etherfi-protocol/cash-contracts repo (Nethermind and Zellic), and ether.fi's audits page (etherfi.gitbook.io/etherfi/security/security-and-risks/audits), which points to the cash-v3 registry. The Zellic \"Cash contracts Pre-order Update\" draft (Sep 2024) covers the card pre-order NFT contract, not the payment path, so it is not listed. Staking-protocol audits (etherfi-protocol/smart-contracts) are out of scope. The Immunefi bug bounty is not an audit. Many Certora item reports are marked draft or internal in the committed PDF.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Certora",
            "date": "2026-09",
            "type": "review",
            "scope": "Item 21: MidasLiquifierModule (src/modules/etherfi/MidasLiquifierModule.sol).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20-%20Midas%20Liquifier.pdf",
            "commit": "8405b6ce",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "7 informational",
            "note": "Initial commit 29350aaf. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 17: role re-gating across modules (AcrossSwapModule, CashbackDispatcher, EtherFiDataProvider, DebtManagerAdmin, DebtManagerStorageContract, EnsoSwapModule and other modules).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20-%20Role%20Re-gating%20%28Item%2017%29.pdf",
            "commit": "2aed606ac4",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 low, 8 informational",
            "note": "Initial commit 18f224a108. Report header dated August 2026; committed to cash-v3 on 2026-09-29."
          },
          {
            "auditor": "Certora",
            "date": "2026-09",
            "type": "review",
            "scope": "Item 22: TradingSafeLiquidDepositModule (mainnet Liquid deposit from the trading Safe).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/ether.fi%20-%20certora%20-%20mainnet%20liquid%20deposit.pdf",
            "commit": "65bc80ec1",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 informational",
            "note": "Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 18: CashbackDistributor (src/cashback-distributor/CashbackDistributor.sol).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20-%20Cashback%20Distributor.pdf",
            "commit": "0dda38da",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 medium (awardStaked approves ETHFI to the wrong address), fixed",
            "note": "Initial commit 0058252b. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 15: Safe WETH wrap and ERC-1271 support (SafeErc1271Lib, EtherFiSafe, EtherFiSafeErrors, MultiSig), the user Safe implementation.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20-%20Safe%20WETH%20Wrap%20%2B%20ERC1271.pdf",
            "commit": "27385346",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "6 informational",
            "note": "Initial commit 56719bb523. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 16: Stargate taxi mode (StargateModule, SettlementDispatcherV2, StargateAdapter).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20-%20Stargate%20Taxi.pdf",
            "commit": "02993649",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 informational",
            "note": "Initial commit 3603a691. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 14: wrapStocks in TopUp and TopUpFactory.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20-%20Wrap%20Stocks.pdf",
            "commit": "db2a2113",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 informational",
            "note": "Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 11: CCTPModule (src/modules/cctp/CCTPModule.sol).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20-%20CCTP%20Module.pdf",
            "commit": "dd7b4cac74",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "7 informational",
            "note": "Initial commit ccb8fe30f3. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 13: stock wrap on top-up redirect (TopUp, TopUpFactory).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora_StockWrapOnTopUpRedirect.pdf",
            "commit": "aa27177e",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 informational",
            "note": "Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 10: StockWithdrawModule, StockUnwrapper and StockOFTBridgeAdapter.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20StockWithdrawModule%2BStockTopupAdapter.pdf",
            "commit": "17ccfc063",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "6 informational",
            "note": "Initial commit 0b4c8da3f. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 8: TradingSafeWithdrawModule.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi_Q2%20-%20Item%208%20-%20Final.pdf",
            "commit": "72d0ae3e14",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "2 informational",
            "note": "Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08",
            "type": "review",
            "scope": "Item 9: EnsoSwapModule.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi_Q2%20-%20Item%209%20-%20Final.pdf",
            "commit": "90e68688",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 informational",
            "note": "Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-08-04",
            "type": "audit",
            "scope": "EtherFi Lend: lend-gateway module and related contracts (cash-v3 PR 153 and the PR 261 follow-up); reviewed 2026-07-20 to 2026-08-04.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora-Lend.pdf",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 medium, 8 low, 9 informational",
            "note": "Draft report as committed. Lend is the borrowing path card spends can draw on."
          },
          {
            "auditor": "Paladin",
            "date": "2026-07-28",
            "type": "audit",
            "scope": "Aave v4 price feeds: BaseAaveV4PriceFeed, StablePriceLib, ChainlinkPriceFeed, PythPriceFeed, VedaAccountantPriceFeed and OracleSinkPriceFeed on Optimism.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Paladin%20-%20Aave%20v4%20Price%20Feeds.pdf",
            "commit": "3c932071c6d9930e71d46caad023e2700487e15f",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "yes",
            "findings": "5 informational: 2 resolved, 1 partly resolved, 2 acknowledged",
            "note": "Resolution commit ac70926. The report marks the Chainlink, Pyth and Veda feeds as matching live code on Optimism; OracleSinkPriceFeed was not deployed. We did not re-check the live bytecode."
          },
          {
            "auditor": "Certora",
            "date": "2026-07",
            "type": "review",
            "scope": "Item 6: Trade and Hold (EtherFiDataProvider, AcrossSwapModule, EnsoSwapModule, OwnershipBridge sender, receiver and library, EtherFiSafe and related contracts).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/TherFi_Q2_-_Trade_and_Hold_Report.pdf",
            "commit": "ac86bd70eb",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "7 medium, 7 low and informational findings",
            "note": "Initial commit edba2b91. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-06",
            "type": "review",
            "scope": "Items 3 and 4: SafeAssetRecoveryModule and its deploy script (cash-v3 PRs 132 and 136).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/Etherfi-Certora%20-%20Safe%20Asset%20Recovery%20Module.pdf",
            "commit": "f907a44c76",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 medium (fixed), 1 low, 4 informational",
            "note": "Initial commit 93ff2389. Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-06",
            "type": "review",
            "scope": "Item 2: SCR swap and SCRRecoveryModule.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/scr-swap-audit.pdf",
            "commit": "db245879",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "3 informational",
            "note": "Certora internal item report; dated from the report header (month) and the commit adding it to cash-v3."
          },
          {
            "auditor": "Certora",
            "date": "2026-02",
            "type": "review",
            "scope": "Item 9: SettlementDispatcherV2 (Frax redemption to USDC), the card settlement dispatcher.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-settlement-disptacherV2.pdf",
            "commit": "54150cc",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "7 informational",
            "note": "Initial commit e24c1c2. We did not check whether the SettlementDispatcherRain and Reap implementations on OP Mainnet were built from 54150cc."
          },
          {
            "auditor": "Certora",
            "date": "2025-11-28",
            "type": "review",
            "scope": "Cash Module combined report (bundle 11): Pix wallet auto top-up and SettlementDispatcherV2.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Bundle_11.pdf",
            "commit": "a643d24f2",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "3 informational (2 fixed)",
            "note": "Reviewed 2025-11-16 to 2025-11-28; SettlementDispatcherV2 at 6efc2b47d. Draft report as committed."
          },
          {
            "auditor": "Certora",
            "date": "2025-11-07",
            "type": "review",
            "scope": "beHYPE bridging contracts combined report (bundle 9): BeHYPE Scroll Staker and the BeHYPE staking module in cash-v3.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi_-_Bundle_9.pdf",
            "commit": "bdfb44f",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "3 high, 1 medium, 3 low, 2 informational; 8 of 9 fixed",
            "note": "Reviewed 2025-10-31 to 2025-11-07 across the cash-v3 and beHYPE repos. Staking module, not the card spend path."
          },
          {
            "auditor": "Certora",
            "date": "2025-10-08",
            "type": "review",
            "scope": "Bridging contracts combined report: weETH OFT role changes, beHYPE OFT contracts and the CCTP adapter in cash-v3.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20-%20CCTP%20Adapter.pdf",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "1 informational, fixed",
            "note": "Reviewed 2025-10-06 to 2025-10-08; only the CCTP adapter is cash-v3 code (commits 76f0ad to 3545ec, as abbreviated in the report)."
          },
          {
            "auditor": "Certora",
            "date": "2025-08",
            "type": "audit",
            "scope": "Canonical bridge support in cash-v3 (module-requested bridging through CashModule withdrawals).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/Etherfi-Certora%20-%20Canonical%20Bridge%20Support.pdf",
            "commit": "a9abc1838458339eff8689eea4b57cab41c0060b",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "2 high, 1 medium, 1 low, 4 informational",
            "note": "The report is undated in the extracted text; the date is when it was committed (2025-08-08)."
          },
          {
            "auditor": "Certora",
            "date": "2025-06",
            "type": "audit",
            "scope": "Cash Module combined report, April-June 2025: Liquid minting and staking module, default module changes, top-up indexing, multi spend and referrals, WETH top-ups, multiple settlement dispatchers, Stargate bridge module, Aave module, NTT bridge adapter and later items.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/EtherFi-Certora%20-%20Combined.pdf",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "unknown",
            "findings": "Per-section findings up to high severity (one H-01 among the sections)",
            "note": "The report's scope table gives no commit hashes. Draft report as committed (2025-06-24)."
          },
          {
            "auditor": "Certora",
            "date": "2025-03-26",
            "type": "audit",
            "scope": "Safe Recovery Manager (cash-v3 PR 5): recovery feature added to the Safe, EtherFiDataProvider, EtherFiHook, IEtherFiSafe, IModule, OpenOceanSwapModule and related contracts.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/Etherfi-Certora%20-%20Recovery%20Manager.pdf",
            "commit": "df6d6c59",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "partly",
            "findings": "1 critical (single Safe admin can drain the Safe), 4 medium; all fixed",
            "note": "Audit start 2b37e643, last reviewed 6bc9436. The recovery code is in the deployed Safe lineage, but the deployed implementations are far past this commit (S6)."
          },
          {
            "auditor": "Certora",
            "date": "2025-03-20",
            "type": "audit",
            "scope": "Cash Module + Safe (cash-v3 PR 3): BeaconFactory, CashbackDispatcher, EtherFiDataProvider, DebtManager, CashModule, EtherFiSafe, EtherFiHook, settlement dispatcher and related core contracts.",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/Etherfi-Certora%20-%20Cash%20Module%20%2B%20Safe.pdf",
            "commit": "d6aa4845",
            "repo": "https://github.com/etherfi-protocol/cash-v3",
            "covers_deployed": "partly",
            "findings": "2 critical, 2 high, 6 medium, 6 low; 14 of 16 fixed, each with a fix commit",
            "note": "Audit start 45dc3ee, final 12cbd745. This is the core of the deployed system, but the OP Mainnet implementations (Oct 2026) are far past the audited commit (S6)."
          },
          {
            "auditor": "Certora",
            "date": "2025-03-03",
            "type": "audit",
            "scope": "EtherFi TopUp contracts in cash-v2 (src/*, excluding mocks and the bridge adapters).",
            "url": "https://github.com/etherfi-protocol/cash-v3/blob/a5024d0b6e81ac0e6f40335a08f697fc7aafde52/audit/top_up_certora.pdf",
            "commit": "c0ae4e5d286df90bdd612a532eeab313532eb6c2",
            "repo": "https://github.com/etherfi-protocol/cash-v2",
            "covers_deployed": "unknown",
            "findings": "1 medium (CREATE3 on zkSync, unconfirmed), 3 low, 7 informational",
            "note": "Reviewed 2025-02-24 to 2025-03-03 on the cash-v2 dev branch; the top-up contracts later moved into cash-v3."
          },
          {
            "auditor": "Nethermind",
            "date": "2024-12-13",
            "type": "review",
            "scope": "NM-0394 EtherFi Cashback: UserSafe, L2DebtManager and CashbackDispatcher in the earlier Cash contracts (Scroll).",
            "url": "https://github.com/etherfi-protocol/cash-contracts/blob/c270e3b0f1606ecfaf6ba958068cb920b367f7f6/audits/NM_0289_EtherFi_Cash_Contracts_Report.pdf",
            "repo": "https://github.com/etherfi-protocol/cash-contracts",
            "covers_deployed": "no",
            "findings": "1 high, 1 medium, 7 low, 7 informational, 5 best practices; 12 fixed, 9 acknowledged, 1 unresolved",
            "note": "The file is named NM_0289 but the report is NM-0394. Covers the pre-cash-v3 contracts, replaced by the cash-v3 Safes on OP Mainnet."
          },
          {
            "auditor": "Nethermind",
            "date": "2024-11-21",
            "type": "review",
            "scope": "NM-0381 EtherFi CashSafe top-up mechanism and UserSafe spending-limit changes in the earlier Cash contracts.",
            "url": "https://github.com/etherfi-protocol/cash-contracts/blob/c270e3b0f1606ecfaf6ba958068cb920b367f7f6/audits/NM_0381_EtherFi_Cash_TopUps_FINAL.pdf",
            "repo": "https://github.com/etherfi-protocol/cash-contracts",
            "covers_deployed": "no",
            "findings": "6 low, 4 informational, 1 best practices; 6 fixed, 5 acknowledged",
            "note": "Covers the pre-cash-v3 contracts."
          },
          {
            "auditor": "Nethermind",
            "date": "2024-09-23",
            "type": "review",
            "scope": "NM-0289 EtherFi Cash: UserSafe funds management and L2DebtManager loans in the earlier Cash contracts.",
            "url": "https://github.com/etherfi-protocol/cash-contracts/blob/c270e3b0f1606ecfaf6ba958068cb920b367f7f6/audits/Cash%20Audit%20Report.pdf",
            "repo": "https://github.com/etherfi-protocol/cash-contracts",
            "covers_deployed": "no",
            "findings": "5 critical, 2 high, 11 medium, 7 low, 11 informational, 2 best practices; 25 fixed, 6 acknowledged, 4 mitigated, 3 unresolved",
            "note": "Initial report 2024-09-18. Covers the pre-cash-v3 contracts."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S5"
          ]
        }
      },
      "tally": {
        "holds": 5,
        "short": 15,
        "unk": 3,
        "total": 23
      }
    },
    {
      "slug": "exa-card",
      "name": "Exa Card",
      "type": "card",
      "website": "https://www.exactly.app",
      "primary_chain": {
        "name": "OP Mainnet",
        "chain_id": 10,
        "basis": "Production app builds default to Optimism (exactly/exa 4fba32b, common/wagmi.config.ts#L18: CHAIN_ID falls back to optimism.id for EAS builds), and the Exa help center says the protocol behind the card \"works on Optimism\". Unit: the ExaPlugin, IssuerChecker and ProposalManager deployed by contracts/broadcast/*/10/run-latest.json at commit aceb1b5 (Sourcify exact match), the exaUSDC market they settle from, and a live collectDebit at block 157882808. Excluded: the Base deployment and its Firewall-gated markets, Exa Business, and ramp partners."
      },
      "repos": [
        {
          "url": "https://github.com/exactly/exa",
          "role": "backend",
          "license": "none"
        },
        {
          "url": "https://github.com/exactly/webauthn-owner-plugin",
          "role": "contracts",
          "license": "GPL-3.0"
        },
        {
          "url": "https://github.com/exactly/protocol",
          "role": "contracts",
          "license": "BUSL-1.1"
        },
        {
          "url": "https://github.com/exactly/docs",
          "role": "docs",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e",
          "chain_id": 10,
          "role": "ExaPlugin (ERC-6900 account plugin), non-upgradeable",
          "verified": "sourcify"
        },
        {
          "address": "0x59A644E490E48235adF8ba9b814A4f666C4fEb3A",
          "chain_id": 10,
          "role": "IssuerChecker (Exa issuer signature check)",
          "verified": "sourcify"
        },
        {
          "address": "0x6817974CA2c354F2FA40d8349b725B5bF81c8338",
          "chain_id": 10,
          "role": "ProposalManager (60 s delay on user withdrawals)",
          "verified": "sourcify"
        },
        {
          "address": "0xd5f8C9D87b7691449dEc453d041D9054e0Fdd228",
          "chain_id": 10,
          "role": "Refunder",
          "verified": "sourcify"
        },
        {
          "address": "0x6926B434CCe9b5b7966aE1BfEef6D0A7DCF3A8bb",
          "chain_id": 10,
          "role": "Exactly exaUSDC market (TransparentUpgradeableProxy)",
          "verified": "sourcify"
        },
        {
          "address": "0x3a73880ff21ABf9cA9F80B293570a3cBD846eFc5",
          "chain_id": 10,
          "role": "Card collector, Rain collateral BeaconProxy",
          "verified": "none"
        },
        {
          "address": "0xD71Fd74187f81a42e322E0A33945F9C263E37624",
          "chain_id": 10,
          "role": "RainCollateral implementation behind the collector beacon",
          "verified": "sourcify"
        },
        {
          "address": "0x6561b09d5d6012D416dfDf9BeFe37228Ae89434C",
          "chain_id": 10,
          "role": "Exa contracts admin, Safe 1.4.1 3-of-4",
          "verified": "none"
        },
        {
          "address": "0xC0d6Bc5d052d1e74523AD79dD5A954276c9286D3",
          "chain_id": 10,
          "role": "Exactly Safe 3-of-6 (PAUSER_ROLE, timelock proposer)",
          "verified": "none"
        },
        {
          "address": "0x92024C4bDa9DA602b711B9AbB610d072018eb58b",
          "chain_id": 10,
          "role": "TimelockController (1 day) owning the market ProxyAdmin",
          "verified": "sourcify"
        },
        {
          "address": "0x8cC05394eD714073758E9bEf8073a83d79F6F2A3",
          "chain_id": 10,
          "role": "Exactly Pauser (EMERGENCY_ADMIN_ROLE), owned by an EOA",
          "verified": "sourcify"
        },
        {
          "address": "0x8f498c8240E621f8050249D1C2F5f2AAeE484ca0",
          "chain_id": 10,
          "role": "WebauthnOwnerPlugin (passkey owner of each account)",
          "verified": "sourcify"
        },
        {
          "address": "0x973ccce386F99bd7a32Eec2DF192A030d8f214b8",
          "chain_id": 10,
          "role": "Sample user account (ERC-1967 proxy, modular account)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "User's modular smart account (Alchemy UpgradeableModularAccount v1)",
          "role": "wallet",
          "public": true,
          "license": "GPL-3.0",
          "operator": "User (passkey owner via WebauthnOwnerPlugin)",
          "required": true,
          "repo": "https://github.com/alchemyplatform/modular-account"
        },
        {
          "name": "WebauthnOwnerPlugin",
          "role": "contracts",
          "public": true,
          "license": "GPL-3.0",
          "operator": "Exa Labs (code); user (owner)",
          "required": true,
          "repo": "https://github.com/exactly/webauthn-owner-plugin"
        },
        {
          "name": "ExaPlugin, IssuerChecker and ProposalManager",
          "role": "contracts",
          "public": true,
          "license": "GPL-3.0",
          "operator": "Exa Labs (admin Safe 0x6561...434C)",
          "required": true,
          "repo": "https://github.com/exactly/exa"
        },
        {
          "name": "Exactly Protocol exaUSDC market (card collateral and credit)",
          "role": "contracts",
          "public": true,
          "license": "source-available",
          "operator": "Exactly (timelock, protocol Safe, Pauser)",
          "required": true,
          "repo": "https://github.com/exactly/protocol"
        },
        {
          "name": "USDC (Circle) on OP Mainnet",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Circle",
          "required": true
        },
        {
          "name": "Exa server (card authorisation webhooks, KYC orchestration, collection signing)",
          "role": "backend",
          "public": true,
          "license": "none",
          "operator": "Exa Labs",
          "required": true,
          "repo": "https://github.com/exactly/exa"
        },
        {
          "name": "Keeper EOA and issuer signing key",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Exa Labs",
          "required": true
        },
        {
          "name": "Card collector (Rain collateral BeaconProxy; implementation RainCollateral)",
          "role": "contracts",
          "public": true,
          "license": "none",
          "operator": "Rain (beacon owner Safe 0x6454...Bf15, 2-of-5)",
          "required": true
        },
        {
          "name": "Rain (card program and issuing API, \"panda\" in code)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Rain",
          "required": true
        },
        {
          "name": "Third National (card issuer)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Third National",
          "required": true
        },
        {
          "name": "Visa (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Persona (KYC)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Persona",
          "required": true
        },
        {
          "name": "Sardine (transaction risk scoring in card authorisation)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Sardine",
          "required": true
        },
        {
          "name": "Exa App (mobile and web frontend)",
          "role": "frontend",
          "public": true,
          "license": "none",
          "operator": "Exa Labs",
          "required": false,
          "repo": "https://github.com/exactly/exa"
        },
        {
          "name": "Alchemy (RPC, bundler, gas manager for the app)",
          "role": "bundler",
          "public": false,
          "license": "proprietary",
          "operator": "Alchemy",
          "required": false
        },
        {
          "name": "Exa substreams indexer",
          "role": "indexer",
          "public": true,
          "license": "none",
          "operator": "Exa Labs",
          "required": false,
          "repo": "https://github.com/exactly/exa"
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/10/0x8cC05394eD714073758E9bEf8073a83d79F6F2A3",
              "address": "0x8cC05394eD714073758E9bEf8073a83d79F6F2A3",
              "block_number": 157885618,
              "detail": "The Exactly Pauser holds EMERGENCY_ADMIN_ROLE on exaUSDC; its pause() and pauseProtocol() are onlyOwner, and owner() is 0xEa2127b14D05229CB3d4b75b42052e556AB7391F (no code, nonce 0). A paused market blocks every withdraw, including card debits and user exits (Market.sol beforeWithdraw whenNotPaused).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000ea2127b14d05229cb3d4b75b42052e556ab7391f"
              },
              "recheck": "cast call 0x8cC05394eD714073758E9bEf8073a83d79F6F2A3 \"owner()(address)\" --rpc-url https://mainnet.optimism.io --block 157885618",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/10/0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e",
              "address": "0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e",
              "block_number": 157885618,
              "detail": "ExaPlugin hasRole(KEEPER_ROLE, 0xcDdB23654595C224A563f62943D9Ff189138c04e) = true. The keeper is an EOA (nonce 417500) and the only party allowed to call collectDebit/collectCredit on accounts.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d14854fc8737ab85eb45125971625a9ebdb75cc78e01d5c1fa80c4c6e5203f47bc4fab000000000000000000000000cddb23654595c224a563f62943d9ff189138c04e",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0xC0d6Bc5d052d1e74523AD79dD5A954276c9286D3",
              "address": "0xC0d6Bc5d052d1e74523AD79dD5A954276c9286D3",
              "block_number": 157885618,
              "detail": "The market's PAUSER_ROLE (pause and unpause) is held by Safe 1.3.0 0xC0d6Bc5d... with getThreshold() = 3 and 6 owners; no modules and a zero guard slot.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000003"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions",
              "detail": "The Exa Card terms let Exa Labs and the issuer block transactions and suspend account access.",
              "quote": "Exa Labs and Issuer reserve the right to block and terminate transactions and suspend access to your Account",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Three things can stop card settlement. A single EOA owns the Pauser, which can pause the exaUSDC market and so freeze every card debit and every user withdrawal, with no notice or timelock. Card collections run only through Exa's keeper EOA. The card terms let Exa and the issuer block transactions and suspend accounts. The longer-standing PAUSER_ROLE sits with a 3-of-6 Safe (undisclosed signers, no timelock). An EOA-held pause meets anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/aceb1b5be29a84cb2a37742e2204647d249443ab/contracts/src/ExaPlugin.sol#L203-L226",
              "commit": "aceb1b5be29a84cb2a37742e2204647d249443ab",
              "path": "contracts/src/ExaPlugin.sol",
              "detail": "collectCredit and collectDebit first call ISSUER_CHECKER.checkIssuer (an Exa issuer signature) and then withdraw or borrow to the collector. The manifest at L403 binds collectDebit to keeper-only runtime validation (L553-L560). This source is identical to the Sourcify exact match for 0x3d73D0fb....",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/tx/0x906cb58684b9445dcbad6ab80c636d1d65799110782a8a1f4fda96821976e79b",
              "address": "0x973ccce386F99bd7a32Eec2DF192A030d8f214b8",
              "block_number": 157882808,
              "detail": "A sample card debit. Keeper EOA 0xcDdB2365... called collectDebit (0x8980d703) on account 0x973ccce3...; IssuerChecker emitted Collected and exaUSDC emitted Withdraw to collector 0x3a73880f....",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Merchants are paid by Visa, Third National and Rain offchain. The only onchain step is a debit or borrow that needs both Exa's issuer signature and Exa's keeper. Neither payer nor payee can settle a card payment by calling the contracts.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/index.ts#L60-L82",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/index.ts",
              "detail": "The public server requires PANDA_API_KEY/URL (Rain issuing API), PERSONA_API_KEY/URL and SARDINE_API_KEY/URL to start.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/docs/blob/fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b/exa-app/the-exa-tech-stack.md#L18-L18",
              "commit": "fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b",
              "path": "exa-app/the-exa-tech-stack.md",
              "detail": "Exa's docs say KYC (Persona), card issuing (Rain) and support (Intercom) are integrated in the Exa App's backend.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Exa publishes its own backend, which is unusual for a card. A card payment still requires Rain's closed issuing platform, Third National and Visa, plus Exa's own keeper and issuer keys. The deployed IssuerChecker accepts only Exa's issuer key, so a self-hosted server could not settle against the deployed contracts. The required issuer path is closed and single-vendor, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/hooks/panda.ts#L188-L200",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/hooks/panda.ts",
              "detail": "Card authorisation calls Sardine risk scoring before approving. KYC goes through Persona. No sanctions list, list source or country blocklist is defined in the public code; screening happens inside those vendors and Rain.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions",
              "detail": "The card terms require that the cardholder is not blocked or sanctioned by the US Government, including OFAC listings.",
              "quote": "You are not a person who is blocked or sanctioned by the United States Government",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The Optimism settlement contracts (ExaPlugin and the standard exaUSDC market) have no address or country filter; the Firewall allowlist exists only on Base. Edge screening is disclosed in the terms, but it runs inside closed vendors with no named list source in code, and it cannot be bypassed because C2 = 0. Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/contracts/deploy.json#L84-L121",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "contracts/deploy.json",
              "detail": "The ProposalManager allowlist enumerates the OP Mainnet tokens the account can interact with. The card itself settles from the exaUSDC market (EXA_USDC immutable in ExaPlugin).",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://raw.githubusercontent.com/exactly/exa/4fba32be1803f15c0db9f39a055bda4740c1fdf1/contracts/deploy.json | sed -n 84,121p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85",
              "address": "0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85",
              "block_number": 157885618,
              "detail": "Native USDC on OP Mainnet has blacklister() 0x551e855b7355C98534175879A300972856C04D7C.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xbd102430",
                "expect": "0x000000000000000000000000551e855b7355c98534175879a300972856c04d7c"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/9071732-which-blockchain-does-exa-app-work-on",
              "detail": "The help article names Optimism and explains rollups, but says nothing about the sequencer, forced inclusion, or issuer freeze powers.",
              "quote": "works on Optimism",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Chain and tokens are enumerated in code. USDC carries a Circle blacklister, the exaUSDC market can be paused (C1), and OP Mainnet has a single sequencer. None of this is stated to cardholders in the help center or the terms I read. Enumerated in code, assumptions not stated, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/10/0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e",
              "address": "0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e",
              "block_number": 157885618,
              "detail": "Sourcify v2 returns exact_match for ExaPlugin, IssuerChecker, ProposalManager, Refunder, Pauser, WebauthnOwnerPlugin, the account implementation 0x00460000...a61e and the market proxy. It returns null for the exaUSDC implementation 0xEBd58C87... and for the collector proxy 0x3a73880f.... The collector is a BeaconProxy whose beacon is RainCollateralBeacon 0xE84110fF... (exact) and whose implementation is RainCollateral 0xD71Fd741... (exact).",
              "checked_at": "2026-10-07",
              "recheck": "for a in 0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e 0xEBd58C87A63689B9DEa6690aD76BDBCd44d9eB19 0x3a73880ff21ABf9cA9F80B293570a3cBD846eFc5; do curl -s https://sourcify.dev/server/v2/contract/10/$a | jq -r .match; done"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/aceb1b5be29a84cb2a37742e2204647d249443ab/contracts/broadcast/ExaPlugin.s.sol/10/run-latest.json",
              "commit": "aceb1b5be29a84cb2a37742e2204647d249443ab",
              "path": "contracts/broadcast/ExaPlugin.s.sol/10/run-latest.json",
              "detail": "The Foundry broadcast for the OP Mainnet deployment is committed, and ExaPlugin.sol at this commit matches the Sourcify source apart from a trailing newline.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Exa's own contracts and Rain's collateral beacon and implementation are exact matches, and Exa has a committed Foundry deploy. The exaUSDC market implementation that holds all card collateral is not on Sourcify, and the Optimism Blockscout API returned no verification record for it. Some settlement contracts are verified, so 1. Judgment call: the unverified market implementation sits in the settlement path, so I did not go higher.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/tree/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server",
              "detail": "The exa monorepo contains the backend (server/, with Dockerfile and deploy workflows), the mobile and web app (src/), contracts with deploy scripts and broadcasts (contracts/), and the substreams indexer (substreams/).",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/exactly/exa/git/trees/4fba32be1803f15c0db9f39a055bda4740c1fdf1 --jq '.tree[].path'"
            }
          ],
          "finding": "Exa's own stack is public: SDK and contracts, frontend, backend, indexer and deploy scripts. The closed parts are third parties (Rain, Third National, Visa, Persona, Sardine, Alchemy) and Exa's operating keys; they are scored under C3, F1 and F3. Judgment call: O2 counts what the provider runs, and all of that is published.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/README.md#L1-L50",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "README.md",
              "detail": "The README lists toolchain requirements and install, run and e2e commands for the app, and links to the server and contracts.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Build docs exist. Reproduction not attempted. Visible blockers: the server needs Rain, Persona and Sardine API keys, and a working card needs an issuer key that the deployed IssuerChecker accepts.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/script/openapi.ts#L1-L40",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/script/openapi.ts",
              "detail": "An OpenAPI spec is generated from the server routes (hono-openapi generateSpecs).",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://raw.githubusercontent.com/exactly/exa/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/script/openapi.ts | sed -n 1,40p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/aceb1b5be29a84cb2a37742e2204647d249443ab/contracts/src/IssuerChecker.sol#L114-L122",
              "commit": "aceb1b5be29a84cb2a37742e2204647d249443ab",
              "path": "contracts/src/IssuerChecker.sol",
              "detail": "Event schemas (Collected, Refunded, IssuerSet...) are in the contract source; ABIs come from the Foundry build.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "ABIs, events and an API schema generator are versioned with the code. The cardholder export is a PDF statement (server/api/activity.ts); there is no payee export, since merchants are paid through Visa. Judgment call: the API schema is generated rather than committed, and there is no payee export, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/README.md#L1-L50",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "README.md",
              "detail": "The exa monorepo has no LICENSE file at the root or in any package, and the package.json files have no license field. Contract files carry SPDX GPL-3.0 headers only. GitHub reports no license.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/protocol/blob/0d1ca2a6b753f40c4a0c5a442ee25246122594f7/LICENSE#L1-L22",
              "commit": "0d1ca2a6b753f40c4a0c5a442ee25246122594f7",
              "path": "LICENSE",
              "detail": "Exactly Protocol (the exaUSDC market) is under BUSL-1.1, changing to GPL-3.0-or-later two years after each release.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The backend and app repo has no license. The market contracts are source-available (BUSL-1.1). The issuer, network and Rain are closed. Closed required components alone set F1 to 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/tree/4fba32be1803f15c0db9f39a055bda4740c1fdf1/.github/workflows",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": ".github/workflows",
              "detail": "There is no CLA workflow, no CONTRIBUTING file or license-stability commitment, and the LICENSE path has no history (gh api 'repos/exactly/exa/commits?path=LICENSE' returns none).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "There is no CLA, but there is also no license, so Exa Labs holds every right in its code and can license future versions however it likes. Judgment call: the anchors assume a license exists. \"No CLA, no commitment\" (2) would credit stability that an unlicensed repo does not have, so I took the lower anchor, 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/index.ts#L60-L82",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/index.ts",
              "detail": "The server will not start without Rain (panda), Persona and Sardine credentials.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card cannot run without Rain's issuing platform, the issuer and Visa, and Persona and Sardine. These are hosted-only proprietary services.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/src/utils/segment.ts#L11-L30",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "src/utils/segment.ts",
              "detail": "The web app loads Segment with hardcoded write keys per domain, with no consent check, and identify() sends the account address. package.json also ships @sentry/react-native, @sentry/browser, Intercom, OneSignal and expo-insights.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/9945134-privacy-policy",
              "detail": "The privacy policy discloses usage analytics, including third-party analysis.",
              "quote": "we analyze (and may engage third parties to analyze) this information",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics (Segment, keyed to the wallet address) and error reporting (Sentry) are on by default, with no opt-in in code. The privacy policy discloses analytics in general terms. Present, on by default, disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/9945134-privacy-policy",
              "detail": "The privacy policy lists the KYC data collected through Persona, including ID document, photo and biometric face scans, plus IP and wallet address.",
              "quote": "identification document information, personal photo, biometric face scans",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/docs/blob/fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b/exa-app/credit-and-debit-modes.md#L11-L11",
              "commit": "fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b",
              "path": "exa-app/credit-and-debit-modes.md",
              "detail": "Exa's docs repo says KYC is required to comply with Visa regulations.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Full KYC, including biometrics, is collected for the card. The basis is given only loosely (\"Visa regulations\") in a versioned doc, and the field list is disclosed in the privacy policy. Collection goes well beyond settlement needs. Judgment call: a stated basis without a field-level limit to the legal requirement does not reach 2, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/tx/0x906cb58684b9445dcbad6ab80c636d1d65799110782a8a1f4fda96821976e79b",
              "address": "0x59A644E490E48235adF8ba9b814A4f666C4fEb3A",
              "block_number": 157882808,
              "detail": "A card debit emits IssuerChecker Collected(account, amount, timestamp) and an exaUSDC Withdraw to the collector. No merchant or order data is emitted.",
              "checked_at": "2026-10-07",
              "recheck": "cast receipt 0x906cb58684b9445dcbad6ab80c636d1d65799110782a8a1f4fda96821976e79b --rpc-url https://mainnet.optimism.io"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/docs/blob/fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b/exa-app/exa-plugin.md#L42-L72",
              "commit": "fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b",
              "path": "exa-app/exa-plugin.md",
              "detail": "The docs describe the keeper-run collectDebit and collectCredit and the IssuerChecker that signs them.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card spend is publicly tied to the user's long-lived Exa account (amount and time), and the Collected event marks the account as an Exa cardholder. No merchant data goes onchain, and there are no fresh addresses. Minimal linkage that is documented, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/hooks/panda.ts#L188-L200",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/hooks/panda.ts",
              "detail": "Each card authorisation is sent to Sardine for risk scoring and tracked to Segment (L816). Rain sends the authorisation webhook. The endpoints are env-set, but each integration is vendor-specific code.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/docs/blob/fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b/exa-app/the-exa-tech-stack.md#L18-L18",
              "commit": "fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b",
              "path": "exa-app/the-exa-tech-stack.md",
              "detail": "Persona, Rain and Intercom are named in the docs.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payment is seen by Rain, Third National, Visa, Sardine and Segment, plus Alchemy on the app side. All of them are named in public code or docs, but none can be swapped without code changes. No trace was run. Judgment call: named in code (2) but not swappable by config (1); I took the lower anchor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/common/alchemyAPIKey.ts#L5-L15",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "common/alchemyAPIKey.ts",
              "detail": "The app reads through Alchemy (src/utils/publicClient.ts#L7-L10), with per-chain keys hardcoded and an env override for the key only. The RPC vendor is fixed in code.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The RPC endpoint is fixed to Alchemy; only the key can be overridden at build time. The indexer (substreams) is public, but users cannot point the app at their own endpoints. Judgment call: changing the key is not changing the endpoint, so this is \"hardcoded\" (0).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/aceb1b5be29a84cb2a37742e2204647d249443ab/contracts/src/IssuerChecker.sol#L37-L71",
              "commit": "aceb1b5be29a84cb2a37742e2204647d249443ab",
              "path": "contracts/src/IssuerChecker.sol",
              "detail": "check() verifies only an Exa issuer signature over (account, amount, timestamp) with replay protection. There is no per-account limit and no user signature.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/10/0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e",
              "address": "0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e",
              "block_number": 157885618,
              "detail": "ExaPlugin collector() = 0x3a73880f...efc5, a BeaconProxy to RainCollateral whose beacon owner is Safe 0x6454cf01... (2-of-5). setCollector is DEFAULT_ADMIN_ROLE, held by Safe 0x6561b09d... (3-of-4, no modules, no guard, no timelock).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x913e77ad",
                "expect": "0x0000000000000000000000003a73880ff21abf9ca9f80b293570a3cbd846efc5"
              },
              "recheck": "cast call 0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e \"collector()(address)\" --rpc-url https://mainnet.optimism.io --block 157885618",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/10/0x59A644E490E48235adF8ba9b814A4f666C4fEb3A",
              "address": "0x59A644E490E48235adF8ba9b814A4f666C4fEb3A",
              "block_number": 157885618,
              "detail": "IssuerChecker issuer() = 0x3Ed5B7C4F0406b0D5afbe8ccFd1BD845f8F9D415, a key with no code and nonce 0 (a signing-only EOA).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x1d143848",
                "expect": "0x0000000000000000000000003ed5b7c4f0406b0d5afbe8ccfd1bd845f8f9d415"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "At rest, funds sit in the user's own account as exaUSDC shares in an upgradeable lending market. Exa's issuer key plus its keeper can debit any amount from any account to the collector without a user signature, and the admin Safe can repoint the collector without a timelock. Card debits land in Rain's upgradeable collateral contract (beacon owned by a 2-of-5 Safe). The provider can redirect funds, which meets anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0xfBa759BCd1a99a7724c5068FEddb4F5b844b941A",
              "address": "0xfBa759BCd1a99a7724c5068FEddb4F5b844b941A",
              "block_number": 157885618,
              "detail": "The exaUSDC proxy admin (EIP-1967 admin slot) is ProxyAdmin 0xfBa759BC..., whose owner() is TimelockController 0x92024C4b... (getMinDelay 86400 s). The timelock's PROPOSER_ROLE includes Safe 0xC0d6Bc5d... (3-of-6).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x00000000000000000000000092024c4bda9da602b711b9abb610d072018eb58b"
              },
              "recheck": "cast call 0x92024C4bDa9DA602b711B9AbB610d072018eb58b \"getMinDelay()(uint256)\" --rpc-url https://mainnet.optimism.io --block 157885618",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x6561b09d5d6012D416dfDf9BeFe37228Ae89434C",
              "address": "0x6561b09d5d6012D416dfDf9BeFe37228Ae89434C",
              "block_number": 157885618,
              "detail": "The ExaPlugin admin Safe has getThreshold() = 3 with 4 owners, no modules and no guard. Through setProposalManager, setSwapper, setFlashLoaner and allowPlugin it can replace, with no timelock, the contracts that gate every user withdrawal.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000003"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/aceb1b5be29a84cb2a37742e2204647d249443ab/contracts/src/ExaPlugin.sol#L308-L330",
              "commit": "aceb1b5be29a84cb2a37742e2204647d249443ab",
              "path": "contracts/src/ExaPlugin.sol",
              "detail": "The admin-only setters for flashLoaner, collector, proposalManager and swapper, and the plugin allowlist.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "ExaPlugin itself is immutable, and each account's implementation can be upgraded only by its owner. The market holding user funds is upgradeable behind a 1-day timelock driven by a 3-of-6 Safe, which on its own would score 2 (signers and notice channel undisclosed). The plugin admin, a 3-of-4 Safe with no timelock, can also swap the ProposalManager and swapper contracts that every withdrawal passes through, which amounts to changing the rules with no notice. Judgment call: that is \"multisig admin, no timelock\", so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/aceb1b5be29a84cb2a37742e2204647d249443ab/contracts/src/ExaPlugin.sol#L553-L565",
              "commit": "aceb1b5be29a84cb2a37742e2204647d249443ab",
              "path": "contracts/src/ExaPlugin.sol",
              "detail": "There is no ERC-20 approval. Instead, the installed plugin gives KEEPER_ROLE runtime validation over collectDebit, collectCredit and collectInstallments on every account, bounded only by the issuer signature and the account's balance or credit.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/docs/blob/fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b/exa-app/exa-plugin.md#L42-L72",
              "commit": "fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b",
              "path": "exa-app/exa-plugin.md",
              "detail": "The docs disclose the keeper's collect functions and the issuer's role.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card's spending authority is an unbounded keeper permission built into the account, not a capped allowance. It is disclosed in docs and code. Unbounded by default, disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/10/0x6817974CA2c354F2FA40d8349b725B5bF81c8338",
              "address": "0x6817974CA2c354F2FA40d8349b725B5bF81c8338",
              "block_number": 157885618,
              "detail": "ProposalManager delay() = 60 s (code caps it at 1 hour, L317-L318 at aceb1b5). A user proposes a withdrawal through propose (self-validated) and runs executeProposal after the delay; neither step needs the keeper.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x6a42b8f8",
                "expect": "0x000000000000000000000000000000000000000000000000000000000000003c"
              },
              "recheck": "cast call 0x6817974CA2c354F2FA40d8349b725B5bF81c8338 \"delay()(uint256)\" --rpc-url https://mainnet.optimism.io --block 157885618",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/address/0x973ccce386F99bd7a32Eec2DF192A030d8f214b8",
              "address": "0x973ccce386F99bd7a32Eec2DF192A030d8f214b8",
              "block_number": 157885618,
              "detail": "The sample account's installed plugins are ExaPlugin and WebauthnOwnerPlugin, and its implementation is UpgradeableModularAccount 0x00460000...a61e (Sourcify exact). Only the user's passkey owns it.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Chain of reasoning. By S1, funds sit in the user's own account, though in an upgradeable, pausable market. By the evidence above, the user can withdraw through a verified two-step path after 60 s without Exa's keeper, using any ERC-4337 bundler and the public app source. By C2 = 0 and C3 = 0, card settlement stops without Exa. By O3 = 1, self-hosting is unproven. Caveats: a market pause (C1) would block the exit, and the admin can swap the ProposalManager (S2). Funds retained and retrievable, settlement stops, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/hooks/panda.ts#L109-L118",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/hooks/panda.ts",
              "detail": "Card webhooks are verified with HMAC-SHA256 and timingSafeEqual (server/utils/verifySignature.ts#L9-L15) against a comma-separated key list, so keys can rotate. Persona webhooks need PERSONA_WEBHOOK_SECRET.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://raw.githubusercontent.com/exactly/exa/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/utils/verifySignature.ts",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/common/alchemyAPIKey.ts#L5-L15",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "common/alchemyAPIKey.ts",
              "detail": "The client bundle ships Alchemy keys and Segment write keys (src/utils/segment.ts#L11-L18). Both are publishable client identifiers; Rain, Persona and Sardine secrets stay server-side.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No issuing or KYC secrets are in the client, and webhooks are signature-verified with rotation support. The client ships publishable Alchemy and Segment keys, which authorise metered RPC use and analytics writes. Judgment call: minor, so 2. A 3 is not possible while required components are closed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Quantstamp%20Exa%20App%20Plugin%20(Mar-25).pdf",
              "detail": "The Quantstamp ExaPlugin audit (Mar 2025) reports 11 findings, all fixed, each with an \"Addressed in\" commit, and a fix review ending at commit 368df25.",
              "quote": "The fix-review process went through four rounds in total, concluding at 368df25.",
              "archive": "data/archive/exa-card-quantstamp-plugin-mar25.txt",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/aceb1b5be29a84cb2a37742e2204647d249443ab/contracts/src/ExaPlugin.sol#L1-L5",
              "commit": "aceb1b5be29a84cb2a37742e2204647d249443ab",
              "path": "contracts/src/ExaPlugin.sol",
              "detail": "The deployed source (aceb1b5) is 23 commits after 368df25, and ExaPlugin.sol changed in between (gh api repos/exactly/exa/compare/368df25...aceb1b5). The Oct-25 update audit covers later code that is not deployed on OP Mainnet.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Audits exist, with pinned commits and per-finding fix commits, but the deployed OP Mainnet plugin is not the audited commit. I found no bug bounty in any exactly repo. Judgment call: an audit of a neighbouring version does not cover the deployed contract, so this is held at \"audit report only\" (1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The Exa Card terms name Third National as issuer of the card program, \"issued by the Issuer under license from Visa\" (https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions). The help center says the card is issued in the United States and gives a legal address \"provided by Rain\" (https://help.exactly.app/en/articles/10209480-where-is-the-exa-card-issued). The app operator is EXA LABS S.A.S., incorporated in Uruguay (app terms and privacy policy), and the app terms let it suspend or terminate access with or without notice. Card terms for US citizens and Exa Business cards are separate documents, not assessed.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "AE",
          "AG",
          "AR",
          "AU",
          "BB",
          "BO",
          "BR",
          "BS",
          "BZ",
          "CI",
          "CO",
          "CR",
          "DO",
          "GD",
          "GH",
          "GY",
          "HN",
          "JP",
          "KE",
          "KN",
          "KY",
          "LC",
          "MA",
          "MX",
          "MY",
          "NZ",
          "PA",
          "PE",
          "PH",
          "PK",
          "PY",
          "SG",
          "SN",
          "SR",
          "TC",
          "TT",
          "UG",
          "UY",
          "VC",
          "ZA",
          "ZM"
        ],
        "note": "The help-centre article \"Card availability and usage\" lists 46 countries and 31 US states where the card can be issued. Exa's documents disagree on six of these, and we take the more restrictive reading. Nigeria is listed as eligible \"with conditional approval\" but is on the separate List of prohibited countries (2026-01-15). Ecuador, El Salvador, Guatemala and Hong Kong are listed as eligible but are named among sanctioned jurisdictions in the Exa App Terms (2025-10-02). The United States is excluded: the help article lists eligible US states and Exa publishes card terms for US citizens (2025-05-20), but the App Terms say US Persons are prohibited from using the App, and the card is created in the App. The App Terms' sanctions list also names countries that are not on the help list (for example England, Greece, Estonia, Slovenia, Cyprus); those are already outside the allowlist. The card can be spent anywhere Visa is accepted except Cuba, Iran, North Korea, Russia, Syria, Ukraine and Venezuela. Protocol level: the Exa account contracts on Optimism are usable without the card.",
        "evidence": [
          {
            "tier": "claimed",
            "by": "provider",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/8979641-card-availability-and-usage",
            "archive": "data/archive/exa-card-availability.txt",
            "detail": "Help article \"Card availability and usage\" lists 46 eligible countries, 31 eligible US states, 18 ineligible countries and 7 countries where the card cannot be spent.",
            "checked_at": "2026-10-09",
            "quote": "The Exa Card can be issued to residents of the following countries",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "claimed",
            "by": "provider",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/10715755-list-of-prohibited-countries-for-the-exa-card",
            "archive": "data/archive/exa-card-prohibited-countries.txt",
            "detail": "List of prohibited countries for the Exa Card (2026-01-15) names 32 countries where issuance is forbidden, including Nigeria.",
            "checked_at": "2026-10-09",
            "quote": "Exa card issuance is forbidden in the following countries",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/9942510-exa-app-terms-and-conditions",
            "archive": "data/archive/exa-card-app-terms.txt",
            "detail": "Exa App Terms (2025-10-02) prohibit US Persons from using the App and list sanctioned jurisdictions, including Ecuador, El Salvador, Guatemala and Hong Kong.",
            "checked_at": "2026-10-09",
            "quote": "the US Persons are prohibited from accessing and using the Services in any way",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Scored the OP Mainnet card on contracts pinned at exactly/exa aceb1b5 (which matches Sourcify), the backend and app at HEAD 4fba32b, and onchain reads at OP block 157885618. The card is issued by Third National through Rain, on Visa. Collateral sits in the user's own Alchemy modular account as exaUSDC in the Exactly Protocol market; Exa's keeper debits it with an Exa issuer signature. Explorer verification could not be checked because Optimistic Etherscan and Blockscout block automated requests.",
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true,
            "chain_id": 10,
            "address": "0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85"
          },
          {
            "symbol": "exaUSDC",
            "class": "other",
            "chain_id": 10,
            "address": "0x6926B434CCe9b5b7966aE1BfEef6D0A7DCF3A8bb"
          }
        ],
        "conversion": "at_spend",
        "note": "Deposits sit in Exactly Protocol markets, so a USDC balance is held as exaUSDC, the yield-bearing share of the exaUSDC market (a deposit receipt, not a separate dollar). Every card payment is collected in USDC from that market: Pay Now withdraws USDC from the user's exaUSDC deposit, and installment purchases borrow USDC from the market against the user's deposits. Other deposited assets (ETH, wstETH, WBTC, OP) are collateral for installment credit and are not spent directly. Exa converts the USDC to USD for the merchant; non-USD purchases carry a 1.5% FX fee. Scope is the OP Mainnet card; the Base deployment was not checked.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/exactly/docs/blob/fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b/exa-app/credit-and-debit-modes.md#L21-L33",
            "commit": "fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b",
            "path": "exa-app/credit-and-debit-modes.md",
            "detail": "Exa's docs say deposits (USDC, ETH, wstETH, WBTC, OP) are allocated to Exactly Protocol markets; Pay Now deducts the amount from the user's funds in those markets, and installment purchases borrow from the fixed-rate markets, converting the borrowed funds to USD for the merchant.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/contracts/deploy.json#L84-L121",
            "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
            "path": "contracts/deploy.json",
            "detail": "The OP Mainnet deploy config enumerates the tokens accounts can use; the card itself settles from the exaUSDC market (EXA_USDC immutable in ExaPlugin).",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://explorer.optimism.io/tx/0x906cb58684b9445dcbad6ab80c636d1d65799110782a8a1f4fda96821976e79b",
            "address": "0x973ccce386F99bd7a32Eec2DF192A030d8f214b8",
            "block_number": 157882808,
            "detail": "A sample card debit - the keeper called collectDebit on the user's account and the exaUSDC market emitted Withdraw of USDC to the card collector 0x3a73880f....",
            "checked_at": "2026-10-12"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "github.com/exactly/audits (32 reports for Exa and the Exactly Protocol), the audits/ folders of exactly/webauthn-owner-plugin and alchemyplatform/modular-account (v1 reports; the Dec 2024 ChainLight and Quantstamp reports cover Modular Account v2, which Exa accounts do not use), exactly/exa and exactly/protocol (no audit folders), and circlefin/stablecoin-evm (no published USDC audit). Left out as outside the card path: EXA token cross-chain, EscrowedEXA (ABDK, OpenZeppelin), staking (ChainSafe, Sherlock), peripheral contracts (ABDK Sep-23) and the Cryptecon economics paper. No audit of Rain's collateral contracts is published. Exactly Protocol reports are marked unknown because the deployed exaUSDC implementation is not source-verified. No bug bounty was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "ABDK Consulting",
            "date": "2026-09-17",
            "type": "review",
            "scope": "Exactly Protocol pull request review: non-collateral markets (Auditor and Market changes). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/ABDK%20Non-Collateral%20Markets%20%28Sep-26%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "note": "Initial draft 2026-09-08; public report 2026-09-17 with client responses; two findings withdrawn."
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2025-10-31",
            "type": "audit",
            "scope": "Exactly Protocol update (Market and related contracts). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/ABDK%20Protocol%20Update%20%28Oct-25%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "Moderate issues and recommendations; most marked info, several fixed"
          },
          {
            "auditor": "Quantstamp",
            "date": "2025-10-30",
            "type": "audit",
            "scope": "Exa App diff review: ExaPlugin changes between 1a27efdf and 16efc1be (batched proposal execution, cross-repay with non-USDC markets, minor fixes).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Quantstamp%20Exa%20App%20Plugin%20Update%20%28Oct-25%29.pdf",
            "commit": "16efc1be67e03dcd407ad3430150456dac965434",
            "repo": "https://github.com/exactly/exa",
            "covers_deployed": "no",
            "findings": "1 informational, fixed (fix review 2025-10-30)",
            "note": "Reviewed 2025-09-17 to 2025-09-29. Per S6, this later code is not what is deployed on OP Mainnet (deployed source aceb1b5)."
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2025-03-27",
            "type": "audit",
            "scope": "Exactly RewardsController update (called by the market on deposits, borrows and repays). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/ABDK%20Rewards%20Controller%20Update%20%28Mar-25%29pdf.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "Moderate and minor issues; some fixed, the rest informational"
          },
          {
            "auditor": "Quantstamp",
            "date": "2025-03",
            "type": "audit",
            "scope": "Exa App Plugin: ExaPlugin (ERC-6900 plugin for card debit and credit, collateral and withdrawal proposals), IssuerChecker and ProposalManager.",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Quantstamp%20Exa%20App%20Plugin%20%28Mar-25%29.pdf",
            "commit": "b262356",
            "repo": "https://github.com/exactly/exa",
            "covers_deployed": "no",
            "findings": "3 high, 3 medium, 5 low; all fixed",
            "note": "Reviewed 2025-01-14 to 2025-01-27 on exactly/mobile (now exactly/exa); fix review ended at 368df25. The deployed source aceb1b5 is 23 commits later and ExaPlugin.sol changed in between (S6)."
          },
          {
            "auditor": "Quantstamp",
            "date": "2024-06-10",
            "type": "audit",
            "scope": "Exactly WebAuthn Owner Plugin (ERC-6900 owner plugin with ECDSA, ERC-1271 and WebAuthn P-256 signatures), the passkey owner of each Exa account.",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Quantstamp%20Exa%20App%20WebAuthn%20Plugin%20%28Jul-24%29.pdf",
            "commit": "7fcf594",
            "repo": "https://github.com/exactly/webauthn-owner-plugin",
            "covers_deployed": "unknown",
            "findings": "1 medium (fixed), 2 low (acknowledged), 5 informational",
            "note": "Reviewed 2024-06-05 to 2024-06-10. The same PDF is in exactly/webauthn-owner-plugin audits/2024-06-10-quantstamp.pdf. Not checked against the deployed plugin 0x8f498c82..."
          },
          {
            "auditor": "Hashlock",
            "date": "2024-04",
            "type": "audit",
            "scope": "Exactly Protocol Market.sol and InstallmentsRouter.sol on Optimism (new market roles and installments router). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Hashlock%20Installments%20Router%20and%20New%20Market%20Roles%20%28Apr-24%29.pdf",
            "commit": "9bd8d2e29f5d9893d88e3a972e210b6ed06827bc",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown"
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2024-04-15",
            "type": "audit",
            "scope": "Exactly Protocol update part II: InstallmentsRouter and new Market roles. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/ABDK%20Installments%20Router%20and%20New%20Market%20Roles%20%28Apr-24%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "Recommendations only; several fixed"
          },
          {
            "auditor": "Hashlock",
            "date": "2024-03",
            "type": "audit",
            "scope": "Exactly Protocol InterestRateModel.sol and Market.sol on Optimism (interest rate model v2). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Hashlock%20Interest%20Rate%20Model%20v2%20%28Mar-24%29.pdf",
            "commit": "d424a0758a877e95a9f21a3685c680e086dc2321",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown"
          },
          {
            "auditor": "ChainSafe",
            "date": "2024-03",
            "type": "audit",
            "scope": "Exactly Protocol interest rate model v2 review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Chainsafe%20Interest%20Rate%20Model%20v2%20%28Mar-24%29.pdf",
            "commit": "d424a0758a877e95a9f21a3685c680e086dc2321",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "note": "A follow-up diff review is in 'Chainsafe Interest Rate Model v2 Diff (Mar-24).pdf' in the same repo."
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2024-03-12",
            "type": "audit",
            "scope": "Exactly Protocol update: interest rate model v2. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/ABDK%20Interest%20Rate%20Model%20v2%20%28Mar-24%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "1 major, 3 moderate (all fixed), minor issues",
            "note": "Report v3.0; v2.0 of the same report (2024-02-14) is 'ABDK Interest Rate Model v2 (Feb-24).pdf' in the same repo."
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2023-05-17",
            "type": "audit",
            "scope": "Exactly Protocol phase II. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/ABDK%202nd%20audit%20%28May-23%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "Major, moderate and minor issues; majors marked fixed"
          },
          {
            "auditor": "Coinspect",
            "date": "2023-03",
            "type": "audit",
            "scope": "Exactly Protocol fifth audit (fixed rate curve and interest rate model changes). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Coinspect%205th%20audit%20%28Mar-23%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "EXA-40 fixed rate curve discontinuity, EXA-41 retroactive fee collection on model change"
          },
          {
            "auditor": "Coinspect",
            "date": "2023-03",
            "type": "audit",
            "scope": "Exactly RewardsController, third review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Coinspect%20RewardsController%203rd%20audit%20%28Mar-23%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown"
          },
          {
            "auditor": "Coinspect",
            "date": "2023-02",
            "type": "audit",
            "scope": "Exactly RewardsController, second review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Coinspect%20RewardsController%202nd%20audit%20%28Feb-23%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "EXR-8 to EXR-12"
          },
          {
            "auditor": "Coinspect",
            "date": "2023-01",
            "type": "audit",
            "scope": "Exactly RewardsController, first review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Coinspect%20RewardsController%201st%20audit%20%28Jan-23%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "EXR-1 to EXR-7"
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2022-11-05",
            "type": "audit",
            "scope": "Exactly Protocol first ABDK audit. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/ABDK%201st%20audit%20%28Oct-22%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown"
          },
          {
            "auditor": "Coinspect",
            "date": "2022-10",
            "type": "audit",
            "scope": "Exactly Protocol fourth audit (price feeds and market enabling). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Coinspect%204th%20audit%20%28Oct-22%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "EXA-36 to EXA-39"
          },
          {
            "auditor": "ChainSafe",
            "date": "2022-10",
            "type": "audit",
            "scope": "Exactly Protocol update review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Chainsafe%202nd%20audit%20%28Oct-22%29.pdf",
            "commit": "af5b4907ec63fe034fb8dde62bae99222d8407bc",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown"
          },
          {
            "auditor": "Coinspect",
            "date": "2022-09",
            "type": "audit",
            "scope": "Exactly Protocol third audit. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Coinspect%203rd%20audit%20%28Oct-22%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "EXA-23 to EXA-35, including a liquidity-check bypass"
          },
          {
            "auditor": "ChainSafe",
            "date": "2022-05",
            "type": "audit",
            "scope": "Exactly Finance fixed lending protocol review. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Chainsafe%201st%20audit%20%28May-22%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown"
          },
          {
            "auditor": "Coinspect",
            "date": "2022-05",
            "type": "audit",
            "scope": "Exactly Protocol second audit. Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Coinspect%202nd%20audit%20%28May-22%29.pdf",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "unknown",
            "findings": "EXA-06 to EXA-22, including a liquidity-check bypass that could drain funds"
          },
          {
            "auditor": "Coinspect",
            "date": "2021-11",
            "type": "audit",
            "scope": "Exactly Protocol first audit (FixedLender and early protocol contracts). Exactly Protocol (shared component: the exaUSDC market that holds card collateral).",
            "url": "https://github.com/exactly/audits/blob/a430a1526b4609b7dc61fde5f8c2cc2545e0c632/Coinspect%201st%20audit%20%28Nov-21%29.pdf",
            "commit": "351d868e858f588d3e06c3a1cb9568ea13535601",
            "repo": "https://github.com/exactly/protocol",
            "covers_deployed": "no",
            "findings": "EXA-1 to EXA-5, including reward-token theft and an admin able to seize user funds",
            "note": "Covers the pre-launch FixedLender design, later replaced by Market."
          },
          {
            "auditor": "Quantstamp",
            "date": "2024-02-19",
            "type": "audit",
            "scope": "Alchemy Modular Account v1 (shared component: the user's UpgradeableModularAccount), ERC-6900 account and plugins.",
            "url": "https://github.com/alchemyplatform/modular-account/blob/ab9c0c24752d83f79ba7b8c112797502d2c2c5a5/audits/2024-02-19_quantstamp_0e3fd1e.pdf",
            "commit": "0e3fd1e",
            "repo": "https://github.com/alchemyplatform/modular-account",
            "covers_deployed": "unknown",
            "findings": "33 findings (2 high, 6 medium, 15 low, 3 undetermined, 7 informational); 21 fixed, 11 acknowledged, 1 mitigated",
            "note": "Reviewed 2023-11-20 to 2023-12-19. Also in the v1.0.1 tag as audits/2024-02-20-quantstamp-8ae319e.pdf. Not checked against the deployed implementation 0x00460000...a61e."
          },
          {
            "auditor": "Spearbit",
            "date": "2024-01-31",
            "type": "audit",
            "scope": "Alchemy Modular Account v1 (shared component: the user's UpgradeableModularAccount), account, factory and plugins.",
            "url": "https://github.com/alchemyplatform/modular-account/blob/ab9c0c24752d83f79ba7b8c112797502d2c2c5a5/audits/2024-01-31_spearbit_0e3fd1e.pdf",
            "commit": "0e3fd1e",
            "repo": "https://github.com/alchemyplatform/modular-account",
            "covers_deployed": "unknown",
            "findings": "High finding: SESSION_KEY_DATA_PREFIX storage collision; plus medium and lower findings",
            "note": "Also in the v1.0.1 tag. Not checked against the deployed implementation 0x00460000...a61e."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O1",
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1"
          ]
        }
      },
      "tally": {
        "holds": 6,
        "short": 17,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "fluidkey",
      "name": "Fluidkey",
      "type": "transfer",
      "website": "https://www.fluidkey.com",
      "primary_chain": {
        "name": "Base",
        "chain_id": 8453,
        "basis": "Fluidkey's docs say deposits from other chains via Near Intents \"are deposited as USDC on Base\", and the earliest auto-earn profile in Fluidkey's recovery tool configures Base USDC (fluidkey/sara@e6e4fcd9 src/configs/autoEarnProfiles.ts). Unit: stealth accounts as counterfactual Safe 1.3.0 proxies on Base (singleton 0xd9Db…9552, factory 0xa6B7…6AB2) and the FluidkeyEarn module 0x3BDb…f2f9. Excluded: the other six EVM chains, Near Intents routes, bank (Noah) and tokenised-stock features."
      },
      "repos": [
        {
          "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/fluidkey/fluidkey-earn-module",
          "role": "contracts",
          "license": "none"
        },
        {
          "url": "https://github.com/fluidkey/sara",
          "role": "frontend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/fluidkey/fluidkey-hydrator",
          "role": "contracts",
          "license": "MIT"
        }
      ],
      "contracts": [
        {
          "address": "0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552",
          "chain_id": 8453,
          "role": "Safe 1.3.0 singleton (stealth account logic)",
          "verified": "sourcify"
        },
        {
          "address": "0xa6B71E26C5e0845f74c812102Ca7114b6a896AB2",
          "chain_id": 8453,
          "role": "Safe 1.3.0 proxy factory",
          "verified": "sourcify"
        },
        {
          "address": "0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
          "chain_id": 8453,
          "role": "FluidkeyEarnModule (optional auto-earn)",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Stealth Safe accounts (Safe 1.3.0 proxy, singleton and factory)",
          "role": "contracts",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "none (each Safe is 1-of-1, owned by a user-derived stealth EOA)",
          "required": true,
          "repo": "https://github.com/safe-global/safe-smart-account"
        },
        {
          "name": "Fluidkey backend (stealth address issuance, ENS offchain resolver, indexing)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Fluid Privacy SA",
          "required": true
        },
        {
          "name": "Fluidkey app (web and mobile)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Fluid Privacy SA",
          "required": true
        },
        {
          "name": "Fluidkey Stealth Account Kit (@fluidkey/stealth-account-kit)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "user or Fluidkey app",
          "required": true,
          "repo": "https://github.com/fluidkey/fluidkey-stealth-account-kit"
        },
        {
          "name": "Base and a JSON-RPC endpoint",
          "role": "ledger",
          "public": true,
          "license": "MIT",
          "operator": "Base sequencer (Coinbase)",
          "required": true,
          "repo": "https://github.com/ethereum-optimism/optimism"
        },
        {
          "name": "Gas sponsorship relayer",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Fluid Privacy SA",
          "required": false
        },
        {
          "name": "FluidkeyEarnModule and authorized relayers (auto-earn)",
          "role": "contracts",
          "public": true,
          "license": "AGPL-3.0",
          "operator": "Fluid Privacy SA (owner Safe 2-of-3)",
          "required": false,
          "repo": "https://github.com/fluidkey/fluidkey-earn-module"
        },
        {
          "name": "Privy embedded wallet (web login key derivation)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Privy",
          "required": false
        },
        {
          "name": "SARA recovery interface (recovery.fluidkey.com)",
          "role": "frontend",
          "public": true,
          "license": "MIT",
          "operator": "Fluid Privacy SA, or self-hosted",
          "required": false,
          "repo": "https://github.com/fluidkey/sara"
        },
        {
          "name": "Noah (bank feature, KYC), Near Intents, Houdini Swap",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "third parties",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552",
              "address": "0xaAa53d54Ba6450f9294Ce3c1f51e866D0F8C8e70",
              "block_number": 52372315,
              "detail": "A sample Fluidkey stealth account (from an AutoEarnExecuted event at block 52372274) is a Safe 1.3.0 proxy with masterCopy 0xd9Db…9552, threshold 1, one owner 0x43D7…17EB with no code, guard slot 0, and one module, FluidkeyEarnModule 0x3BDb…f2f9.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xaAa53d54Ba6450f9294Ce3c1f51e866D0F8C8e70 \"getModulesPaginated(address,uint256)(address[],address)\" 0x0000000000000000000000000000000000000001 10 --rpc-url https://mainnet.base.org",
              "check": {
                "slot": "0x0",
                "expect": "0x000000000000000000000000d9db270c1b5e3bd161e8c8503c55ceabee709552"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-earn-module/blob/122cde19940d06b94c0027f4cd2e22e7fa19129a/src/FluidkeyEarnModule.sol#L429-L483",
              "commit": "122cde19940d06b94c0027f4cd2e22e7fa19129a",
              "path": "src/FluidkeyEarnModule.sol",
              "detail": "The module can only make the Safe wrap native tokens, approve and deposit into the vault configured for that Safe's config hash, with shares minted to the Safe; it has no transfer-out, pause or freeze path.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Payments are ordinary transfers into user-owned 1-of-1 Safes built on Safe's immutable 1.3.0 singleton; no Fluidkey role can pause, freeze or block them onchain. The optional earn module lets Fluidkey's relayers push received funds into preconfigured vaults, which is a custody question (S1), not a block. Refusal of service happens off-chain, in address issuance (C3, C4).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit/blob/2a4ccfafef127165c11ba16fc16235c919698ec2/README.md#L1-L58",
              "commit": "2a4ccfafef127165c11ba16fc16235c919698ec2",
              "path": "README.md",
              "detail": "The kit \"enables anyone to independently generate and recover stealth smart accounts and related funds\" and lists the Fluidkey parameters (chainId 0, Safe 1.3.0, default addresses, threshold 1).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fluidkey/fluidkey-stealth-account-kit/contents/README.md?ref=2a4ccfafef127165c11ba16fc16235c919698ec2\" --jq .content | base64 -d | sed -n 1,58p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fluidkey.com/readme/recovery",
              "detail": "The docs present the open recovery interface (SARA) only as a way to verify addresses or \"as a last resort to recover funds\".",
              "checked_at": "2026-10-09",
              "quote": "as a last resort to recover funds",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Once a payer has a stealth address, settlement is a plain token transfer, and the payee can deploy the Safe and move funds with the kit and Safe's public factory, without Fluidkey. But new addresses are issued by Fluidkey's backend, and the documented direct path is recovery only. Judgment call: 2, possible and reconstructable from public code, but not documented as a settlement path.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fluidkey.com/technical-documentation/technical-walkthrough",
              "detail": "The user shares a BIP-32 node of the viewing key with Fluidkey so that Fluidkey can generate stealth addresses, and ENS names resolve through Fluidkey's offchain resolver.",
              "checked_at": "2026-10-09",
              "quote": "Fluidkey uses an ENS offchain resolver to return stealth addresses",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit/tree/2a4ccfafef127165c11ba16fc16235c919698ec2/src",
              "commit": "2a4ccfafef127165c11ba16fc16235c919698ec2",
              "path": "src",
              "detail": "The public kit contains only key derivation and address prediction; no resolver, issuance service or relayer code is published in github.com/fluidkey.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "In the product flow a payer gets a fresh address from Fluidkey's offchain ENS resolver or payment page, both run only by Fluidkey with no public code. The gas relayer is also Fluidkey's. Scored 0: required, closed, single-vendor. The kit lets a payee derive addresses themselves, which keeps funds recoverable (S4).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.fluidkey.com/privacy",
              "detail": "The privacy policy lists fraud, risk and device signals including sanctions/PEP screening indicators among the data processed, and fraud-prevention and risk-screening providers among recipients.",
              "checked_at": "2026-10-09",
              "quote": "Fraud, risk and device signals, which may include sanctions/PEP screening indicators",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.fluidkey.com/terms",
              "detail": "The terms require that users are not subject to or resident in jurisdictions under Swiss, UN, EU, UK, US or other sanctions.",
              "checked_at": "2026-10-09",
              "quote": "subject to economic sanctions or trade embargoes",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement layer (token transfers into Safes) has no filtering. Screening exists in Fluidkey's closed backend and is disclosed only in the privacy policy and terms; we cannot see where it applies or whether address issuance is refused. Scored 1: edge filtering disclosed in docs only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fluidkey.com/readme/frequently-asked-questions",
              "detail": "The FAQ names 7 EVM chains (Ethereum, Arbitrum, Base, Polygon, Optimism, Gnosis, BSC); receiving accepts ETH, USDC and any ERC-20.",
              "checked_at": "2026-10-09",
              "quote": "Fluidkey accounts are currently available on 7 EVM chains",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Chains are listed in the docs; tokens are an open set. We found no statement that USDC or other issuers can freeze funds in a stealth account, or about Base's sequencer. Judgment call: an open token set is not enumerated, so 0, as for Railgun.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
              "address": "0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
              "block_number": 52372315,
              "detail": "Sourcify returns exact_match on Base for the Safe singleton, proxy factory and FluidkeyEarnModule (and match for MultiSend 0xA238…7761); the module source equals src/FluidkeyEarnModule.sol at 122cde19 apart from a trailing newline.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552 0xa6B71E26C5e0845f74c812102Ca7114b6a896AB2 0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/8453/$a | jq -r .match; done"
            }
          ],
          "finding": "All contracts in the path are full Sourcify matches. No rebuild was attempted, and the Safe contracts come from Safe's own repository rather than Fluidkey's. Judgment call: 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit/tree/2a4ccfafef127165c11ba16fc16235c919698ec2/src",
              "commit": "2a4ccfafef127165c11ba16fc16235c919698ec2",
              "path": "src",
              "detail": "github.com/fluidkey publishes the kit, the earn module, the hydrator, the SARA recovery UI and hackathon repos; no app, backend, resolver or indexer code.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Only the SDK-level kit and contracts are public. The app, backend, resolver, relayer and indexer are closed. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/sara/blob/e6e4fcd9e718722948b82fa0e819e0c4fca46e0d/README.md",
              "commit": "e6e4fcd9e718722948b82fa0e819e0c4fca46e0d",
              "path": "README.md",
              "detail": "The only public deployable app is the SARA recovery interface, whose README has a description and a demo link but no build steps.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no path to a self-hosted Fluidkey deployment: the app and backend are closed. SARA recovers funds but does not issue addresses or receive payments. Judgment call: 0, since recovery is not a working payment deployment.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-earn-module/blob/122cde19940d06b94c0027f4cd2e22e7fa19129a/src/FluidkeyEarnModule.sol#L98-L116",
              "commit": "122cde19940d06b94c0027f4cd2e22e7fa19129a",
              "path": "src/FluidkeyEarnModule.sol",
              "detail": "The earn module's events are in its source; Safe ABIs are public through safe-deployments, used by the kit.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fluidkey.com/readme/receiving-funds",
              "detail": "The docs describe receiving via ENS, payment pages and Near Intents; transaction export is described only in the docs (Exporting Transactions page).",
              "checked_at": "2026-10-09",
              "quote": "These transfers are deposited as USDC on Base",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Contract interfaces are public, but there is no API schema for the backend, and the transaction export is documented only. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit/blob/2a4ccfafef127165c11ba16fc16235c919698ec2/LICENSE",
              "commit": "2a4ccfafef127165c11ba16fc16235c919698ec2",
              "path": "LICENSE",
              "detail": "The kit is MIT; SARA and the hydrator are MIT; the earn module has no LICENSE file (SPDX AGPL-3.0-only in source, GPL-3.0 in package.json).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The required app and backend are closed, so F1 is 0 by rule.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit/blob/14a11e007c51320b64803156158672082c2fcc0a/LICENSE",
              "commit": "14a11e007c51320b64803156158672082c2fcc0a",
              "path": "LICENSE",
              "detail": "The kit's LICENSE went MIT (de2cc84a, 2024-01-04) to Apache-2.0 (14a11e00, 2024-01-12) and back to MIT the same day (b32f35d3); no CLA or CONTRIBUTING file.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fluidkey/fluidkey-stealth-account-kit/commits?path=LICENSE&sha=2a4ccfafef127165c11ba16fc16235c919698ec2\" --jq '.[].sha'",
              "historical": true
            }
          ],
          "finding": "No CLA and no licence-stability commitment. The kit's licence changed twice in January 2024, between two permissive licences. Judgment call: the anchor names any prior relicense as 0; we apply it as for Privacy Pools.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fluidkey.com/technical-documentation/technical-walkthrough",
              "detail": "Address generation for users relies on the viewing-key node shared with Fluidkey.",
              "checked_at": "2026-10-09",
              "quote": "the user shares a BIP-32 derived node of their private viewing key with Fluidkey",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Production depends on Fluidkey's hosted backend for issuing and tracking addresses, with no open alternative; the open kit covers key derivation and recovery. Scored 1: documented that production needs a hosted service.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "unknown": true,
          "finding": "The app is closed and we ran no trace. The privacy policy mentions consent-based usage analysis, which does not show whether analytics is on by default.",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.fluidkey.com/privacy",
              "detail": "The policy lists contact and login details, blockchain data, identity-verification data from regulated partners, fraud/risk/device signals and, for the Bank feature, biometric data.",
              "checked_at": "2026-10-09",
              "quote": "Fraud, risk and device signals, which may include sanctions/PEP screening indicators",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fluidkey.com/technical-documentation/technical-walkthrough",
              "detail": "Fluidkey holds a node of each user's viewing key, which lets it link all of the user's stealth accounts and payments.",
              "checked_at": "2026-10-09",
              "quote": "the user shares a BIP-32 derived node of their private viewing key with Fluidkey",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Beyond settlement data, Fluidkey holds the user's viewing-key node (and so the full payment history), login and contact data, and risk signals; KYC applies only to the optional Bank feature. All of it is disclosed in the policy and docs, not limited in code. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit/blob/2a4ccfafef127165c11ba16fc16235c919698ec2/src/generateStealthAddresses.ts#L1-L49",
              "commit": "2a4ccfafef127165c11ba16fc16235c919698ec2",
              "path": "src/generateStealthAddresses.ts",
              "detail": "Each payment goes to a fresh stealth EOA's counterfactual Safe; nothing about the payee or invoice is written onchain.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fluidkey/fluidkey-stealth-account-kit/contents/src/generateStealthAddresses.ts?ref=2a4ccfafef127165c11ba16fc16235c919698ec2\" --jq .content | base64 -d",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fluidkey.com/readme/sending-funds",
              "detail": "When sending, the app selects \"one or a few stealth accounts\" to fund a payment, which can link them; labels limit which accounts are combined.",
              "checked_at": "2026-10-09",
              "quote": "selecting one or a few stealth accounts",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Receiving uses fresh addresses with no metadata. Spending can combine several stealth accounts in one payment, linking them, and Safes created with the earn-module initializer are recognisable as Fluidkey accounts; both are documented. Fluidkey itself sees all links (P2). Judgment call: 2, minimal documented linkage, because the linking comes from the app's spending logic rather than user behaviour.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fluidkey.com/readme/account-set-up",
              "detail": "The web app derives keys through a Privy embedded wallet; other docs pages name Noah (bank KYC), Near Intents and Houdini Swap; the policy lists IT, risk-screening and identity-verification providers by type.",
              "checked_at": "2026-10-09",
              "quote": "your keys are generated from your login via a Privy embedded wallet",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Fluidkey's backend sees every payment, and Privy, risk-screening providers and feature partners are disclosed only in docs and the policy; the app code is closed. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "finding": "The app is closed, so we could not check whether RPC or indexer endpoints are configurable. The SARA recovery UI accepts a custom RPC URL, but it is not the payment path.",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552",
              "address": "0xaAa53d54Ba6450f9294Ce3c1f51e866D0F8C8e70",
              "block_number": 52372315,
              "detail": "The sample stealth Safe's threshold is 1 and its only owner is a stealth EOA derived from the user's keys; Fluidkey holds no signer.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xaAa53d54Ba6450f9294Ce3c1f51e866D0F8C8e70 \"getOwners()(address[])\" --rpc-url https://mainnet.base.org",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-earn-module/blob/122cde19940d06b94c0027f4cd2e22e7fa19129a/src/FluidkeyEarnModule.sol#L375-L427",
              "commit": "122cde19940d06b94c0027f4cd2e22e7fa19129a",
              "path": "src/FluidkeyEarnModule.sol",
              "detail": "autoEarn is callable by an authorized relayer (or with a relayer signature) and deposits into the vault configured for the Safe, with shares to the Safe.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Payments go directly into a Safe the payee alone controls; Fluidkey cannot redirect them. With auto-earn on, Fluidkey's relayers move received funds into preconfigured Morpho, Aave or InfiniFi vaults without a per-transaction signature, so custody shifts to those vaults; the shares stay with the Safe. Judgment call: 3, because the payment itself is a direct transfer and auto-earn is a disclosed, user-chosen profile.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
              "address": "0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
              "block_number": 52372315,
              "detail": "FluidkeyEarnModule is not a proxy (implementation slot zero); its owner() is Safe 0x9E3e…e7CD (1.4.1, 2-of-3, no modules, guard 0), which can add relayers and register new configs but not change code. Each stealth Safe's masterCopy can be changed only by its own 1-of-1 owner.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9 \"owner()(address)\" --rpc-url https://mainnet.base.org",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000009e3eba321427941868cb4123de97dab145c9e7cd"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Nobody but the account owner can change the code behind a stealth account, and the earn module is immutable. Scored 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-earn-module/blob/122cde19940d06b94c0027f4cd2e22e7fa19129a/src/FluidkeyEarnModule.sol#L459-L467",
              "commit": "122cde19940d06b94c0027f4cd2e22e7fa19129a",
              "path": "src/FluidkeyEarnModule.sol",
              "detail": "The only approval in public code is the module's exact-amount approval of the vault (amountToSave); a payer pays by plain transfer and needs no approval.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fluidkey/fluidkey-earn-module/contents/src/FluidkeyEarnModule.sol?ref=122cde19940d06b94c0027f4cd2e22e7fa19129a\" --jq .content | base64 -d | sed -n 459,467p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Receiving needs no approval, and the auto-earn path approves exact amounts. Judgment call: approvals the closed app may request for swaps or other features cannot be checked, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit/blob/2a4ccfafef127165c11ba16fc16235c919698ec2/src/predictStealthSafeAddress.ts#L1-L60",
              "commit": "2a4ccfafef127165c11ba16fc16235c919698ec2",
              "path": "src/predictStealthSafeAddress.ts",
              "detail": "The kit replays stealth EOAs from the user's keys and predicts each Safe address from Safe's public deployments, so funds can be located and recovered without Fluidkey.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fluidkey/fluidkey-stealth-account-kit/contents/src/predictStealthSafeAddress.ts?ref=2a4ccfafef127165c11ba16fc16235c919698ec2\" --jq .content | base64 -d | sed -n 1,60p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=3, C2=2, C3=0, O3=0. Funds sit in user-owned Safes (S1). If Fluidkey disappears, a user with their login or key backup can rebuild addresses with the kit and move funds through the public Safe contracts, for example with SARA (C2). New addresses, ENS resolution and gas sponsorship stop, because they need the closed backend (C3), and the app cannot be self-hosted (O3). Scored 2: funds retrievable without the provider; settlement stops. Keys created through Privy depend on that login or a backup.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "finding": "The app bundle is closed and not inspected. The docs say spending keys never leave the client, while a viewing-key node is shared with Fluidkey by design (P2).",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit/blob/2a4ccfafef127165c11ba16fc16235c919698ec2/README.md#L60-L63",
              "commit": "2a4ccfafef127165c11ba16fc16235c919698ec2",
              "path": "README.md",
              "detail": "The kit was audited by Dedaub (May 2024, PDF in audits/); the earn-module repo holds an Ackee report (March 2025) and its source has commits after an \"implement audit recommendations\" commit (8263b4f8, 2025-02-24).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Audit reports for the kit and the earn module are in their repos. We could not extract the audited commits from the PDFs, so we cannot tie them to the deployed code. The app and backend have no published audit, and we found no bounty. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "notes": "Unit: Fluidkey stealth accounts on Base. Fluidkey runs no settlement contract of its own: payments are transfers into counterfactual Safe 1.3.0 proxies owned by stealth EOAs, and the optional FluidkeyEarnModule moves balances into vaults. Reads at block 52372315 via base-rpc.publicnode.com (the sample Safe 0xaAa5…8e70 came from an AutoEarnExecuted log at block 52372274). Authorized-relayer events could not be enumerated (public Base RPCs cap log ranges). No availability block: the terms refer to sanctions regimes without naming countries. No transactions, app runs, traces or self-host attempts.",
      "audits": {
        "searched": "The audits/ folders of github.com/fluidkey/fluidkey-stealth-account-kit and fluidkey-earn-module (fluidkey-hydrator and sara have none), the kit's README, fluidkey.com, and for the shared Safe 1.3.0 contracts the docs/ folder of github.com/safe-global/safe-smart-account (audit_1_3_0.md and the PDFs it lists). No published audit of the Fluidkey app, backend, relayer or ENS resolver was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Nethermind Security",
            "date": "2026-08-17",
            "type": "review",
            "scope": "Shared component, Safe Smart Account v1.3.0 (Safe, SafeL2, handlers, libraries, proxy factory)",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Safe_Audit_Report_1_3_0_Nethermind.pdf",
            "commit": "767ef36bba88bdbc0c9fe3708a4290cabef4c376",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "yes",
            "findings": "1 low, 1 informational; addressed in Safe v1.4.0, not in 1.3.0",
            "note": "Retrospective review of the v1.3.0-libs.0 tag; the core contracts are unchanged from the 2021 audited code that the canonical Base deployments (singleton 0xd9Db…9552, factory 0xa6B7…6AB2) were built from. The fixes are not in the deployed 1.3.0 contracts."
          },
          {
            "auditor": "Certora",
            "date": "2026-07",
            "type": "audit",
            "scope": "Shared component, Safe Smart Account v1.3.0 (GnosisSafe, GnosisSafeL2, accessors, base managers, handlers, libraries, proxies)",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Safe_Audit_Report_1_3_0_Certora.pdf",
            "commit": "767ef36bba88bdbc0c9fe3708a4290cabef4c376",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "yes",
            "findings": "1 low, 2 informational; all acknowledged",
            "note": "Review dated 20-29 July 2026 of the v1.3.0-libs.0 tag."
          },
          {
            "auditor": "Ackee Blockchain Security",
            "date": "2025-03-04",
            "type": "audit",
            "scope": "FluidkeyEarnModule (src/FluidkeyEarnModule.sol), the optional auto-earn Safe module",
            "url": "https://github.com/fluidkey/fluidkey-earn-module/blob/122cde19940d06b94c0027f4cd2e22e7fa19129a/audits/ackee-blockchain-fluidkey-earn-module-report.pdf",
            "commit": "6aca8f7e203cadad6287f643cb3ef050ffe1ef01",
            "repo": "https://github.com/fluidkey/fluidkey-earn-module",
            "covers_deployed": "partly",
            "findings": "1 high, 1 medium, 3 warning, 4 info; all fixed (re-review at 66510813)",
            "note": "The deployed module matches src at 122cde19, which adds about 260 changed lines to the module after the reviewed fix commit (ownership/CREATE3 and calldata changes, March-April 2025) that the report does not cover."
          },
          {
            "auditor": "Dedaub",
            "date": "2024-05-24",
            "type": "audit",
            "scope": "Fluidkey Stealth Account Kit (TypeScript key derivation, stealth address generation and Safe address prediction)",
            "url": "https://github.com/fluidkey/fluidkey-stealth-account-kit/blob/2a4ccfafef127165c11ba16fc16235c919698ec2/audits/Fluidkey%20Stealth%20Account%20Kit%20-%20May%2024,%202024.pdf",
            "commit": "518a4dec1ccdb3a1d61dba62b6cf8e124a89367d",
            "repo": "https://github.com/fluidkey/fluidkey-stealth-account-kit",
            "covers_deployed": "partly",
            "findings": "1 medium, 1 low, 1 advisory; all resolved (fixes reviewed at 192a2260)",
            "note": "Covers the open library only, not the Fluidkey app or backend. src/ has changed since (predictStealthSafeAddress and new files), so current releases are partly covered."
          },
          {
            "auditor": "G0 Group",
            "date": "2021-05",
            "type": "audit",
            "scope": "Shared component, Gnosis Safe 1.3.0 contracts (all Solidity files), final audit",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Gnosis_Safe_Audit_Report_1_3_0_Final.pdf",
            "commit": "ad6c7355d5bdf4f7fa348fbfcb9f07431769a3c9",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "yes",
            "findings": "No issues; 1 note",
            "note": "Core contracts are unchanged between this commit and the v1.3.0-libs.0 tag used for the canonical deployments."
          },
          {
            "auditor": "G0 Group",
            "date": "2021-04",
            "type": "audit",
            "scope": "Shared component, Gnosis Safe 1.3.0 contracts (all Solidity files), initial audit",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Gnosis_Safe_Audit_Report_1_3_0_Initial.pdf",
            "commit": "4bfc0c8519f1893015d7edfd2c2780fca163c364",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "partly",
            "findings": "No issues; 5 optimisation notes",
            "note": "Superseded by the May 2021 final audit."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S5"
          ]
        }
      },
      "tally": {
        "holds": 8,
        "short": 12,
        "unk": 3,
        "total": 23
      }
    },
    {
      "slug": "fuse-card",
      "name": "Fuse Card",
      "type": "card",
      "website": "https://fusewallet.com",
      "primary_chain": {
        "name": "Solana",
        "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
        "basis": "Fuse Card is the Bridge-run Visa card in Squads' Fuse wallet (fusewallet.com), not a product of the Fuse Network (chain 122). The Fuse Terms and Fuse Pay post say a separate Squads smart-account \"Card Account\" holds the USDC and Bridge spends it through a daily Spending Limit. Onchain, 1,727 Squads v4 USDC spending limits share member AE2RGS1h... with period Day and a 2,000 USDC cap, matching the documented \"up to $2,000\" limit. Excluded: Fuse Network (122), which no Fuse Card document mentions."
      },
      "repos": [
        {
          "url": "https://github.com/Squads-Protocol/v4",
          "role": "contracts",
          "license": "AGPL-3.0"
        },
        {
          "url": "https://github.com/Squads-Protocol/public-v4-client",
          "role": "frontend",
          "license": "MIT"
        }
      ],
      "contracts": [
        {
          "address": "SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf",
          "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
          "role": "Squads v4 multisig program (immutable)",
          "verified": "none"
        },
        {
          "address": "2ozzxmEwAoKAw5ekUzeMej3E7ToCV1KjTbvhNHdkdZDK",
          "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
          "role": "Sample Fuse Card Account (v4 multisig, 1-of-1, 300 s lock)",
          "verified": "none"
        },
        {
          "address": "12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B",
          "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
          "role": "Sample Bridge spending limit (2,000 USDC per day)",
          "verified": "none"
        },
        {
          "address": "6AFbKVmLKT7a8Nwx3D8bUrcpWny3sFpR8DbjHYAZzGXk",
          "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
          "role": "Sample Fuse Main Account (v4 multisig, 2-of-3 keys)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "Squads v4 multisig program (Main and Card Accounts, spending limits)",
          "role": "contracts",
          "public": true,
          "license": "AGPL-3.0",
          "operator": "Squads (program immutable)",
          "required": true,
          "repo": "https://github.com/Squads-Protocol/v4"
        },
        {
          "name": "Fuse iOS app (key management, card UI)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Squads Labs",
          "required": true
        },
        {
          "name": "Fuse backend and fee payer",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Squads Labs",
          "required": true
        },
        {
          "name": "Bridge card programme (program manager, spending-limit key AE2RGS1h...)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Bridge Ventures LLC",
          "required": true
        },
        {
          "name": "Lead Bank (card issuer)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Lead Bank",
          "required": true
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "KYC via Bridge",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Bridge Ventures LLC",
          "required": true
        },
        {
          "name": "Turnkey email recovery key (optional)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Turnkey",
          "required": false
        },
        {
          "name": "Squads public v4 client (self-hostable, not used by Fuse app)",
          "role": "frontend",
          "public": true,
          "license": "MIT",
          "operator": "Squads / self-hosted",
          "required": false,
          "repo": "https://github.com/Squads-Protocol/public-v4-client"
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/v4/blob/64af7330413d5c85cbbccfd8c27a05d45b6e666f/programs/squads_multisig_program/src/lib.rs#L48-L80",
              "commit": "64af7330413d5c85cbbccfd8c27a05d45b6e666f",
              "path": "programs/squads_multisig_program/src/lib.rs",
              "detail": "The only program-level admin (ProgramConfig authority) can set itself, the multisig creation fee and the treasury; no pause, freeze or blacklist instruction exists in the program.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/2ozzxmEwAoKAw5ekUzeMej3E7ToCV1KjTbvhNHdkdZDK",
              "address": "2ozzxmEwAoKAw5ekUzeMej3E7ToCV1KjTbvhNHdkdZDK",
              "block_number": 454201822,
              "detail": "Sample Card Account multisig has config_authority = default (autonomous), threshold 1 and a single member GcWXuyno... (permissions 7), which is the vault of Main Account 6AFbKVmL... (threshold 2; device and 2FA keys plus a vote-only recovery key). Squads and Bridge hold no member key.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.bridge.xyz/card-agreements/fuse-card",
              "quote": "We reserve the right to block, suspend or cancel your Card at any time, with or without notice",
              "detail": "Lead Bank Prepaid Visa Cardholder Agreement (Bridge Ventures as Program Manager), fraud prevention clause.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Onchain, no one can pause or freeze the user's Squads accounts: the program has no such instruction and is immutable, and neither Squads nor Bridge holds a member key. The card itself can be blocked or cancelled by Lead Bank or Bridge \"with or without notice\", and every card settlement depends on Bridge using its spending limit. Judgment call: the documented per-card block without notice meets anchor 0, as in Gnosis Pay; the onchain layer alone would score 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/tx/2Pd7P942u9s4Cgjh2342qN69bH7jzwXRngmgx42BnfWVQvjXfqPci9qH3Bh9AqeUmBu1mrEpV5k6dM6zyyo2tVQY",
              "address": "AE2RGS1hhdmMMFrM6HAaZx8XmZL4TuSfQX8wjCpDXv2p",
              "block_number": 454199060,
              "eoa": true,
              "detail": "A sample card debit is a SpendingLimitUse signed by Bridge's key AE2RGS1h... (a system-owned keypair account) moving 1.69 USDC from a card vault 9BWWRFQ7... to 9ipHpNhr...",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/blog/fuse-pay",
              "quote": "You can set a daily Spending Limit for Bridge",
              "detail": "The Fuse Pay post says Bridge uses the spending limit in real time as the user pays with the card.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Merchants are paid by Visa and Lead Bank off-chain. The only onchain step is Bridge pulling USDC with its own key. Neither payer nor payee can complete a card payment by calling the program.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/support/fuse-visa-card",
              "quote": "Complete the KYC process via Bridge",
              "detail": "Applying, KYC and card issuance run through Bridge inside the closed Fuse app.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A card payment needs Bridge (KYC, authorisation, the spending-limit signer), Lead Bank, Visa and the closed Fuse app. All are closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/v4/blob/64af7330413d5c85cbbccfd8c27a05d45b6e666f/programs/squads_multisig_program/src/instructions/spending_limit_use.rs#L90-L135",
              "commit": "64af7330413d5c85cbbccfd8c27a05d45b6e666f",
              "path": "programs/squads_multisig_program/src/instructions/spending_limit_use.rs",
              "detail": "SpendingLimitUse checks only the spending-limit member, mint and optional destination list; the program has no address or country filter.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/support/fuse-visa-card",
              "quote": "Smart account enforced spending limits to protect your card balance",
              "detail": "The support page lists eligible countries (U.S. excluding NY and AK, plus 17 Latin American and African countries); KYC is done by Bridge.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement program is neutral. Geographic eligibility is disclosed as a country list in the docs, and screening runs in Bridge's closed KYC. With C2 at 0 there is no way around it. Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B",
              "address": "12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B",
              "block_number": 454201823,
              "detail": "The Bridge spending limit's mint is USDC EPjFWdd5... (period Day, amount 2,000,000,000 base units); all 1,727 limits with member AE2RGS1h... use the USDC mint.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type:application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B\",{\"encoding\":\"base64\"}]}' (bytes 73-104 = mint, 105-112 = amount)"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
              "address": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
              "block_number": 454202586,
              "detail": "USDC mint freezeAuthority = 7dGbd2QZcCKcTndnHcTL8q7SMVXAkp688NTQYwrRCrar (Circle), so any card vault's USDC token account can be frozen.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "USDC on Solana is the only card asset. That shows in the onchain spending-limit configuration and in the docs. Circle's freeze authority over USDC is not stated in the Fuse Terms, the support page or the cardholder agreement. Judgment call: onchain configuration counts as \"enumerated in code\"; assumptions not stated, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://verify.osec.io/status/SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf",
              "address": "SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf",
              "block_number": 454201918,
              "detail": "The OtterSec verified-build registry returns is_verified false for the program (\"On chain program not verified\"), on-chain hash d4866083..., a registered commit 3742e552 (Jan 2024) and is_frozen true.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/README.md#L112-L148",
              "commit": "af94153ff77a28b6effe46b9c94baaa93742b48c",
              "path": "README.md",
              "detail": "The README documents a solana-verify deterministic build and the commands to compare hashes; I did not run it.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The program has no recorded verified build. The registry entry is unverified and points at a January 2024 commit whose spending-limit code (members must be multisig members) does not match observed behaviour; the audited commit 64af733 does match it. The README gives reproducible build steps, but no one has recorded a match. Unverified, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/v4/tree/64af7330413d5c85cbbccfd8c27a05d45b6e666f/programs",
              "commit": "64af7330413d5c85cbbccfd8c27a05d45b6e666f",
              "path": "programs",
              "detail": "The settlement program and its TypeScript SDK are public; no repo for the Fuse app, Fuse backend or Bridge card integration exists in the Squads-Protocol org.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Only the program and SDK are public. The Fuse app, backend and card integration are closed, and no API schema is published. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/public-v4-client/blob/ee95b825e0d1d056b388df72d217bcb6b86bceb6/README.md#L17-L80",
              "commit": "ee95b825e0d1d056b388df72d217bcb6b86bceb6",
              "path": "README.md",
              "detail": "The public v4 client README gives build, hash-verification and Docker self-host steps for a generic Squads v4 interface.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Self-host docs exist for a generic v4 client, not for Fuse. Reproduction not attempted, and the card cannot be self-hosted. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/LICENSE",
              "commit": "af94153ff77a28b6effe46b9c94baaa93742b48c",
              "path": "LICENSE",
              "detail": "Squads v4 is AGPL-3.0; the public client is MIT.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The public repos carry OSI licences. The Fuse app, backend and Bridge integration are required and closed, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/v4/blob/d5cb3e7470ccb26073510a16af3b1da9c6ad1818/LICENSE",
              "commit": "d5cb3e7470ccb26073510a16af3b1da9c6ad1818",
              "path": "LICENSE",
              "detail": "From January 2024 to October 2024 the v4 LICENSE was Business Source License 1.1 (Licensor Selimor Investments Limited); commit 316913ad (\"Open sourced!\", 2024-10-11) replaced it with AGPL-3.0.",
              "checked_at": "2026-10-07",
              "historical": true
            }
          ],
          "finding": "The program has already been relicensed, from BUSL to AGPL. That change opened it up, but it shows the licensor can relicense unilaterally. I found no CLA and no licence-stability commitment. Judgment call: the anchor names a prior relicensing event as 0, and I applied it even though the direction was toward openness.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.bridge.xyz/card-agreements/fuse-card",
              "quote": "issued to you by Lead Bank",
              "detail": "The card exists only through Lead Bank, Bridge as Program Manager and Squads as Platform Provider.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card cannot run without proprietary services: the Fuse app, Bridge, Lead Bank and Visa.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://squads.xyz/legal/privacy-policy",
              "quote": "Data analytics providers",
              "detail": "The Squads privacy policy (covers Fuse Wallet) lists ad networks and data analytics providers among recipients and analytics among uses.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics are disclosed in the policy. The app is closed and no trace was run, so presence and defaults cannot be checked in code. Judgment call: disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://squads.xyz/legal/privacy-policy",
              "quote": "may be collected and processed by our financial services partners, such as Bridge Ventures, LLC",
              "detail": "The policy discloses KYC collection by Bridge and Lead Bank for Fuse Card, plus card account numbers, name, transaction history, email, phone, address and balances.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The regulated card requires full KYC. It is disclosed in the policy and is beyond settlement needs, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/tx/2Pd7P942u9s4Cgjh2342qN69bH7jzwXRngmgx42BnfWVQvjXfqPci9qH3Bh9AqeUmBu1mrEpV5k6dM6zyyo2tVQY",
              "address": "AE2RGS1hhdmMMFrM6HAaZx8XmZL4TuSfQX8wjCpDXv2p",
              "block_number": 454199060,
              "eoa": true,
              "detail": "Each card purchase is a public SpendingLimitUse whose log names the card vault, the destination 9ipHpNhr... and the exact amount (1,690,000 base units); no merchant or MCC data is onchain.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type:application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getTransaction\",\"params\":[\"2Pd7P942u9s4Cgjh2342qN69bH7jzwXRngmgx42BnfWVQvjXfqPci9qH3Bh9AqeUmBu1mrEpV5k6dM6zyyo2tVQY\",{\"encoding\":\"jsonParsed\",\"maxSupportedTransactionVersion\":0}]}' | jq .result.meta.logMessages"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/blog/fuse-card",
              "quote": "the equivalent USDC is deducted from your Card Account",
              "detail": "The launch post says USDC stays on Solana until purchase and is then deducted from the Card Account.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No merchant data goes onchain. Every purchase is still a public, exactly sized transfer from a long-lived card vault, signed by Bridge's well-known key, so anyone can list a cardholder's spending amounts and timing. There are no fresh addresses or privacy patterns. Minimal linkage, documented, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://squads.xyz/legal/privacy-policy",
              "quote": "may be collected and processed by our financial services partners, such as Bridge Ventures, LLC",
              "detail": "The policy names Bridge and Lead Bank; the Fuse posts name Turnkey for email recovery; Visa is the network.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Bridge, Lead Bank, Visa, and Turnkey if used, see card activity. They are disclosed in docs, not swappable, and the app is closed. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B",
              "address": "12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B",
              "block_number": 454201823,
              "detail": "The sample Bridge spending limit has member AE2RGS1h..., period Day, 2,000 USDC and an empty destinations list; 1,723 of the 1,727 limits with that member have no destination restriction.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type:application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B\",{\"encoding\":\"base64\"}]}'"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/v4/blob/64af7330413d5c85cbbccfd8c27a05d45b6e666f/programs/squads_multisig_program/src/instructions/spending_limit_use.rs#L90-L135",
              "commit": "64af7330413d5c85cbbccfd8c27a05d45b6e666f",
              "path": "programs/squads_multisig_program/src/instructions/spending_limit_use.rs",
              "detail": "An empty destinations list means any destination is allowed (L124-L133); the member need not be a multisig member at this commit.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "At rest, funds stay in the user's Card Account, whose only member is the user's Main Account. When a purchase happens, Bridge pulls USDC into its own wallet and settles with the merchant off-chain, so funds in flight are provider-held. Bridge's key can also send up to the daily limit to any address, because the destination is unrestricted. Judgment call: that is a bounded ability to redirect funds, so 0. With a receiver-locked limit this would be 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf",
              "address": "SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf",
              "block_number": 454201918,
              "detail": "Program account points to programData Fy3YMJCvwbAXUgUM5b91ucUVA3jYzwWLHL3MwBqKsh8n, whose upgrade authority is None (immutable).",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type:application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"Fy3YMJCvwbAXUgUM5b91ucUVA3jYzwWLHL3MwBqKsh8n\",{\"encoding\":\"jsonParsed\",\"dataSlice\":{\"offset\":0,\"length\":0}}]}' | jq .result.value.data.parsed.info.authority"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/6AFbKVmLKT7a8Nwx3D8bUrcpWny3sFpR8DbjHYAZzGXk",
              "address": "6AFbKVmLKT7a8Nwx3D8bUrcpWny3sFpR8DbjHYAZzGXk",
              "block_number": 454202225,
              "detail": "The sample Main Account has config_authority = default, threshold 2 and members F6ow8NRv... (7), F7yCa8b4... (7) and Du5LoukF... (vote only); account configuration changes need the user's own keys.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The program is immutable, and the Main and Card Account configurations can only be changed by the user's own keys. No one at Squads or Bridge can change the code. Non-upgradeable, so 3. The Fuse app could steer users to a different program in future; that is outside this cell.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B",
              "address": "12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B",
              "block_number": 454201823,
              "detail": "The allowance granted to Bridge is a refilling 2,000 USDC per day spending limit with no destination restriction (1,656 of 1,727 limits use the 2,000 maximum).",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/blog/fuse-pay",
              "quote": "You can set a daily Spending Limit for Bridge",
              "detail": "The daily limit is disclosed and user-adjustable up to 2,000 USD.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The allowance is bounded and refilling, but it is not limited to one receiver, which anchor 2 requires. Judgment call: between 1 and 2, so I took the lower. It is disclosed, capped and user-adjustable, but the destination is open.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/v4/blob/64af7330413d5c85cbbccfd8c27a05d45b6e666f/programs/squads_multisig_program/src/instructions/vault_transaction_execute.rs#L60-L80",
              "commit": "64af7330413d5c85cbbccfd8c27a05d45b6e666f",
              "path": "programs/squads_multisig_program/src/instructions/vault_transaction_execute.rs",
              "detail": "A member-approved vault transaction executes after the multisig's time_lock (300 s on the Card Account); no Squads or Bridge signature is involved.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/support/fuse-visa-card",
              "quote": "Withdrawals are subject to a 5-minute security time lock",
              "detail": "Withdrawal from the Card Account to the Main Account is documented.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Chain of reasoning. S1: funds at rest sit in the user's own accounts, outside the spending limit. S2: the program is immutable and holds no provider key. C2 = 0 and C3 = 0: card settlement stops without Bridge and Fuse. O3 = 1: a public MIT Squads v4 client could drive the withdrawal, but self-hosting is unproven. Judgment call: the onchain withdrawal path is verified, but I found no evidence that the Device and 2FA keys can be used outside the closed Fuse app. Funds are retrievable through a documented manual contract call, so 1, not 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/README.md#L154-L177",
              "commit": "af94153ff77a28b6effe46b9c94baaa93742b48c",
              "path": "README.md",
              "detail": "The README lists ten audit reports (OtterSec, Neodyme, Certora, Trail of Bits) in audits/ and names 64af7330413d5c85cbbccfd8c27a05d45b6e666f as \"the final and fully audited commit\"; SECURITY.md describes a bug bounty process.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement program has audits pinned to a commit and a bounty process. The audited commit matches observed spending-limit behaviour, but no verified build ties it to the deployed bytecode (O1 = 0), and finding fixes are not linked. Fuse's own app and Bridge integration have no published audit. Judgment call: 1 rather than 2 because deployed-equals-audited is unproven.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The Fuse Card is a Lead Bank Prepaid Visa card. Lead Bank is a Missouri state-chartered bank (FDIC member per the Fuse Terms). Bridge Ventures LLC is Program Manager and Squads is Platform Provider; the agreement says card funds are not FDIC insured. The cardholder agreement includes binding arbitration. The privacy policy is issued by Selimor Investments Limited d/b/a Squads (BVI); the Fuse Terms are with Squads Inc.",
      "notes": "\"Fuse Card\" here is Squads' Fuse wallet card (fusewallet.com), not a Fuse Network (chain 122) product. A Fuse Network blog post announces a different card (Solid Card); no Fuse Card document mentions chain 122. Solana reads were taken through api.mainnet-beta.solana.com at slots 454199060-454202586, and the Bridge spender key was identified by getProgramAccounts over v4 SpendingLimit accounts with the USDC mint. Fuse's app and backend are closed, so O4, P5 and S5 are unknown. Card Map was used only to identify the product.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "US",
          "AR"
        ],
        "note": "The Fuse Visa Card support page lists 18 countries twice (in the card overview and in the FAQ \"Am I eligible for Fuse Card?\"): the U.S. (excluding residents of New York and Alaska), Argentina, Bolivia, Brazil, Colombia, Costa Rica, Dominican Republic, Ecuador, El Salvador, Ghana, Guatemala, Honduras, Mexico, Panama, Nigeria, Paraguay, Peru and Uruguay. The same FAQ answer then says the card is for users in the U.S. and Argentina only, followed by \"We are working to make Fuse Card available in more countries soon\". The page contradicts itself, so the more restrictive reading (US and AR) is used; the 18-country list is probably the newer text. In the US, residents of New York and Alaska are excluded. Applicants must be 18 or older and pass KYC via Bridge.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fusewallet.com/support/fuse-visa-card",
            "detail": "The FAQ answer limits the card to the U.S. and Argentina, excluding New York and Alaska.",
            "quote": "users in the U.S. and Argentina aged 18 or older, excluding residents of New York and Alaska",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fusewallet.com/support/fuse-visa-card",
            "detail": "The same page lists 18 countries, starting with the U.S. (excluding New York and Alaska) and ending with Paraguay, Peru and Uruguay.",
            "quote": "Fuse Card is currently available for users in",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true,
            "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
            "address": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"
          }
        ],
        "conversion": "at_spend",
        "note": "USDC on Solana is the only card asset. It stays in the user's Squads Card Account until a purchase, when Bridge pulls it through its daily spending limit and the merchant is paid in local currency over Visa.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fusewallet.com/blog/fuse-card",
            "detail": "The launch post says USDC stays on Solana in the Fuse wallet until a purchase, when the merchant gets local currency and the equivalent USDC is deducted from the Card Account.",
            "quote": "Your USDC stays on Solana in your Fuse wallet until the moment you make a purchase",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://solana.fm/address/12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B",
            "address": "12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B",
            "block_number": 454201823,
            "detail": "The sample Bridge spending limit's mint is USDC EPjFWdd5... (period Day, 2,000 USDC); all 1,727 limits with Bridge's member key use the USDC mint.",
            "checked_at": "2026-10-07",
            "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type:application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"12BqReNBFWSfQ3hSwjDuyUGyVmZMDj1VLh5ctG6LAK4B\",{\"encoding\":\"base64\"}]}' (bytes 73-104 = mint)"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "The Security section of the Squads-Protocol/v4 README and its audits/ folder (ten reports, read at af94153), Squads' public-v4-client repository (no reports), Fuse's site and support pages, and Bridge's card agreement. Fuse's iOS app, backend and Bridge's spending-limit key handling have no published audit. Coverage check: the SHA-256 of the deployed SQDS4ep65... program data (read 2026-10-13 from api.mainnet-beta.solana.com) is d48660833989ecea...f2fac, the program hash that the final 2024 OtterSec, Neodyme and Certora reports name as the audited build of 64af733.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Neodyme",
            "date": "2024-12-10",
            "type": "audit",
            "scope": "Squads v4 multisig program updates: transaction buffers and the custom allocator, reviewed October to November 2024.",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/neodyme_squads_v4_report_2024_final.pdf",
            "commit": "dcac867070a3073929e2240a053780c324f4c29f",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "yes",
            "findings": "1 low; remediated",
            "note": "The report states that the last reviewed revision corresponds to the deployed program hash d4866083...f2fac, which matches the program data read onchain on 2026-10-13."
          },
          {
            "auditor": "Certora",
            "date": "2024-11",
            "type": "formal_verification",
            "scope": "Squads v4 multisig program: security assessment and Certora Prover verification of the 2024 additions (transaction buffers and related changes), 3 September to 1 October 2024.",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/certora_squads_v4_security_report_and_formal_verification_2024_final.pdf",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "yes",
            "findings": "1 high, 2 low, 2 informational; all fixed",
            "note": "The report names program hash d4866083...f2fac as the latest audited build; the deployed program matches it."
          },
          {
            "auditor": "OtterSec",
            "date": "2024-12",
            "type": "audit",
            "scope": "Squads v4 multisig program: full audit at 7d79e69 with formal verification and follow-up reviews up to 64af733 (final report).",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/ottersec_squads_v4_report_2024_final.pdf",
            "commit": "64af7330413d5c85cbbccfd8c27a05d45b6e666f",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "yes",
            "findings": "3 low, 3 informational suggestions",
            "note": "Undated; added to the repository on 2024-12-09. The report names d4866083...f2fac as the onchain hash of the audited program, matching the deployed program."
          },
          {
            "auditor": "Neodyme",
            "date": "2024-02-06",
            "type": "audit",
            "scope": "Squads v4 multisig program updates: rent reclamation and global program config, January 2024.",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/neodyme_squads_v4_report_2024.pdf",
            "commit": "3742e5521a3e833f24a4c6bc024dd1aa5385d010",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "partly",
            "findings": "2 low, 2 informational; all accepted",
            "note": "Earlier revision of the deployed program; later changes were covered by the December 2024 reports."
          },
          {
            "auditor": "OtterSec",
            "date": "2024-02",
            "type": "audit",
            "scope": "Squads v4 multisig program: audit at 7d79e69 with formal verification and follow-up reviews up to 3742e55.",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/ottersec_squads_v4_audit_2024.pdf",
            "commit": "3742e5521a3e833f24a4c6bc024dd1aa5385d010",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "partly",
            "findings": "8 findings: 3 low, 3 suggestions, 2 formal verification findings",
            "note": "Undated; added to the repository on 2024-02-08. Superseded by the final 2024 report."
          },
          {
            "auditor": "Certora",
            "date": "2023-12",
            "type": "formal_verification",
            "scope": "Squads v4 multisig program: the October 2023 audit and formal verification plus an appendix on the rent reclamation and global program config PRs (#60 to #66).",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/certora_squads_v4_security_report_and_formal_verification_2024.pdf",
            "commit": "81842a7e37143537789e6d17fbe198700f8fe573",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "partly",
            "findings": "October 2023 findings plus 1 low/medium and 2 recommendations in the appendix"
          },
          {
            "auditor": "Trail of Bits",
            "date": "2023-10-19",
            "type": "audit",
            "scope": "Squads v4 multisig program (Rust/Anchor), with a fix review.",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/trail_of_bits_squads_v4_security_audit.pdf",
            "commit": "7d79e69c03892be468cce8acb51b6748b6262fbb",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "partly",
            "findings": "1 high, 1 medium, 6 informational, 1 undetermined; fix review marks most resolved, logging unresolved",
            "note": "Earlier revision of the deployed program."
          },
          {
            "auditor": "Certora",
            "date": "2023-10",
            "type": "formal_verification",
            "scope": "Squads v4 multisig program: manual security analysis (29 August to 5 October 2023) and formal verification.",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/certora_squads_v4_security_report_and_formal_verification.pdf",
            "commit": "81842a7e37143537789e6d17fbe198700f8fe573",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "partly",
            "findings": "1 medium/high, 3 low, 1 informational",
            "note": "Earlier revision of the deployed program; SQ-005 (spending-limit members not checked against multisig members) concerns the spending limits Fuse uses."
          },
          {
            "auditor": "Neodyme",
            "date": "2023-09-22",
            "type": "audit",
            "scope": "Squads v4 multisig program, full source including the September 2023 spending-limit instructions, plus design and social-engineering resilience.",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/neodyme_squads_v4_report.pdf",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "partly",
            "findings": "No critical or high; 2 medium, 2 low and informational issues; all addressed",
            "note": "Earlier revision of the deployed program."
          },
          {
            "auditor": "OtterSec",
            "date": "2023-09",
            "type": "audit",
            "scope": "Squads v4 multisig program, assessed 6 July to 22 September 2023.",
            "url": "https://github.com/Squads-Protocol/v4/blob/af94153ff77a28b6effe46b9c94baaa93742b48c/audits/ottersec_squads_v4_audit.pdf",
            "commit": "7d79e69",
            "repo": "https://github.com/Squads-Protocol/v4",
            "covers_deployed": "partly",
            "findings": "3 low, 3 informational suggestions",
            "note": "Earlier revision of the deployed program; superseded by the 2024 OtterSec reports."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S5"
          ]
        }
      },
      "tally": {
        "holds": 3,
        "short": 17,
        "unk": 3,
        "total": 23
      }
    },
    {
      "slug": "gnosis-pay",
      "name": "Gnosis Pay",
      "type": "card",
      "website": "https://gnosispay.com",
      "primary_chain": {
        "name": "Gnosis Chain",
        "chain_id": 100,
        "basis": "Gnosis Chain is the only chain the web app supports (gnosispay/ui src/wagmi.ts#L23 at 7fc844b: chains [gnosis]) and the Terms define the Safe as deployed to Gnosis Chain. Unit: the post-June-2026 account architecture pinned in account-kit 5.1.1 (9366073, src/deployments.ts#L56-L67) and a live account found from a Spend event at block 48629267. Excluded: pre-incident Safes and mastercopies, and the partner card programs that replace the consumer card after 20 Dec 2026."
      },
      "repos": [
        {
          "url": "https://github.com/gnosispay/account-kit",
          "role": "sdk",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/gnosispay/ui",
          "role": "frontend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/gnosispay/docs",
          "role": "docs",
          "license": "none"
        },
        {
          "url": "https://github.com/gnosispay/pse-react-native",
          "role": "sdk",
          "license": "none"
        },
        {
          "url": "https://github.com/gnosisguild/zodiac-modifier-delay",
          "role": "contracts",
          "license": "LGPL-3.0"
        },
        {
          "url": "https://github.com/gnosisguild/zodiac-modifier-roles",
          "role": "contracts",
          "license": "LGPL-3.0"
        },
        {
          "url": "https://github.com/safe-global/safe-smart-account",
          "role": "contracts",
          "license": "LGPL-3.0"
        }
      ],
      "contracts": [
        {
          "address": "0x7a592baE57b8cd45688F9Eb81ce4A622E7E37cB7",
          "chain_id": 100,
          "role": "Spender modifier mastercopy (account-kit 5.1.1)",
          "verified": "sourcify"
        },
        {
          "address": "0x22d903fd45F441F51bcad198D14eBa8a75EA1ef0",
          "chain_id": 100,
          "role": "Zodiac Delay modifier mastercopy (account-kit 5.1.1)",
          "verified": "sourcify"
        },
        {
          "address": "0x732B9E9f259fbA6f65A1a012DC89c20872ffBd2f",
          "chain_id": 100,
          "role": "Zodiac Roles v2 modifier mastercopy (account-kit 5.1.1)",
          "verified": "sourcify"
        },
        {
          "address": "0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552",
          "chain_id": 100,
          "role": "Safe v1.3.0 singleton used by account Safes",
          "verified": "sourcify"
        },
        {
          "address": "0x000000000000aDdB49795b0f9bA5BC298cDda236",
          "chain_id": 100,
          "role": "Zodiac ModuleProxyFactory",
          "verified": "sourcify"
        },
        {
          "address": "0x5f07734E2B9C4dE6f9C32253d485741800da3F8a",
          "chain_id": 100,
          "role": "Spender modifier instance (EIP-1167) for card spends",
          "verified": "none"
        },
        {
          "address": "0x896a695d5cCDd21F9e3Bb18307a558befCCb8428",
          "chain_id": 100,
          "role": "Gnosis Pay spender Safe (2-of-3), owner of spender modifier",
          "verified": "none"
        },
        {
          "address": "0x4822521E6135CD2599199c83Ea35179229A172EE",
          "chain_id": 100,
          "role": "Gnosis Pay settlement Safe (2-of-10), card spend receiver",
          "verified": "none"
        },
        {
          "address": "0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8",
          "chain_id": 100,
          "role": "Sample user account Safe (proxy)",
          "verified": "sourcify"
        },
        {
          "address": "0x91Def2b0C4894F4A574C5e3c6C7d0B8F51F53723",
          "chain_id": 100,
          "role": "Sample account Delay modifier instance (EIP-1167 proxy)",
          "verified": "none"
        },
        {
          "address": "0xd69693CA293e189b546691485D1500EA5150bA29",
          "chain_id": 100,
          "role": "Sample account Roles modifier instance (EIP-1167 proxy)",
          "verified": "none"
        },
        {
          "address": "0x4d5803A09D44D615A202E4831ee0CC14a803F562",
          "chain_id": 100,
          "role": "Sample account Bouncer (Roles owner)",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "User account Safe (Safe v1.3.0 proxy)",
          "role": "contracts",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "User (self-custodial; owner swapped to 0x...02 sentinel)",
          "required": true,
          "repo": "https://github.com/safe-global/safe-smart-account"
        },
        {
          "name": "Zodiac Delay modifier (per account)",
          "role": "contracts",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "User's account Safe (Gnosis Guild code)",
          "required": true,
          "repo": "https://github.com/gnosisguild/zodiac-modifier-delay"
        },
        {
          "name": "Zodiac Roles v2 modifier and Bouncer (per account)",
          "role": "contracts",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "User's account Safe (Gnosis Guild code; Bouncer from account-kit)",
          "required": true,
          "repo": "https://github.com/gnosisguild/zodiac-modifier-roles"
        },
        {
          "name": "Spender modifier (account-kit Spender.sol)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Gnosis Pay (owned by spender Safe 0x896a...8428)",
          "required": true,
          "repo": "https://github.com/gnosispay/account-kit"
        },
        {
          "name": "Gnosis Pay spender Safe (2-of-3) and settlement Safe (2-of-10)",
          "role": "contracts",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Gnosis Pay",
          "required": true,
          "repo": "https://github.com/safe-global/safe-smart-account"
        },
        {
          "name": "Monerium EURe token (default card currency; GBPe same issuer)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Monerium",
          "required": true
        },
        {
          "name": "account-kit SDK (account setup)",
          "role": "sdk",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Gnosis Pay",
          "required": false,
          "repo": "https://github.com/gnosispay/account-kit"
        },
        {
          "name": "Gnosis Pay web app",
          "role": "frontend",
          "public": true,
          "license": "MIT",
          "operator": "Gnosis Pay",
          "required": false,
          "repo": "https://github.com/gnosispay/ui"
        },
        {
          "name": "Gnosis Pay API and card authorisation backend",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Gnosis Pay",
          "required": true
        },
        {
          "name": "Spend delegate signer (EOA 0x9c48...4d4df)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Gnosis Pay",
          "required": true
        },
        {
          "name": "Spend relayer (EOA 0x9083...18De9)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Gnosis Pay",
          "required": true
        },
        {
          "name": "Card-transaction indexer and delay relay",
          "role": "indexer",
          "public": false,
          "license": "proprietary",
          "operator": "Gnosis Pay",
          "required": false
        },
        {
          "name": "Monavate (card issuer, e-money institution)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "UAB Monavate (EEA) / Monavate Ltd (UK, non-EEA)",
          "required": true
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Sumsub KYC",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sum and Substance Ltd",
          "required": true
        },
        {
          "name": "Pylon support widget",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Pylon",
          "required": false
        },
        {
          "name": "WalletConnect relay (via RainbowKit, hardcoded projectId)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "WalletConnect / Reown",
          "required": false
        },
        {
          "name": "PSE card-details service (partner secure elements)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Gnosis Pay",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/src/entrypoints/accounts-actions/accountSetup.ts#L169-L299",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "src/entrypoints/accounts-actions/accountSetup.ts",
              "detail": "Account setup swaps the Safe owner to 0x...02, enables only the Roles and Delay modifiers, and hands Roles ownership to a Bouncer; no pause, freeze or blacklist function is configured anywhere in the account.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x5f07734E2B9C4dE6f9C32253d485741800da3F8a",
              "address": "0x5f07734E2B9C4dE6f9C32253d485741800da3F8a",
              "block_number": 48629765,
              "detail": "Spender modifier owner() is the Gnosis Pay spender Safe 0x896a695d5cCDd21F9e3Bb18307a558befCCb8428 (2-of-3 EOAs, no timelock), which can enable or disable the delegate keys that execute every card spend; its only enabled delegate is EOA 0x9c48bc73841FD98456cB52f8A28580266d74d4df.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000896a695d5ccdd21f9e3bb18307a558befccb8428"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x896a695d5cCDd21F9e3Bb18307a558befCCb8428",
              "address": "0x896a695d5cCDd21F9e3Bb18307a558befCCb8428",
              "block_number": 48629765,
              "detail": "Spender Safe getThreshold() = 2 with owners 0x2FD460fD9aE6d71ee3231DfB827B85FCeC31Fa4f, 0x09Ab2E7F1E40D2Becc7da265f147aA7aaDd3d141, 0x9F7dfAb2222A473284205cdDF08a677726d786A0 (all EOAs, no code at block 48629765); I found no document naming who holds these keys.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000002"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x896a695d5cCDd21F9e3Bb18307a558befCCb8428",
              "address": "0x896a695d5cCDd21F9e3Bb18307a558befCCb8428",
              "block_number": 48629765,
              "detail": "Spender Safe getModulesPaginated(0x1,10) returns exactly one module, 0x5f07734E2B9C4dE6f9C32253d485741800da3F8a (the spender modifier, whose avatar(), target() and owner() are all this Safe); isModuleEnabled(0x5f07...) = true.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x2d9ad53d0000000000000000000000005f07734e2b9c4de6f9c32253d485741800da3f8a",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0x896a695d5cCDd21F9e3Bb18307a558befCCb8428 \"getModulesPaginated(address,uint256)(address[],address)\" 0x0000000000000000000000000000000000000001 10 --rpc-url https://rpc.gnosischain.com --block 48629765; for f in \"avatar()(address)\" \"target()(address)\" \"owner()(address)\"; do cast call 0x5f07734E2B9C4dE6f9C32253d485741800da3F8a \"$f\" --rpc-url https://rpc.gnosischain.com --block 48629765; done",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x896a695d5cCDd21F9e3Bb18307a558befCCb8428",
              "address": "0x896a695d5cCDd21F9e3Bb18307a558befCCb8428",
              "block_number": 48629765,
              "detail": "Spender Safe guard slot 0x4a204f62...c34c8 is zero (no transaction guard); fallback handler slot holds the Safe 1.3.0 CompatibilityFallbackHandler 0xf48f2B2d2a534e402487b3ee7C18c33Aec0Fe5e4. No timelock contract sits between the Safe and the spender modifier.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "recheck": "cast storage 0x896a695d5cCDd21F9e3Bb18307a558befCCb8428 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8 --rpc-url https://rpc.gnosischain.com --block 48629765",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x5f07734E2B9C4dE6f9C32253d485741800da3F8a",
              "address": "0x5f07734E2B9C4dE6f9C32253d485741800da3F8a",
              "block_number": 48629765,
              "detail": "Spender modifier getModulesPaginated(0x1,10) returns one delegate, 0x9c48bc73841FD98456cB52f8A28580266d74d4df; isModuleEnabled(0x9c48...) = true. Any one enabled delegate can call spend() with no Safe signature.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x2d9ad53d0000000000000000000000009c48bc73841fd98456cb52f8a28580266d74d4df",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0x5f07734E2B9C4dE6f9C32253d485741800da3F8a \"getModulesPaginated(address,uint256)(address[],address)\" 0x0000000000000000000000000000000000000001 10 --rpc-url https://rpc.gnosischain.com --block 48629765",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x9c48bc73841FD98456cB52f8A28580266d74d4df",
              "address": "0x9c48bc73841FD98456cB52f8A28580266d74d4df",
              "block_number": 48629765,
              "eoa": true,
              "detail": "The spend delegate 0x9c48bc73... has no code and nonce 0 at block 48629765, so it is a single EOA key that signs offchain; spends are submitted by relayer EOA 0x90830Ed558f12D826370DC52E9D87947A7F18De9.",
              "checked_at": "2026-10-07",
              "recheck": "cast code 0x9c48bc73841FD98456cB52f8A28580266d74d4df --rpc-url https://rpc.gnosischain.com --block 48629765; cast nonce 0x9c48bc73841FD98456cB52f8A28580266d74d4df --rpc-url https://rpc.gnosischain.com --block 48629765"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/contracts/Spender.sol#L29-L82",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "contracts/Spender.sol",
              "detail": "setUp sets avatar = target = owner; execTransactionFromModule and execTransactionFromModuleReturnData are overridden with empty bodies; spend() (moduleOnly) makes the target Safe call account.execTransactionWithRole(asset, 0, transfer(receiver, amount), Call, roleKey, true), with account, receiver, amount and roleKey chosen by the delegate.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/2178874711",
              "detail": "Terms of Service say that if Monavate tells Gnosis Pay not to fund a card transaction from the Safe, or to block the card, Gnosis Pay will act on it without liability; elsewhere they let Gnosis Pay suspend services or account access with or without notice.",
              "quote": "if we are told by Monavate not to permit (or to permit) a transaction on your Card to be funded by your Safe, or to block your Card, we will act on such instruction",
              "archive": "data/archive/gnosis-pay-terms.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/2178874711",
              "detail": "Terms of Service document the user exit delay as 3 minutes on non-card transactions from the Safe (the Delay modifier cooldown, 180 s onchain).",
              "quote": "a 3 minute delay is imposed on execution of any non-Card transactions that you carry out from your Safe",
              "archive": "data/archive/gnosis-pay-terms.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Funds at rest cannot be frozen: the account Safe has no guard, its only modules are the user's Delay and Roles modifiers, and Gnosis Pay holds no key over them. Card settlement is different. Every card spend is Spender.spend(), which only an enabled delegate can call, and the one delegate is EOA 0x9c48bc73... A single EOA can stop or selectively withhold settlement, which meets anchor 0 on its own. The delegate list is controlled by spender Safe 0x896a695d... It is 2-of-3, its three EOA signers are not named in any document I found, it has no guard, and there is no timelock (the documented user exit is 3 minutes). It misses every anchor-2 condition. Module check (red team R7): the spender Safe's only module is the spender modifier itself (avatar = target = owner = the Safe). Through it, one delegate key can make the Safe call execTransactionWithRole on any account it names. The inner payload is fixed to token.transfer(receiver, amount), the modifier's generic exec functions are emptied, and changing delegates, owners or settings still needs 2 signatures. On user accounts the payload is limited by each account's Roles scope, read from the setup events (see S1): one token, receiver = settlement Safe 0x4822521E..., amount within the daily allowance. So the module does bypass the 2-of-3 threshold, but only to pull up to each account's remaining allowance into Gnosis Pay's settlement Safe. Separately, the Terms let Gnosis Pay block an individual card on Monavate's instruction. The EOA-held delegate (verified) and the card-block power (documented) each meet anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/contracts/Spender.sol#L56-L82",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "contracts/Spender.sol",
              "detail": "spend(asset, account, receiver, amount, roleKey) is moduleOnly, so only a delegate enabled by the Gnosis Pay spender Safe can move funds to the settlement receiver; source is identical to the Sourcify exact match for mastercopy 0x7a592baE57b8cd45688F9Eb81ce4A622E7E37cB7.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/tx/0xf99c9e1cfaef7a2a4e5226099ad60463abf9a900d4d954e877a55bab83a300cb",
              "address": "0x5f07734E2B9C4dE6f9C32253d485741800da3F8a",
              "block_number": 48629267,
              "detail": "Sample card spend tx 0xf99c9e1c...a300cb was submitted by relayer EOA 0x90830Ed558f12D826370DC52E9D87947A7F18De9 to the spender modifier (selector 0x8a320255) and moved EURe from account Roles modifier 0xd69693CA... to settlement Safe 0x4822521E....",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "A merchant (payee) is paid through Visa and the issuer offchain; onchain, the only settlement step is a spend() that requires a Gnosis Pay delegate signature and is relayed by a Gnosis Pay relayer. Neither payer nor payee can complete a card payment by calling the contracts directly. The user's own withdrawal path is direct (see S4), but that is exit, not settlement.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/main.tsx#L25-L39",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/main.tsx",
              "detail": "The frontend defaults its API client to api.gnosispay.com (overridable by VITE_GNOSIS_PAY_API_BASE_URL); no public implementation of that API exists in any gnosispay repo.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/README.md#L159-L180",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "README.md",
              "detail": "The Spend section requires a signature from the spend delegate configured in the Gnosis Pay Spender Safe and a relayer to submit it.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/1452055581-formal-notice-closure-of-the-gnosis-pay-web-app-and-card-21-september-2026",
              "detail": "Closure notice names Monavate (EMI) as card issuer and Gnosis Pay as program manager and card management platform; the card stops working at 23:59 UTC on 20 December 2026.",
              "quote": "Your card and the web app will stop working at 23:59 UTC on 20 December 2026.",
              "archive": "data/archive/gnosis-pay-closure-notice.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card flow requires Gnosis Pay's closed backend (authorisation, spend delegate, relayer) plus the issuer Monavate and Visa. None of it is public or has a fallback. Single-vendor and closed for the payment path.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/pages/Kyc.tsx#L13-L62",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/pages/Kyc.tsx",
              "detail": "The KYC route hands the user to a Sumsub integration URL fetched from the Gnosis Pay API; eligibility screening runs in the closed backend. A search of src/ for sanctions lists, IP geolocation or address blocklists found none.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/constants.ts#L82-L115",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/constants.ts",
              "detail": "SUPPORTED_COUNTRIES lists 32 EEA/UK/CH country codes; it is defined but not referenced elsewhere in src/ at this commit (shipping uses SUPPORTED_SHIPPING_COUNTRIES at L1615-L1634).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/2178874711",
              "detail": "Terms of Service eligibility excludes persons on UN, EU, US or UK sanctions lists and residents of sanctioned countries, and forbids VPNs or mixers to circumvent restrictions.",
              "quote": "United Nations, European Union and its Member States, United States and United Kingdom sanctions lists",
              "archive": "data/archive/gnosis-pay-terms.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/contracts/Spender.sol#L56-L82",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "contracts/Spender.sol",
              "detail": "spend() has no address list, country or screening check; the only onchain conditions on a card spend are the per-account Roles scope (token, receiver = settlement Safe, amount within allowance), read from the Roles setup events cited under S1.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/onboarding-flow.mdx#L86-L88",
              "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
              "path": "onboarding-flow.mdx",
              "detail": "The versioned docs repo describes the Sumsub KYC step for card orders but says nothing about sanctions or country screening or its list source; a grep of the repo for sanction, countries, geolocation and blocked found no screening disclosure.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Re-assessed against the revised anchor. The settlement contracts are neutral: Spender.spend() and the Roles scope contain no address list or geographic check. Edge filtering exists. The Terms exclude people on UN, EU, US or UK sanctions lists and residents of sanctioned countries, and forbid VPNs used to get around this; screening runs in Sumsub and the closed backend. That disclosure is in the hosted Terms only. Neither the frontend code nor the versioned docs repo describes the screening or names its list source. The card path has no direct route (C2 = 0), so the filtering cannot be bypassed. Anchor 1 (\"edge filtering is disclosed in docs only\") fits. A 2 would need disclosure in code or a repo document, and a 3 would also need a bypass and public required components. Note: which spends are executed is decided offchain by the delegate key (see C1), so the contracts are neutral but the settlement step as a whole is not.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/constants/currencies.ts#L7-L30",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/constants/currencies.ts",
              "detail": "Supported tokens enumerated in code - EURe 0xcB444e90D8198415266c6a2724b7900fb12FC56E (v2 0x420CA0f9...), GBPe 0x5Cb9073902F2035222B9749F8fB0c9BFe5527108, USDC.e 0x2a22f9c3b484c3629090FeED35F17Ff8F88f76F0, all on Gnosis Chain.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x420CA0f9B9b604cE0fd9C18EF134C705e5Fa3430",
              "address": "0x420CA0f9B9b604cE0fd9C18EF134C705e5Fa3430",
              "block_number": 48629765,
              "detail": "Monerium EURe v2 validator() = 0xfE74A522768547be33A3ad40B999381d57f238A0, a BlacklistValidatorUpgradeable proxy (Sourcify exact match on impl 0x614fcc5b...) exposing ban/unban; EURe owner() is Monerium Safe 0x8001EA269cb9715Bf7acFf89c664ffC134A519ec (3-of-6), UUPS-upgradeable; GBPe v2 0x8E34bfEC... uses the same validator.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x3a5381b5",
                "expect": "0x000000000000000000000000fe74a522768547be33a3ad40b999381d57f238a0"
              },
              "recheck": "cast call 0x420CA0f9B9b604cE0fd9C18EF134C705e5Fa3430 \"validator()(address)\" --rpc-url https://rpc.gnosischain.com --block 48629765; cast call 0x2a22f9c3b484c3629090FeED35F17Ff8F88f76F0 \"blacklister()(address)\" --rpc-url https://rpc.gnosischain.com --block 48629765",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x2a22f9c3b484c3629090FeED35F17Ff8F88f76F0",
              "address": "0x2a22f9c3b484c3629090FeED35F17Ff8F88f76F0",
              "block_number": 48629765,
              "detail": "Bridged USDC (Gnosis) blacklister(), pauser() and owner() all return 0x458cd345B4C05e8DF39d0A07220feb4Ec19F5e6f (a Safe, threshold 3).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xbd102430",
                "expect": "0x000000000000000000000000458cd345b4c05e8df39d0a07220feb4ec19f5e6f"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/2178874711",
              "detail": "Terms define EURe and GBPe as Monerium e-money tokens and USDCe as Circle USDC bridged to Gnosis Chain, but say nothing about issuer freeze, ban or burn powers.",
              "quote": "means euro electronic money tokens issued by Monerium",
              "archive": "data/archive/gnosis-pay-terms.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens and chain are enumerated in code. Each one carries an issuer freeze: Monerium's blacklist validator can ban addresses for EURe and GBPe, and the bridged USDC contract has a blacklister and pauser. Neither the Terms nor the docs tell cardholders about these powers. Gnosis Chain is an L1 with no sequencer, which is also not stated. Enumerated in code, assumptions not stated, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/100/0x7a592baE57b8cd45688F9Eb81ce4A622E7E37cB7",
              "address": "0x7a592baE57b8cd45688F9Eb81ce4A622E7E37cB7",
              "block_number": 48629765,
              "detail": "Sourcify v2 reports exact_match for the Spender (0x7a592b...), Delay (0x22d903...), Safe 1.3.0 (0xd9Db27...), ModuleProxyFactory (0x0000...a236) and Bouncer (0x4d5803...); Roles mastercopy 0x732B9E... is match (partial, not exact).",
              "checked_at": "2026-10-07",
              "recheck": "for a in 0x7a592baE57b8cd45688F9Eb81ce4A622E7E37cB7 0x22d903fd45F441F51bcad198D14eBa8a75EA1ef0 0x732B9E9f259fbA6f65A1a012DC89c20872ffBd2f 0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552 0x000000000000aDdB49795b0f9bA5BC298cDda236 0x4d5803A09D44D615A202E4831ee0CC14a803F562; do curl -s https://sourcify.dev/server/v2/contract/100/$a | jq -r '.address + \" \" + .match'; done"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0xd69693CA293e189b546691485D1500EA5150bA29",
              "address": "0xd69693CA293e189b546691485D1500EA5150bA29",
              "block_number": 48629765,
              "detail": "Per-account Roles, Delay and Spender instances are EIP-1167 minimal proxies (runtime code 0x363d3d37...5af43d82803e903d91602b57fd5bf3 pointing at the mastercopies) and are not themselves on Sourcify; the spender and settlement Safes are not on Sourcify either.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/src/deployments.ts#L56-L67",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "src/deployments.ts",
              "detail": "SDK pins the Delay, Roles and Spender mastercopy addresses checked above.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every mastercopy that holds logic is verified on Sourcify, five of six as exact matches; Roles is a partial match. The minimal-proxy instances delegate to those verified mastercopies. Spender.sol and Bouncer.sol at the pinned commit are byte-identical to the Sourcify sources (apart from a trailing newline). There is no documented script that rebuilds the deployed bytecode from a pinned commit, and Roles is partial, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/package.json#L12-L13",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "package.json",
              "detail": "The frontend generates its API client from the published OpenAPI spec at https://api.gnosispay.com/api-docs/spec.json; the generated client is committed under src/client.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/gnosispay/ui/contents/package.json?ref=7fc844b4bb779ed1384468008b9a3eb2e7cf59f2\" --jq .content | base64 -d | sed -n 12,13p; gh repo list gnosispay --limit 50",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/tree/9366073768f4ad8a321c03832066f6b97921b21a/contracts",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "contracts",
              "detail": "SDK and Gnosis Pay contracts (Spender, Bouncer) are public; the gnosispay org lists account-kit, ui, docs, pse-react-native and siwe-demo-app, and no backend, indexer, relayer or spender-service repository.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Public: SDK, contracts, the full web app frontend (with Dockerfile and deploy workflows), a PSE demo backend, and docs. Closed: the Gnosis Pay API, card-transaction indexer, delay relay and spend service. The API schema is published (hosted OpenAPI plus a committed generated client). This is \"everything except the backend, with the API schema published\".",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/README.md#L1-L18",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "README.md",
              "detail": "README lists env vars (PSE relay route, PSE app id from Gnosis Pay partner registration, API base URL, RPC URL) and build commands; contract addresses live in account-kit src/deployments.ts.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Re-assessed against the revised anchor: a 3 needs a recorded attempt or a deploy script with a recorded successful test payment, and a 2 needs a recorded reproduction. Build docs exist for the frontend and SDK. Reproduction not attempted. Known blockers from the README alone: a working deployment needs a Gnosis Pay-issued PSE app id and the hosted Gnosis Pay API. No deploy script in any gnosispay repo completes a test card payment, and one could not, because the spend delegate, relayer, issuer and network are closed. Stays 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/scripts/abi/spender.json#L239-L269",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "scripts/abi/spender.json",
              "detail": "ABIs for spender, delay, roles and moduleProxyFactory are committed under scripts/abi, including the Spend event definition.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/gnosispay/account-kit/contents/scripts/abi?ref=9366073768f4ad8a321c03832066f6b97921b21a\" --jq '.[].name'; gh api \"repos/gnosispay/account-kit/contents/scripts/abi/spender.json?ref=9366073768f4ad8a321c03832066f6b97921b21a\" --jq .content | base64 -d | sed -n 239,269p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/client/types.gen.ts#L1-L5",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/client/types.gen.ts",
              "detail": "Types generated from the Gnosis Pay OpenAPI spec by @hey-api/openapi-ts (header at L1, baseUrl api.gnosispay.com at L4) are versioned in the frontend repo (4626 lines).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/utils/csvDownloadUtils.ts#L172-L200",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/utils/csvDownloadUtils.ts",
              "detail": "The cardholder can export card transactions as CSV.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ABIs, event definitions and an API schema (generated from OpenAPI) are in repos. The only export is a cardholder-side CSV of card transactions; there is no payee (merchant) export, because merchants are paid through Visa. Judgment call: the payee-export requirement is not met, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/LICENSE#L1-L3",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "LICENSE",
              "detail": "account-kit is Apache License 2.0.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/LICENSE#L1-L3",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "LICENSE",
              "detail": "ui is MIT (Copyright 2025 Gnosis Pay).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosisguild/zodiac-modifier-delay/blob/221382ead4022eba81b7d311c54b76889f8b4e15/LICENSE#L1-L2",
              "commit": "221382ead4022eba81b7d311c54b76889f8b4e15",
              "path": "LICENSE",
              "detail": "zodiac-modifier-delay is LGPL-3.0; zodiac-modifier-roles (820e5bc9) and safe-smart-account (f8fc2f2e) are also LGPL-3.0.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/Readme.md",
              "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
              "path": "Readme.md",
              "detail": "The docs repo tree at this commit (47 files) has no LICENSE file and the Readme names none; pse-react-native at 9446024d has no LICENSE either.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Contracts, SDK and frontend all carry OSI licences (Apache-2.0, MIT, LGPL-3.0). Two non-critical repos, docs and pse-react-native, have none. F1 is now scored against the component inventory, not only the listed repos. A card payment cannot complete without closed, proprietary components: the Gnosis Pay API and authorisation backend, the spend delegate signer, the relayer, Monavate, Visa and Sumsub. A closed required component cannot be forked, so F1 is 0. On the public repos alone this would have been 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosisguild/zodiac-modifier-delay/blob/221382ead4022eba81b7d311c54b76889f8b4e15/.github/workflows/cla.yml#L12-L22",
              "commit": "221382ead4022eba81b7d311c54b76889f8b4e15",
              "path": ".github/workflows/cla.yml",
              "detail": "CLA Assistant enforces the Gnosis CLA (github.com/gnosis/CLA), which grants Gnosis a perpetual, sublicensable copyright license to contributions; zodiac-modifier-roles and zodiac carry the same workflow.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/README.md#L199-L205",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "README.md",
              "detail": "account-kit and ui have no CLA, CONTRIBUTING or license-stability statement; account-kit had no LICENSE until commit c3ca5372 (2025-10-16, Apache-2.0).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Gnosis Pay's own repos have no CLA and no commitment (that alone would be 2). The Delay and Roles modifiers that gate every account are maintained under a Gnosis CLA that permits relicensing, and there is no license-stability commitment. Judgment call: I could not establish whether Gnosis Pay counts as a Gnosis affiliate under that CLA, so I took the lower anchor (0). Deployed mastercopies are immutable, so the risk applies to future versions only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/README.md#L5-L11",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "README.md",
              "detail": "Running the frontend needs a PSE app id obtained by registering as a Gnosis Pay partner and the Gnosis Pay API (prod by default).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/README.md#L159-L180",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "README.md",
              "detail": "Card spends need the delegate configured in the Gnosis Pay Spender Safe.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The core product, card payments, cannot run without Gnosis Pay's proprietary backend and partner credentials, and without the issuer (Monavate) and Visa. The onchain account works on its own for holding and withdrawing, but not as a payment rail.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/index.html#L43-L47",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "index.html",
              "detail": "The Pylon chat widget script from widget.usepylon.com is injected on every page load with no opt-in.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/hooks/usePylonIdentity.tsx#L8-L35",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/hooks/usePylonIdentity.tsx",
              "detail": "Once identified, the app passes the user's email, name and Safe address to Pylon. package.json has no Sentry, PostHog, Mixpanel, Amplitude or GA dependency.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/7638555831",
              "detail": "Privacy and Cookies Policy discloses Google analytics and advertising cookies on its Platforms, and support partners who receive account data.",
              "quote": "Google may use the collected data to contextualise and personalise the ads of its own advertising network",
              "archive": "data/archive/gnosis-pay-privacy.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A third-party support widget (Pylon) is on by default in the web app and receives identity plus the Safe address; the privacy policy discloses analytics (Google) and support partners. No analytics or error-reporting SDK appears in the frontend manifest. No trace was run, so what the Pylon script collects at runtime is unconfirmed. Judgment call: Pylon is a support SDK, not analytics, but it is a third-party script loaded on every page; treated as present, on by default and disclosed generically, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/pages/Kyc.tsx#L13-L62",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/pages/Kyc.tsx",
              "detail": "Onboarding requires completing Sumsub KYC before the card flow; the reason (regulated card) is visible in the flow.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/7638555831",
              "detail": "Policy lists name, nationality, home address, IP address, date and place of birth, ID and proof-of-address documents, biometric data, source of wealth, expected card spending and signing-wallet addresses; Sumsub is the named KYC provider. It states a legal basis per purpose, including explicit consent for biometrics.",
              "quote": "In relation to Biometric Information, we obtain your explicit consent in accordance with Article 6(1)(a) and Article 9(2)(a) of GDPR and UK GDPR",
              "archive": "data/archive/gnosis-pay-privacy.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/7752555767-what-happens-to-your-data",
              "detail": "KYC and transaction records are kept 5 years after account closure.",
              "quote": "We're legally required to keep certain records after your account closes.",
              "archive": "data/archive/gnosis-pay-data.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/onboarding-flow.mdx#L86-L88",
              "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
              "path": "onboarding-flow.mdx",
              "detail": "The versioned partner docs describe the mandatory Sumsub KYC step before a card order, but state no legal basis for it and do not limit the fields collected.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Re-assessed against the revised anchor. Full KYC is required for the regulated card: identity documents, a biometric photo, source of wealth and expected spending, collected through Sumsub. The privacy policy discloses each category and gives a legal basis for each purpose: the contract, a legitimate interest in enabling the regulated partner's KYC and AML checks, and explicit consent for biometrics. The partner docs repo and the frontend show the KYC step. Anchor 2 now credits legally required collection disclosed with its legal basis, but only when that disclosure is in code or a versioned repo document. Here the legal basis appears only in the hosted policy, so the documented cap of 1 applies. Judgment call: the policy also covers processing beyond the KYC and AML requirement, namely marketing data, analytics and advertising cookies, and legitimate-interest use of transaction and device data to improve and market the product. The cookie and marketing items are consent-based. I read the whole as collection disclosed in a policy (1) rather than undisclosed or beyond-requirement collection (0). A stricter reading of the legitimate-interest uses would give 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/contracts/Spender.sol#L21-L22",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "contracts/Spender.sol",
              "detail": "The Spend event emits asset, account (the user's Roles modifier), receiver and amount; there is no merchant, MCC or invoice field.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/tx/0xf99c9e1cfaef7a2a4e5226099ad60463abf9a900d4d954e877a55bab83a300cb",
              "address": "0x5f07734E2B9C4dE6f9C32253d485741800da3F8a",
              "block_number": 48629267,
              "detail": "Sample spend shows an EURe Transfer from the user's Safe 0xE27aa566... to the fixed settlement Safe 0x4822521E... (5 EURe) plus the Spend event.",
              "checked_at": "2026-10-07",
              "recheck": "cast receipt 0xf99c9e1cfaef7a2a4e5226099ad60463abf9a900d4d954e877a55bab83a300cb --rpc-url https://rpc.gnosischain.com"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/7752555767-what-happens-to-your-data",
              "detail": "Help article says onchain transactions stay visible on Gnosis Chain and show fund movement but not merchant names or card-level detail.",
              "quote": "That shows the movement of funds, but not merchant names or card-level detail.",
              "archive": "data/archive/gnosis-pay-data.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No merchant or order data goes onchain. Every card purchase is still a public transfer from one long-lived Safe to one well-known settlement address, so anyone can read a cardholder's spending amounts and timing and identify the Safe as a Gnosis Pay card. There are no fresh addresses or privacy patterns. This is minimal linkage that is documented, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/wagmi.ts#L5-L28",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/wagmi.ts",
              "detail": "WalletConnect projectId is hardcoded via RainbowKit; RPC transport is configurable.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/index.html#L43-L47",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "index.html",
              "detail": "The Pylon widget URL and app id are hardcoded, with no config switch.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/7638555831",
              "detail": "Policy names Sumsub (KYC), Google (analytics/ads), and card, distribution and support partners.",
              "quote": "Our current KYC Provider is SUM AND SUBSTANCE LTD",
              "archive": "data/archive/gnosis-pay-privacy.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/6763083779-legal-documents-and-fees",
              "detail": "Legal page states the card is issued by Monavate pursuant to licence by VISA Europe Limited.",
              "quote": "Your Gnosis Pay card is issued by Monavate Limited pursuant to licence by VISA Europe Limited.",
              "archive": "data/archive/gnosis-pay-legal-docs.txt",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A card payment is seen by Visa, Monavate and Gnosis Pay's backend, which are disclosed in docs and not swappable. In the web app, WalletConnect and Pylon are named in code but hardcoded; only the RPC and API base URL are configurable. No trace was run. Third parties are present and disclosed but not swappable by config, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/wagmi.ts#L7-L26",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/wagmi.ts",
              "detail": "RPC URL comes from VITE_GNOSIS_RPC_URL (env only); onchain transfer history is read by getLogs over that same RPC (src/utils/fetchErc20Transfers.ts).",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/gnosispay/ui/contents/src/wagmi.ts?ref=7fc844b4bb779ed1384468008b9a3eb2e7cf59f2\" --jq .content | base64 -d | sed -n 7,26p; gh api \"repos/gnosispay/ui/contents/src/main.tsx?ref=7fc844b4bb779ed1384468008b9a3eb2e7cf59f2\" --jq .content | base64 -d | sed -n 25,39p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/main.tsx#L25-L39",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/main.tsx",
              "detail": "The API (card-transaction data source) base URL is env-configurable via VITE_GNOSIS_PAY_API_BASE_URL, but its implementation is not public.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The RPC and API endpoints are configurable through build-time env only, not in the UI. Onchain history uses the configured RPC directly. The card-transaction indexer is closed, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/100/0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8",
              "address": "0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8",
              "block_number": 48629765,
              "detail": "Sample account Safe has threshold 1 with sole owner 0x...02 (unusable sentinel), and only the Delay 0x91Def2b0... and Roles 0xd69693CA... modifiers are enabled.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x2f54bf6e0000000000000000000000000000000000000000000000000000000000000002",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x4822521E6135CD2599199c83Ea35179229A172EE",
              "address": "0x4822521E6135CD2599199c83Ea35179229A172EE",
              "block_number": 48629765,
              "detail": "Settlement receiver is a Gnosis Pay Safe (proxy to Safe L2 1.3.0) with getThreshold() = 2 and 10 owners.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000002"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/src/entrypoints/accounts-actions/accountSetup.ts#L240-L296",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "src/entrypoints/accounts-actions/accountSetup.ts",
              "detail": "The spending role is scoped to token.transfer with recipient EqualTo the configured receiver and amount WithinAllowance; Roles ownership then passes to a Bouncer that only forwards setAllowance from the Safe.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/constants.ts#L78",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/constants.ts",
              "detail": "GNOSIS_PAY_SETTLEMENT_ADDRESS = 0x4822521E6135CD2599199c83Ea35179229A172EE is disclosed in code.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/tx/0x2a9c14e83961db1f9c501ba04777fcd8f3141f188fc07017ef4b1c17a32de0a8",
              "address": "0xd69693CA293e189b546691485D1500EA5150bA29",
              "block_number": 46534712,
              "detail": "The sample account's Roles setup tx (block 46534712) emits EnabledModule(0x896a...8428), AssignRoles(0x896a...8428, [keccak(\"SPENDING_ROLE\")], [true]), ScopeTarget(EURe 0xcB444e90D8198415266c6a2724b7900fb12FC56E), and ScopeFunction(selector 0xa9059cbb transfer, conditions [Matches calldata; param 0 EqualTo 0x4822521E...72EE; param 1 WithinAllowance keccak(\"SPENDING_ALLOWANCE\")], ExecutionOptions 0 = no value, no delegatecall). Every later log from this Roles instance up to block 48629267 is ConsumeAllowance (topic 0x90355d54...), so the scope has not changed.",
              "checked_at": "2026-10-07",
              "recheck": "cast receipt 0x2a9c14e83961db1f9c501ba04777fcd8f3141f188fc07017ef4b1c17a32de0a8 --rpc-url https://rpc.gnosischain.com --json | jq -r '.logs[] | select(.topics[0]==\"0x4f6c340456f64db31a3d003c1224ba1de058557b1cdf71f21ae48ce4a4f64f52\") | .data' | xargs cast decode-event --sig \"ScopeFunction(bytes32,address,bytes4,(uint8,uint8,uint8,bytes)[],uint8)\"; curl -sL \"https://gnosis.blockscout.com/api?module=logs&action=getLogs&address=0xd69693CA293e189b546691485D1500EA5150bA29&fromBlock=0&toBlock=latest\" | jq -r '.result[].topics[0]' | sort | uniq -c"
            }
          ],
          "finding": "At rest, funds sit in the user's own Safe and Gnosis Pay cannot redirect them. The Roles setup events (now read onchain, not only from SDK code) show that the only role member is the spender Safe. Its only permission is EURe.transfer to settlement Safe 0x4822521E..., within the daily allowance, with no delegatecall. Only the user's Safe can change that allowance, through the Bouncer. When a card payment happens, funds move into the Gnosis Pay-held 2-of-10 settlement Safe and reach the merchant offchain through Monavate and Visa. A provider-held wallet disclosed in code scores 1. Module check (red team R7): one delegate EOA can call spend() through the spender Safe's module without the 2-of-3 threshold. Nothing onchain ties a pull to a card authorisation, so a single compromised or misused delegate key could move up to each account's remaining daily allowance into the settlement Safe. Judgment call: the destination is fixed to the disclosed settlement Safe and the amount is capped, so I read this as provider custody in flight (1), not as the provider being able to redirect funds (0).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/100/0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8",
              "address": "0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8",
              "block_number": 48629765,
              "detail": "Account Safe proxy slot 0 (masterCopy) = Safe 1.3.0 singleton 0xd9Db270c...; only the Safe itself can change it, and its sole owner is the 0x...02 sentinel, so a change has to come from the user's own Delay queue.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x0",
                "expect": "0x000000000000000000000000d9db270c1b5e3bd161e8c8503c55ceabee709552"
              },
              "recheck": "cast storage 0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8 0x0 --rpc-url https://rpc.gnosischain.com --block 48629765; cast call 0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8 \"getOwners()(address[])\" --rpc-url https://rpc.gnosischain.com --block 48629765",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/100/0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8",
              "address": "0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8",
              "block_number": 48629765,
              "detail": "Account Safe guard slot 0x4a204f62...c34c8 is zero, and getModulesPaginated(0x1,10) returns only Delay 0x91Def2b0... and Roles 0xd69693CA...; the Roles scope (S1, setup events) allows only EURe.transfer to the settlement Safe with no delegatecall, so no module can change the Safe's masterCopy except the user's own Delay queue.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "recheck": "cast storage 0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8 --rpc-url https://rpc.gnosischain.com --block 48629765; cast call 0xE27aa566F989D832094222d9D71d0Ffd8fb78cD8 \"getModulesPaginated(address,uint256)(address[],address)\" 0x0000000000000000000000000000000000000001 10 --rpc-url https://rpc.gnosischain.com --block 48629765",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x91Def2b0C4894F4A574C5e3c6C7d0B8F51F53723",
              "address": "0x91Def2b0C4894F4A574C5e3c6C7d0B8F51F53723",
              "block_number": 48629765,
              "detail": "Delay instance runtime code is the EIP-1167 minimal proxy to 0x22d903fd... (non-upgradeable), and its owner() is the account Safe; Roles 0xd69693CA... (to 0x732B9E9f...) and Spender 0x5f07734E... (to 0x7a592baE...) are also EIP-1167.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000e27aa566f989d832094222d9d71d0ffd8fb78cd8"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0xd69693CA293e189b546691485D1500EA5150bA29",
              "address": "0xd69693CA293e189b546691485D1500EA5150bA29",
              "block_number": 48629765,
              "detail": "Roles owner() = Bouncer 0x4d5803A0... whose from = account Safe, to = Roles, selector = 0xa8ec43ee (setAllowance) - so Gnosis Pay cannot re-scope the role.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000004d5803a09d44d615a202e4831ee0cc14a803f562"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Re-assessed against the revised anchor, which now asks for modules and guards to be read. Gnosis Pay has no upgrade key over any contract that holds or gates user funds. The account Safe has no guard. Its only modules are Delay and Roles, and the Roles scope read from the setup events allows no delegatecall and no call other than EURe.transfer to the settlement Safe. Only the user, through their own Delay queue, can change the Safe's masterCopy. The Delay, Roles and Spender instances are EIP-1167 minimal proxies with no upgrade path, and Roles ownership sits with a Bouncer that only forwards setAllowance from the Safe. This is the \"non-upgradeable\" branch of anchor 3, so the admin-Safe conditions do not apply. Judgment call: the spender Safe (2-of-3, one module, no guard) and the settlement Safe (2-of-10, no module, no guard) are ordinary Safe proxies whose owners could change their code. That would not widen access to user accounts, because the Roles scope binds whatever code the spender Safe runs, and funds already in the settlement Safe are provider custody, scored under S1 (1). Token contracts are upgradeable by their issuers (EURe and GBPe are UUPS under a Monerium 3-of-6 Safe); that is covered in C5. The June 2026 incident was handled by issuing new Safes and new mastercopies (account-kit commit f4b92878), not by upgrading in place.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0xd69693CA293e189b546691485D1500EA5150bA29",
              "address": "0xd69693CA293e189b546691485D1500EA5150bA29",
              "block_number": 48629765,
              "detail": "allowances(keccak256(\"SPENDING_ALLOWANCE\")) returns refill 2700e18, maxRefill 2700e18, period 86400 s, balance 2695e18 - a 2700 EURe per day cap for the spender.",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0xd69693CA293e189b546691485D1500EA5150bA29 \"allowances(bytes32)(uint128,uint128,uint64,uint128,uint64)\" $(cast keccak SPENDING_ALLOWANCE) --rpc-url https://rpc.gnosischain.com --block 48629765"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/account-kit/blob/9366073768f4ad8a321c03832066f6b97921b21a/src/entrypoints/accounts-actions/accountSetup.ts#L223-L289",
              "commit": "9366073768f4ad8a321c03832066f6b97921b21a",
              "path": "src/entrypoints/accounts-actions/accountSetup.ts",
              "detail": "Setup grants a refilling allowance (refill per period), scoped to one token, transfer() only, and one receiver; no ERC-20 approve is used.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no ERC-20 approval. Instead, a Roles allowance lets Gnosis Pay's spender pull up to a daily limit, which the user sets and the UI caps at 8000. It refills every period, applies to one token and transfer() only, and is locked to the settlement receiver; the setup events cited under S1 confirm that scope onchain. The revised anchor 2 names exactly this case (\"a bounded allowance by default, capped or refilling, limited to one receiver\"), so this is 2 without a judgment call. It is not 3 because it is neither exact-amount nor expiring. Note (red team R7): a single delegate key can draw on this allowance without the spender Safe's 2-of-3 threshold (see C1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/address/0x91Def2b0C4894F4A574C5e3c6C7d0B8F51F53723",
              "address": "0x91Def2b0C4894F4A574C5e3c6C7d0B8F51F53723",
              "block_number": 48629765,
              "detail": "Delay txCooldown() = 180 s, txExpiration = 1800 s; the user's EOA 0x701Fb746... is an enabled module, so the user can queue any Safe transaction and anyone can execute it after cooldown.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xdcafac09",
                "expect": "0x00000000000000000000000000000000000000000000000000000000000000b4"
              },
              "recheck": "cast call 0x91Def2b0C4894F4A574C5e3c6C7d0B8F51F53723 \"txCooldown()(uint256)\" --rpc-url https://rpc.gnosischain.com --block 48629765; cast call 0x91Def2b0C4894F4A574C5e3c6C7d0B8F51F53723 \"getModulesPaginated(address,uint256)(address[],address)\" 0x0000000000000000000000000000000000000001 10 --rpc-url https://rpc.gnosischain.com --block 48629765; cast call 0x91Def2b0C4894F4A574C5e3c6C7d0B8F51F53723 \"owner()(address)\" --rpc-url https://rpc.gnosischain.com --block 48629765",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosisguild/zodiac-modifier-delay/blob/515737f67bb704d0ce14d45cd6f7cc8e6b4655d1/contracts/Delay.sol#L128-L201",
              "commit": "515737f67bb704d0ce14d45cd6f7cc8e6b4655d1",
              "path": "contracts/Delay.sol",
              "detail": "execTransactionFromModule (moduleOnly) queues and executeNextTx (public) runs it after cooldown; this file matches the Sourcify source for mastercopy 0x22d903fd... except for a trailing newline.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/components/WithdrawFundsForm.tsx#L191-L218",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "src/components/WithdrawFundsForm.tsx",
              "detail": "The public MIT frontend's /withdraw route has the user's own wallet send the Delay enqueue transaction directly, with no Gnosis Pay API call, and AuthGuard lets the route through without login.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Re-assessed against the revised anchor 2, which needs a verified user withdrawal path that works without the provider. Chain of reasoning: (1) by S1, funds at rest stay in the user's Safe. (2) By S2, Gnosis Pay holds no key over the account, and the Roles scope (setup events) gives its spender Safe only a capped EURe transfer to the settlement Safe, not setTxNonce or any other Delay or Safe call, so it cannot block a queued withdrawal. (3) The user's own EOAs are the Delay modules. They can queue any Safe transaction directly, and anyone can execute it after the 180 s cooldown, using public, Sourcify-matched code (Delay.sol at 515737f). The public MIT frontend's /withdraw route does the same without any Gnosis Pay API call. (4) By C2 = 0 and C3 = 0, card settlement stops if Gnosis Pay disappears. (5) By O3 = 1, self-hosting the frontend is unproven, but the direct contract path does not need it. Funds already pulled into the settlement Safe for in-flight card payments stay with Gnosis Pay. While the delegate is live it can pull up to the remaining daily allowance during the cooldown. \"Funds retained and retrievable through a verified direct path, settlement stops\" = 2. The earlier judgment call about reading S4 as a strict minimum of S1, C2 and C3 is no longer needed under the revised anchor. The closure notice (cards end 20 Dec 2026, withdrawals kept) is this scenario in practice.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/webhooks/getting-started.mdx#L28-L41",
              "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
              "path": "webhooks/getting-started.mdx",
              "detail": "Webhooks are signed with Ed25519 (X-Webhook-Signature plus a timestamp), the public key comes from the API, and reference verification code is at L115-L140.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/gnosispay/docs/contents/webhooks/getting-started.mdx?ref=b0b8c668d044b543f794e6a91065045ec03c6cbb\" --jq .content | base64 -d | sed -n '28,41p;115,140p'"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/pse-backend-demo/.env.template#L5-L7",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "pse-backend-demo/.env.template",
              "detail": "The partner mTLS client cert and key live server-side in the PSE backend demo; the browser bundle carries only publishable ids (WalletConnect projectId, Pylon app id, PSE app id).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No secrets are shipped to the browser, and webhook signatures are asymmetric with verification code in the repo. Key scoping and rotation are not documented in any repo I read. Judgment call: missing scoping and rotation evidence keeps this at 2, not 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosisguild/zodiac-modifier-roles/blob/820e5bc975d1817bdd4bc4a95226f553f7b67b68/packages/evm/docs/Audit03_RolesV2_1_Nov2023_Ominiscia.pdf",
              "commit": "820e5bc975d1817bdd4bc4a95226f553f7b67b68",
              "path": "packages/evm/docs/Audit03_RolesV2_1_Nov2023_Ominiscia.pdf",
              "detail": "Roles v2.1 audits (G0 Group and Omniscia, 2023) are published in the Roles repo; the Delay module audit is dated Sep 2021 (zodiac-modifier-delay audits/), and Safe 1.3.0 audits are in safe-smart-account docs/. Cited as the committed report file (the PDF text cannot be quote-checked); it remains an audit report only.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/public/safe-recovery-data.csv",
              "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
              "path": "public/safe-recovery-data.csv",
              "detail": "Frontend ships a per-Safe list (status lost / not_lost, balance_if_not_hacked_usd) from the June 2026 security incident; account-kit commit f4b92878 (2026-06-03) replaced all three modifier mastercopies.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The Safe, Delay and Roles code that holds and gates funds has published audits, though none is pinned to the deployed commits. No audit was found for Gnosis Pay's own Spender or Bouncer contracts, no bug bounty is in any gnosispay repo, and I found no public post-mortem for the June 2026 incident. Documented tier caps this at 1. Judgment call: 1 applies to the fund-holding modules; Gnosis Pay's own code on its own would score 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The card is issued and its payment services are provided by Monavate: for EEA cardholders UAB Monavate, an electronic money institution authorised and regulated by the Bank of Lithuania (authorisation code LB002139); for UK and other non-EEA cardholders Monavate Ltd, authorised and regulated by the Financial Conduct Authority (firm reference number 901097). Rights as a payment services customer are against Monavate as the licensed issuer (closure notice, https://help.gnosispay.com/articles/1452055581). Monavate's EEA cardholder terms state that the EU deposit guarantee scheme does not apply and that EURe issuer Monerium is authorised as an electronic money institution by the Financial Supervisory Authority of the Central Bank of Iceland (https://help.gnosispay.com/articles/4471559864). After the card closes on 20 Dec 2026, support for refunds, disputes and chargebacks runs until 23:59 UTC on 12 June 2028 (closure notice). Personal data is processed under GDPR and UK GDPR with a named data protection officer, and KYC and transaction records are kept 5 years after account closure as a legal retention requirement (https://help.gnosispay.com/articles/7638555831, https://help.gnosispay.com/articles/7752555767-what-happens-to-your-data).",
      "availability": {
        "model": "allowlist",
        "countries": [
          "EEA",
          "AR",
          "BO",
          "BR",
          "CH",
          "CO",
          "GB",
          "MX"
        ],
        "note": "The Terms (Eligibility) require residence in the EEA or in a \"Non-EEA Supported Country\" listed in the Eligible Countries FAQ. That FAQ lists all 30 EEA states plus Argentina, Bolivia, Brazil, Colombia, Mexico, Switzerland and the United Kingdom. Residents of French overseas territories are not served. Product variants: EEA residents contract with Gnosis P. Tech (Portugal) and Monavate's EEA entity, everyone else with Gnosis Pay Co Ltd and Monavate Limited (UK); the supported stablecoin is GBPe in the UK, EURe in the EEA and Switzerland, and USDCe elsewhere. The same FAQ also says the card does not work for transactions made from 22 sanctioned or high-risk locations, including Crimea (a region of Ukraine), Russia, Belarus, Iran, North Korea, Venezuela and Zimbabwe. The Terms also exclude sanctioned persons and residents of countries sanctioned by the US, UN, UK or EU. The consumer card and web app close at 23:59 UTC on 20 December 2026 (closure notice of 21 September 2026); partner programmes set their own eligibility rules.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/1662387556",
            "archive": "data/archive/gnosis-pay-eligible-countries.txt",
            "detail": "Eligible Countries for Gnosis Pay (help centre, linked from Terms section 2) lists 37 supported countries of residency and 22 locations where card use is prohibited.",
            "checked_at": "2026-10-09",
            "quote": "Current Supported Countries of Residency",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/2178874711",
            "archive": "data/archive/gnosis-pay-terms.txt",
            "detail": "Terms of Service section 2 (Eligibility) require residence in the EEA or a Non-EEA Supported Country listed in the Eligible Countries FAQ, and exclude residents of countries sanctioned by the US, UN, UK or EU.",
            "checked_at": "2026-10-09",
            "quote": "You must be resident in a Non-EEA Supported Country to order a Card",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/1452055581-formal-notice-closure-of-the-gnosis-pay-web-app-and-card-21-september-2026",
            "archive": "data/archive/gnosis-pay-closure-notice.txt",
            "detail": "Closure notice dated 21 September 2026; the card and web app stop at 23:59 UTC on 20 December 2026, and partner card programmes will have their own eligibility rules.",
            "checked_at": "2026-10-09",
            "quote": "Your card and the web app will stop working at 23:59 UTC on 20 December 2026.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Migrated 2026-10-07 to the post-red-team rules (components, quotes, rechecks, R7 module read on the spender Safe). Scored the post-incident (June 2026) account architecture from account-kit 5.1.1 at 9366073 and a live account found from a Spend event at block 48629267; all onchain reads are pinned to Gnosis block 48629765. The card side (issuer Monavate, Visa, KYC, card freeze) is documented tier only, from the Terms, the privacy policy and the closure notice. Gnosis Pay is ending its consumer card and web app at 23:59 UTC on 20 Dec 2026 (the withdraw path stays) and moving to partner card programs, which may use different terms and setups. The homepage privacy and legal links return 404; the live legal pages are at help.gnosispay.com/articles.",
      "settlement": {
        "tokens": [
          {
            "symbol": "EURe",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Monerium",
            "default": true,
            "chain_id": 100,
            "address": "0xcB444e90D8198415266c6a2724b7900fb12FC56E"
          },
          {
            "symbol": "GBPe",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Monerium",
            "chain_id": 100,
            "address": "0x5Cb9073902F2035222B9749F8fB0c9BFe5527108"
          },
          {
            "symbol": "USDC.e",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle (bridged from Ethereum to Gnosis Chain)",
            "chain_id": 100,
            "address": "0x2a22f9c3b484c3629090FeED35F17Ff8F88f76F0"
          }
        ],
        "conversion": "at_spend",
        "note": "One token per region, not a user choice: the Terms define Supported Funds as GBPe for UK users, EURe for users in Switzerland or the EEA, and USDC.e (Circle USDC bridged to Gnosis Chain) for other supported countries, all on Gnosis Chain. EURe is marked default as the EEA variant. Each card spend moves the token from the user's Safe to Gnosis Pay's settlement Safe at authorisation (sample spend in S1), and Gnosis Pay settles the card network in fiat; the fees page describes this as 1:1 stablecoin usage. The UI's EURe entry also lists the Monerium v2 contract 0x420CA0f9... as a jumper address; the address above is the one the card's Roles scope transfers. The consumer card closes on 20 December 2026.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/2178874711",
            "archive": "data/archive/gnosis-pay-terms.txt",
            "detail": "Terms of Service definitions set the Supported Funds per region (GBPe in the UK, EURe in Switzerland and the EEA, USDCe elsewhere), each only on Gnosis Chain, and define USDCe as Circle USDC bridged to Gnosis Chain at 0x2a22f9c3....",
            "quote": "if you are a user based in Switzerland or in the EEA, EURe",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/gnosispay/ui/blob/7fc844b4bb779ed1384468008b9a3eb2e7cf59f2/src/constants/currencies.ts#L7-L30",
            "commit": "7fc844b4bb779ed1384468008b9a3eb2e7cf59f2",
            "path": "src/constants/currencies.ts",
            "detail": "The card UI enumerates the three card currencies by address on Gnosis Chain - EURe 0xcB444e90... (jumper 0x420CA0f9...), GBPe 0x5Cb90739..., USDCe 0x2a22f9c3....",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/6104401027",
            "archive": "data/archive/gnosis-pay-ops-fees.txt",
            "detail": "The fees page says card purchases debit the stablecoin 1:1 with the purchase amount.",
            "quote": "a €10 purchase = 10 EURe (or equivalent)",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "All gnosispay repos (account-kit, ui, docs, safe-contracts, pse-react-native; no audit report, and GitHub code search for \"audit\" finds none), so Gnosis Pay's own Spender modifier and Bouncer have no published audit. Shared components listed in this file: the docs/ folder of safe-global/safe-smart-account (reports for v1.0.0 to v1.3.0 are listed; v1.4.x and v1.5.0 reports are left out because the account Safes run the v1.3.0 singleton), the audits folders of gnosisguild/zodiac-modifier-delay, gnosisguild/zodiac and gnosisguild/zodiac-modifier-roles (packages/evm/docs), and monerium/smart-contracts audits/ for the EURe token. No public post-mortem of the June 2026 incident was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Côme du Crest",
            "date": "2026-06-12",
            "type": "review",
            "scope": "Zodiac signature patch review (shared Zodiac component): patched Delay modifier v1.1.1 (0x824175b9...6df01) and Roles modifier v2.1.1 (0xf2964ce6...b283d5) on Gnosis Chain, checking the fix to SignatureChecker._isValidContractSignature (unchecked staticcall success).",
            "url": "https://github.com/gnosisguild/zodiac/blob/89352c4f05d4b223b9c555ca963a787fd930da2d/audits/ZodiacJune2026.pdf",
            "repo": "https://github.com/gnosisguild/zodiac",
            "covers_deployed": "partly",
            "findings": "Confirms the patch fixes the EIP-1271 signature-check vulnerability; relies on earlier audits for the rest of the code.",
            "note": "Prepared for Gnosis Ltd after the June 2026 incident. The Gnosis Pay mastercopies are different deployments: Delay 0x22d903fd... has runtime bytecode identical to the audited 0x824175b9... except the metadata hash (read 2026-10-13), but Roles 0x732B9E9f... differs in length from the audited 0xf2964ce6..., so its match is unconfirmed."
          },
          {
            "auditor": "Nethermind",
            "date": "2026-08-17",
            "type": "review",
            "scope": "NM-0993 review of Safe Smart Account v1.3.0 (shared Safe component): GnosisSafe, GnosisSafeL2, proxies and factory, base managers, handlers and libraries (1,068 LoC).",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Safe_Audit_Report_1_3_0_Nethermind.pdf",
            "commit": "767ef36bba88bdbc0c9fe3708a4290cabef4c376",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "yes",
            "findings": "1 low (getModulesPaginated skips one module between pages), 1 informational; fixed in v1.4.0, not in v1.3.0",
            "note": "Commit 767ef36 (v1.3.0-libs.0) is 12 commits after the v1.3.0 tag and changes only libraries, tests and tooling, so GnosisSafe.sol matches the v1.3.0 singleton 0xd9Db270c... used by the account Safes. The fixes went into v1.4.0, so the deployed v1.3.0 code keeps the reported behaviour. Initial report 2026-08-07."
          },
          {
            "auditor": "Certora",
            "date": "2026-07",
            "type": "audit",
            "scope": "Security assessment of Safe Smart Account v1.3.0 (shared Safe component), all core contracts, proxies, handlers and libraries; reviewed 2026-07-20 to 2026-07-29.",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Safe_Audit_Report_1_3_0_Certora.pdf",
            "commit": "767ef36bba88bdbc0c9fe3708a4290cabef4c376",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "yes",
            "findings": "1 low, 2 informational; all acknowledged, none fixed",
            "note": "Same commit as the Nethermind NM-0993 review; the core contracts match the v1.3.0 release."
          },
          {
            "auditor": "Omniscia",
            "date": "2023-11-06",
            "type": "audit",
            "scope": "Zodiac Roles modifier v2.1 (shared Zodiac component): changes in zodiac-modifier-roles PR #206 since the May 2023 audit, for contracts in the original scope.",
            "url": "https://github.com/gnosisguild/zodiac-modifier-roles/blob/820e5bc975d1817bdd4bc4a95226f553f7b67b68/packages/evm/docs/Audit03_RolesV2_1_Nov2023_Ominiscia.pdf",
            "commit": "6a7fb909a1",
            "repo": "https://github.com/gnosisguild/zodiac-modifier-roles",
            "covers_deployed": "partly",
            "note": "Revisions run from 2023-09-25 to 2023-11-06 (final revision 4d851d2a84). The Gnosis Pay mastercopy is Roles v2.1.x, rebuilt after the June 2026 signature-checker patch, so the audited v2.1 code is only part of what is deployed."
          },
          {
            "auditor": "G0 Group",
            "date": "2023-11",
            "type": "audit",
            "scope": "Zodiac Roles modifier v2.1 (shared Zodiac component): all Solidity files in packages/evm/contracts.",
            "url": "https://github.com/gnosisguild/zodiac-modifier-roles/blob/820e5bc975d1817bdd4bc4a95226f553f7b67b68/packages/evm/docs/Audit04_Roles-V2_1_Nov2023_G0Group.pdf",
            "commit": "d4b6539bdb742cf20d29425bbfdfd06acebda7d1",
            "repo": "https://github.com/gnosisguild/zodiac-modifier-roles",
            "covers_deployed": "partly",
            "findings": "1 minor (usability), fixed at a19c0ebd",
            "note": "Covers v2.1.0; the deployed mastercopy includes the June 2026 SignatureChecker patch, which this report predates."
          },
          {
            "auditor": "Omniscia",
            "date": "2023-05-09",
            "type": "audit",
            "scope": "Zodiac Roles modifier v2 (shared Zodiac component): BufferPacker, Core, Consumptions, Decoder, Integrity, MultiSendUnwrapper, Packer, Periphery, PermissionLoader and the rest of packages/evm/contracts.",
            "url": "https://github.com/gnosisguild/zodiac-modifier-roles/blob/820e5bc975d1817bdd4bc4a95226f553f7b67b68/packages/evm/docs/Audit02_RolesV2_May2023_Omniscia.pdf",
            "commit": "23b782f781",
            "repo": "https://github.com/gnosisguild/zodiac-modifier-roles",
            "covers_deployed": "no",
            "findings": "All findings reported as dealt with after the revision at 916e3ac17f.",
            "note": "Covers Roles v2.0; superseded by v2.1, which was audited separately."
          },
          {
            "auditor": "G0 Group",
            "date": "2023-04",
            "type": "audit",
            "scope": "Zodiac Roles modifier v2 (shared Zodiac component): all Solidity files in packages/evm/contracts.",
            "url": "https://github.com/gnosisguild/zodiac-modifier-roles/blob/820e5bc975d1817bdd4bc4a95226f553f7b67b68/packages/evm/docs/Audit01_RolesV2_Apr2023_G0Group.pdf",
            "commit": "5d218a4b6b6d01412abac07a2a7582d07dd35a65",
            "repo": "https://github.com/gnosisguild/zodiac-modifier-roles",
            "covers_deployed": "no",
            "findings": "Medium and lower issues; all fixed or addressed by c824d7b2.",
            "note": "Covers Roles v2.0; superseded by v2.1."
          },
          {
            "auditor": "G0 Group",
            "date": "2023-02",
            "type": "audit",
            "scope": "Zodiac Modifier update (shared Zodiac component): contracts/core/Modifier.sol, the base contract of the Delay and Roles modifiers.",
            "url": "https://github.com/gnosisguild/zodiac/blob/89352c4f05d4b223b9c555ca963a787fd930da2d/audits/ZodiacModifierUpdateFeb2023.pdf",
            "commit": "2ddb81b9dab11821aaef3011d83ed7acce63cff9",
            "repo": "https://github.com/gnosisguild/zodiac",
            "covers_deployed": "unknown",
            "findings": "No issues found."
          },
          {
            "auditor": "G0 Group",
            "date": "2021-09",
            "type": "audit",
            "scope": "Zodiac Delay modifier (shared Zodiac component): contracts/Delay.sol.",
            "url": "https://github.com/gnosisguild/zodiac-modifier-delay/blob/221382ead4022eba81b7d311c54b76889f8b4e15/audits/ZodiacDelayModuleSep2021.pdf",
            "commit": "bde282125ebbe119df4bfd6374e097007a13fb8a",
            "repo": "https://github.com/gnosisguild/zodiac-modifier-delay",
            "covers_deployed": "partly",
            "findings": "1 critical (reentrancy in executeNextTx), 2 major and smaller issues; all fixed by 808dfda6",
            "note": "Covers the 2021 Delay.sol. The deployed Delay mastercopy (v1.1.x) adds later changes, including the 2023 Modifier update and the 2026 SignatureChecker patch."
          },
          {
            "auditor": "G0 Group",
            "date": "2021-09",
            "type": "audit",
            "scope": "Zodiac core library (shared Zodiac component): all contracts in gnosis/zodiac, including ModuleProxyFactory, Module, Modifier and FactoryFriendly.",
            "url": "https://github.com/gnosisguild/zodiac/blob/89352c4f05d4b223b9c555ca963a787fd930da2d/audits/GnosisZodiac2021Sep.pdf",
            "commit": "67a0956e2bce11b5945cc79f1aff4ee3a0a4ea2a",
            "repo": "https://github.com/gnosisguild/zodiac",
            "covers_deployed": "unknown",
            "findings": "Minor optimisation issues; all fixed by c7aea1be.",
            "note": "Not checked whether the ModuleProxyFactory at 0x000000000000aDdB...a236 was built from the audited code."
          },
          {
            "auditor": "G0 Group",
            "date": "2021-05",
            "type": "audit",
            "scope": "Gnosis Safe v1.3.0 final review (shared Safe component): all Solidity files in safe-contracts.",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Gnosis_Safe_Audit_Report_1_3_0_Final.pdf",
            "commit": "ad6c7355d5bdf4f7fa348fbfcb9f07431769a3c9",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "yes",
            "findings": "No issues; one note on the example ReentrancyTransactionGuard.",
            "note": "The v1.3.0 tag is 6 commits after ad6c735 and changes only an example guard, so this covers the v1.3.0 singleton used by the account Safes."
          },
          {
            "auditor": "G0 Group",
            "date": "2021-04",
            "type": "audit",
            "scope": "Gnosis Safe v1.3.0 initial review (shared Safe component): all Solidity files in safe-contracts.",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Gnosis_Safe_Audit_Report_1_3_0_Initial.pdf",
            "commit": "4bfc0c8519f1893015d7edfd2c2780fca163c364",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "partly",
            "findings": "No issues; gas and style notes only.",
            "note": "Initial pass on a pre-release commit; changes up to 9b305a0 were checked and the final May 2021 report covers the release."
          },
          {
            "auditor": "G0 Group",
            "date": "2020-05-04",
            "type": "audit",
            "scope": "Gnosis Safe v1.2.0 gas validation adjustment (shared Safe component): GnosisSafe.sol and ModuleManager.sol.",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Gnosis_Safe_Audit_Report_1_2_0.pdf",
            "commit": "271921f4b37613b3d49bf33452dbcd81be219247",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "no",
            "findings": "1 medium (EIP-150 gas overhead lets relayers force failures); fixed",
            "note": "Covers v1.2.0, superseded by the v1.3.0 singleton the accounts use."
          },
          {
            "auditor": "G0 Group",
            "date": "2019-11-11",
            "type": "audit",
            "scope": "Gnosis Safe v1.1.0 security review, amended with the v1.1.1 changes (shared Safe component): base, common, handler, interfaces, libraries and proxies.",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Gnosis_Safe_Audit_Report_1_1_1.pdf",
            "commit": "1a9e5ce768e134c556770ea50e114fd83666b8a8",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "no",
            "note": "Amended report covering changes up to 2df0b2e0 (v1.1.1); the unamended v1.1.0 version is docs/Gnosis_Safe_Audit_Report_1_1_0.pdf. Superseded by v1.3.0."
          },
          {
            "auditor": "Runtime Verification",
            "date": "2019-02-27",
            "type": "formal_verification",
            "scope": "Formal verification of the GnosisSafe contract v1.0.0 (shared Safe component).",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Gnosis_Safe_Formal_Verification_Report_1_0_0.pdf",
            "covers_deployed": "no",
            "findings": "Findings include an execTransaction reentrancy, ISignatureValidator gas and refund abuse, and missing contract-existence checks.",
            "note": "Covers v1.0.0, superseded by v1.3.0. Runtime Verification verified the EVM bytecode rather than the Solidity source."
          },
          {
            "auditor": "Alexey Akhunov",
            "date": "2018-07",
            "type": "audit",
            "scope": "Gnosis Safe contracts audit (interim report and iteration 2) with a symbolic-execution appendix (shared Safe component), pre-v1.0.0.",
            "url": "https://github.com/safe-global/safe-smart-account/blob/f8fc2f2e75b650d63276aaa12cd3a455a5f5a990/docs/Gnosis_Safe_Audit_Report.pdf",
            "commit": "942968d66a4fa200fe9757d02b377dbfc3c88636",
            "repo": "https://github.com/safe-global/safe-smart-account",
            "covers_deployed": "no",
            "note": "The report is undated; the date is when it was committed to the Safe repo (2018-07-04). Changes up to 898cc896 were checked with symbolic execution (docs/Gnosis_Safe_Symbolic_Execution.pdf). Superseded by later versions."
          },
          {
            "auditor": "Ackee Blockchain",
            "date": "2024-06-13",
            "type": "audit",
            "scope": "Monerium smart contracts v2.0.0 (shared EURe/GBPe token component): the V2 token, validator and frontend contracts.",
            "url": "https://github.com/monerium/smart-contracts/blob/514bee7548e754012ee97bb9b9043cb5f3408292/audits/v2.0.0-ackee-blockchain-monerium-smart-contracts-report-1.2.pdf",
            "repo": "https://github.com/monerium/smart-contracts",
            "covers_deployed": "unknown",
            "findings": "2 high (validator rules bypass, token frontend impersonation), 1 medium, plus low and warning findings; fix reviews 2024-05-23 and 2024-06-13",
            "note": "Final report 2024-05-16. Gnosis Pay spends EURe through the v2 contracts; we did not check whether the live implementation matches the audited v2.0.0 code."
          },
          {
            "auditor": "Ackee Blockchain",
            "date": "2024-03-01",
            "type": "audit",
            "scope": "Monerium smart contracts v1.2.1 (shared EURe/GBPe token component); report revision 2.1 extends the 2023 v1.1.0 review.",
            "url": "https://github.com/monerium/smart-contracts/blob/514bee7548e754012ee97bb9b9043cb5f3408292/audits/v1.2.1-ackee-blockchain-monerium-smart-contracts-report-2.1.pdf",
            "repo": "https://github.com/monerium/smart-contracts",
            "covers_deployed": "no",
            "findings": "Revision 1.0 lists 5 medium plus low and warning findings; revisions 2.0 and 2.1 (Feb-Mar 2024) review the v1.2.x changes",
            "note": "Covers the v1 token contracts, which the v2 contracts replaced."
          },
          {
            "auditor": "Ackee Blockchain",
            "date": "2023-08-22",
            "type": "audit",
            "scope": "Monerium smart contracts v1.1.0 (shared EURe/GBPe token component).",
            "url": "https://github.com/monerium/smart-contracts/blob/514bee7548e754012ee97bb9b9043cb5f3408292/audits/v1.1.0-ackee-blockchain-monerium-smart-contracts-report-1.2.pdf",
            "repo": "https://github.com/monerium/smart-contracts",
            "covers_deployed": "no",
            "findings": "5 medium (access control, renounce ownership, weak ownership, unchecked return values, decimals validation) plus low and warning findings",
            "note": "Final report 2023-07-04 with fix reviews to 2023-08-22. Covers the v1 contracts, which v2 replaced."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 1,
          "limiting": [
            "P1",
            "P2",
            "P4"
          ]
        },
        "S": {
          "score": 1,
          "limiting": [
            "S1",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 10,
        "short": 13,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "hesabpay",
      "name": "HesabPay",
      "type": "incumbent",
      "website": "https://hesab.com",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "HesabPay custodial wallet ledger and transaction backend",
          "role": "ledger",
          "public": false,
          "license": "proprietary",
          "operator": "HesabPay",
          "required": true
        },
        {
          "name": "Partner banks holding customer funds 1:1 (not named in sources read)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Licensed partner banks",
          "required": false
        },
        {
          "name": "HesabPay mobile app",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "HesabPay",
          "required": false
        },
        {
          "name": "USSD *580# service",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "HesabPay",
          "required": false
        },
        {
          "name": "web.hesab.com web wallet and enterprise web platform",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "HesabPay",
          "required": false
        },
        {
          "name": "Merchant REST API (api.hesab.com) and developer portal (developers.hesab.com)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "HesabPay",
          "required": false
        },
        {
          "name": "HesabPOS terminals and mPOS devices",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "HesabPay",
          "required": false
        },
        {
          "name": "Identity verification (KYC) via verification services and government databases",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "HesabPay and unnamed identity verification services",
          "required": false
        },
        {
          "name": "HesabPay Visa Card (issued with partner banks)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Licensed partner banks (not named in sources read)",
          "required": false
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": false
        },
        {
          "name": "Cash-out agent network (1,200+ agents per terms s2.4)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "HesabPay agents",
          "required": false
        }
      ],
      "context": "Licensing: Da Afghanistan Bank's public list of licensed electronic money institutions (https://www.dab.gov.af/non-banking-financial-institutions, read 2026-10-07) lists HesabPay under the legal name Zinzir Ltd, licence No EMI101005, licence date 5 June 2023, website https://hesab.com/. The terms and privacy policy name the contracting entity as HesabPay, Inc. (Delaware); how that entity relates to the licensee Zinzir Ltd is not stated in the sources read. Funds: HesabPay's terms s2.3 state that it holds user funds 1:1 in the banking system, and privacy policy s3 says licensed banks hold the funds; these are HesabPay's own statements, and no regulator or auditor document confirming a safeguarding arrangement was read (Da Afghanistan Bank's regulation page links a payment-system licensing regulation whose PDF returned 404 on 2026-10-07). KYC/AML: privacy policy s2 cites Know Your Customer and Anti-Money Laundering rules \"as required by Da Afghanistan Bank\". Recourse: terms s9 put the agreement under the laws of Delaware, with negotiation or mediation before litigation.",
      "notes": "Eligibility: no public repository owned by HesabPay and no verified contract found, so type is incumbent. Searched 2026-10-07: gh search repos hesabpay / hesab; gh search code hesabpay; GitHub users/orgs hesabpay, HesabPay, hesab-pay, hesabpay-official, hesabpayglobal (all 404) and user search \"hesabpay\" (two unrelated accounts: HesabPayZinzir with 0 repos, habib-studio). Every hesabpay repo found is a third-party merchant integration (WooCommerce, Laravel, Django, Flutter) calling HesabPay's hosted API, not code needed to run the product. Blockscout search \"hesab\" on Ethereum returned nothing; hesab.com, its privacy policy, terms and the developer-portal bundle contain no EVM address or contract reference. hesabpay.com returns a Cloudflare 403 to non-browser clients; the operating site is hesab.com, which the privacy policy names as the website. HesabPay is described on hesab.com and in an Algorand Foundation case study (claimed tier) as running on Algorand. Algorand ASAs named \"HesabPay\" exist (e.g. 1258542524, 3561304383) whose self-asserted url field points at hesab.com, but no HesabPay document links to them, ASAs carry no verifiable source, and the schema does not represent Algorand; they are logged in docs/research/hesabpay.md and not used. Scores rest on the terms and privacy policy (documented tier, cap 1) and one reproducible page fetch.",
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms and Conditions (effective 2026-04-06) s5.1: failure to provide government ID 'may result in account suspension or termination'; s7 lists termination grounds including 'Court or government orders mandating termination'. No notice period is stated.",
              "checked_at": "2026-10-07",
              "quote": "Failure to provide documentation may result in account suspension or termination.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "HesabPay can suspend or terminate individual accounts, including on government order, and the terms state no notice period or appeal path. There are no settlement contracts; the role holder is HesabPay itself. Judgment call: anchor 0 (\"can target individual addresses with no notice\") applied to account-level suspension in a custodial ledger.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms s2.3: 'HesabPay functions as a custodial wallet service that holds user funds at a 1:1 ratio in the banking system'; s3.1 transfers run between HesabPay accounts, bank accounts, or cash-out agents.",
              "checked_at": "2026-10-07",
              "quote": "HesabPay functions as a custodial wallet service that holds user funds at a 1:1 ratio in the banking system",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Settlement is a book entry on HesabPay's custodial ledger. The terms describe no path for a payer or payee to settle without HesabPay's app, USSD service, or API.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms s1.2, s2.7, s2.8: every listed flow (app, USSD *580#, HesabPOS, REST API and WooCommerce plugins at developers.hesab.com) runs through HesabPay-operated services; s6 reserves all IP to HesabPay, Inc.",
              "checked_at": "2026-10-07",
              "quote": "Using the USSD *580# service for payments without internet access on any mobile phone.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every payment flow requires HesabPay's hosted services. No intermediary code is public (see notes for the search), so the dependency is closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "detail": "Privacy Policy s2 'Identity Verification': data is used for KYC and AML compliance 'as required by Da Afghanistan Bank and applicable laws'; s4.2 lists automated fraud detection and real-time transaction monitoring.",
              "checked_at": "2026-10-07",
              "quote": "Automated fraud detection and real-time transaction monitoring.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms s7 lists 'Court or government orders mandating termination' as a termination ground; s3.1 says transaction limits may apply based on jurisdictional regulations; s5.2 says suspicious activities are referred to the authorities.",
              "checked_at": "2026-10-07",
              "quote": "Limits on transaction amounts may apply based on jurisdictional regulations.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "HesabPay discloses, in its terms and privacy policy only, that it monitors transactions for AML and fraud, applies jurisdiction-based limits, and terminates accounts on court or government order. It names no screening list. There is no separate settlement layer: filtering and settlement both happen in HesabPay's closed ledger, so the neutrality of settlement cannot be shown from code, and no direct path bypasses the filtering (C2 = 0). Judgment call: anchor 1 (\"edge filtering disclosed in docs only, or the neutrality of the settlement layer cannot be shown from code\") rather than 0, because the filtering read is disclosed and nothing read shows undisclosed filtering; the ledger is closed, so undisclosed filtering cannot be ruled out either, and a trace or internal document showing it would lower this to 0. Documented tier caps the cell at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms s6: all intellectual property in the application and website is owned by HesabPay, Inc.; users get 'a limited, non-transferable license for personal, authorized use'.",
              "checked_at": "2026-10-07",
              "quote": "All intellectual property associated with HesabPay, including the application, website",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No part of the stack is public. GitHub searches found no HesabPay-owned organisation or repository (search log in docs/research/hesabpay.md), and the terms reserve all IP.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms s2.8: 'HesabPay provides RESTful APIs, WooCommerce/WordPress plugins, and split payment capabilities', governed by a Developer Agreement at developers.hesab.com; s2.2 statements are downloadable.",
              "checked_at": "2026-10-07",
              "quote": "HesabPay provides RESTful APIs, WooCommerce/WordPress plugins, and split payment capabilities",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "detail": "Privacy Policy s5 'Data Portability': users may download transaction history and account statements 'in standard formats'.",
              "checked_at": "2026-10-07",
              "quote": "Download your transaction history and account statements in standard formats",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A REST API and a statement export are documented. Nothing is versioned in a public repo, and the export format is not named. Judgment call: the API reference at developers.hesab.com is a client-rendered app whose docs routes appear to sit behind login, so this score rests on the terms and policy text, not on a published API schema.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms s6: 'Users are granted a limited, non-transferable license for personal, authorized use. Unauthorized use is strictly prohibited.'",
              "checked_at": "2026-10-07",
              "quote": "Users are granted a limited, non-transferable license for personal, authorized use.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The product is proprietary. No public repository exists, and the only license offered is a limited, non-transferable use license, so a third party cannot fork or run it.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://hesab.com",
              "detail": "Reproduction: curl -sL https://hesab.com | grep -o 'googletagmanager.com/gtag/js?id=[A-Z0-9-]*' returns G-GMHMD0CKK3 (Google Analytics, loaded unconditionally); the same page preloads google.com/recaptcha/api.js. Run 2026-10-07.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "detail": "Privacy Policy s6: the website uses 'analytics cookies to understand visitor behavior'; s1.2 lists automatically collected device identifiers, IP address and app usage patterns.",
              "checked_at": "2026-10-07",
              "quote": "analytics cookies to understand visitor behavior",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Google Analytics loads by default on hesab.com and the privacy policy discloses analytics in general terms without naming Google. Google reCAPTCHA also loads on the page and is not named in the policy. The mobile app and web.hesab.com were not inspected at a pinned source, so the score covers the website plus the policy. Judgment call: 1 (present, on by default, disclosed) rather than 0, because analytics collection is disclosed even though the vendor is not named.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "detail": "Privacy Policy s1.1: registration collects full name, phone, email, date of birth, and national ID or passport for KYC; s1.2 collects device identifiers, IP, usage data and location; s1.3 adds data from identity-verification services and government databases. s2 states the KYC basis: AML/KYC regulations 'as required by Da Afghanistan Bank and applicable laws'.",
              "checked_at": "2026-10-07",
              "quote": "national ID or passport details for identity verification (KYC)",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "detail": "Privacy Policy s1.2 'Usage Data': app usage patterns, features accessed, transaction frequency, session duration and interaction with notifications are collected automatically; s2 'Improvement' uses them to improve app performance and develop new features, a purpose with no stated legal basis.",
              "checked_at": "2026-10-07",
              "quote": "Analyzing usage patterns to improve app performance, develop new features, and enhance user experience.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms s1.1: account creation needs only a mobile number; s5.1: HesabPay 'may require' government-issued ID, and refusal may lead to suspension.",
              "checked_at": "2026-10-07",
              "quote": "HesabPay may require users to authenticate their identity using government-issued identification documents.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC collection (name, date of birth, national ID or passport) is disclosed in the privacy policy with a stated legal basis (Da Afghanistan Bank KYC/AML rules); on its own that would score 1, since the basis is disclosed in a policy, not in code or a versioned repo document. But the same policy discloses automatic collection of app usage data (features accessed, transaction frequency, session duration) for product improvement, which goes beyond the stated legal requirement, and the updated anchor 0 covers \"collection beyond the stated legal requirement\". Score lowered from 1 to 0 on HesabPay's own policy text. Judgment call: usage data is read as collection by the payment flow because the policy ties it to the app that runs payments; device and location data for fraud prevention and the agent finder were not counted against the score.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "detail": "Privacy Policy s3 names recipients: banking partners, card networks (Visa, Mastercard, American Express), payment processors, Duffel and other booking/delivery partners, AI language-model providers, regulators, and agents/merchants.",
              "checked_at": "2026-10-07",
              "quote": "Flight booking (Duffel), hotel reservations, food delivery, and gift card partners",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties see transaction data and are disclosed only in the policy. Most are named by category, a few by name. Nothing shows whether they can be swapped.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms s2.3: custodial wallet holding user funds 1:1 in the banking system; HesabPay 'does not invest, transfer, or use your funds ... without your explicit consent'; s3.4 reversals are run by HesabPay's team with recipient consent.",
              "checked_at": "2026-10-07",
              "quote": "HesabPay does not invest, transfer, or use your funds under any circumstances without your explicit consent.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "HesabPay holds funds in flight and at rest, and the terms disclose this. The terms limit HesabPay's use of those funds to cases with user consent; no onchain artifact confirms this.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "detail": "Terms s2.3 (custodial wallet) and s3.1 (all transfers via HesabPay accounts, banks or agents); no exit path independent of HesabPay is described.",
              "checked_at": "2026-10-07",
              "quote": "Users can transfer funds to other users via HesabPay accounts, bank accounts, or cash-out agents.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived. S1 = 1 (provider custody), C2 = 0 (no direct settlement), C3 = 0 (closed single-vendor services), O3 unknown (no public code to self-host). If HesabPay stopped operating, both funds and the ability to settle would depend on HesabPay and its partner banks.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "audits": {
        "searched": "hesab.com (home, privacy policy, terms, help and docs pages; the privacy policy mentions \"blockchain-secured\" fraud detection but names no audit), developers.hesab.com, web searches for HesabPay security audits, penetration tests and certifications, and GitHub. No published code audit, penetration test or SOC/ISO report was found. HesabPay is a closed custodial ledger with no public contract or repository in the payment path.",
        "checked_at": "2026-10-13",
        "reports": []
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P2",
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 12,
        "unk": 11,
        "total": 23
      }
    },
    {
      "slug": "hinkal",
      "name": "Hinkal",
      "type": "transfer",
      "website": "https://hinkal.io",
      "primary_chain": {
        "name": "Ethereum",
        "chain_id": 1,
        "basis": "Hinkal's Supported Chains page lists Ethereum (1) first among ten mainnets, and the Hinkal contract 0x7cb6…Cfa4 is the only deployment with a Sourcify exact match (chain 1, created at block 25543753). The SDK's deploy-data-ethMainnet names the same Hinkal, helper and timelock addresses. Unit: Hinkal.sol, its HinkalHelper and verifiers, governed by HinkalTimelockController 0xF043…b7D0. Excluded: the same address on Arbitrum, Polygon, Base, BNB, Tempo, Arc and Robinhood, plus Solana, TRON and the Emporium/wallet adapters."
      },
      "repos": [
        {
          "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits",
          "role": "contracts",
          "license": "BUSL-1.1"
        },
        {
          "url": "https://github.com/Hinkal-Protocol/Hinkal-API-Enclave",
          "role": "backend",
          "license": "none"
        },
        {
          "url": "https://github.com/Hinkal-Protocol/hinkal-go",
          "role": "sdk",
          "license": "none"
        },
        {
          "url": "https://github.com/Hinkal-Protocol/hinkal-ios-sdk",
          "role": "sdk",
          "license": "none"
        },
        {
          "url": "https://github.com/Hinkal-Protocol/wdk-wallet-evm-hinkal",
          "role": "sdk",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/Hinkal-Protocol/Hinkal-Demo-App",
          "role": "frontend",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
          "chain_id": 1,
          "role": "Hinkal (shielded pool, entry point, not a proxy)",
          "verified": "sourcify"
        },
        {
          "address": "0x5f912cBBB7F14E4524faAe8559666e7C79227C1b",
          "chain_id": 1,
          "role": "HinkalHelper (checks, relayer allowlist)",
          "verified": "explorer"
        },
        {
          "address": "0x8c16D510bD236479bc4a61819599338bebe26c36",
          "chain_id": 1,
          "role": "VerifierEVM1x2x1v4 (one of the registered verifiers)",
          "verified": "explorer"
        },
        {
          "address": "0xd7d9eBEDb36C80265B83FC69A83134C90352a091",
          "chain_id": 1,
          "role": "VerifierEVM1x2x2v4 (one of the registered verifiers)",
          "verified": "explorer"
        },
        {
          "address": "0xF04310839973454155d9886a4023451F8D3Db7D0",
          "chain_id": 1,
          "role": "HinkalTimelockController (owner and helper manager)",
          "verified": "explorer"
        },
        {
          "address": "0x4d28b33517aB72e7e2f728FF6527F8256CceD7fB",
          "chain_id": 1,
          "role": "Safe 2-of-3 (timelock proposer, executor, admin)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "Hinkal pool contract, HinkalHelper and Groth16 verifiers",
          "role": "contracts",
          "public": true,
          "license": "BUSL-1.1",
          "operator": "HinkalTimelockController (6 h delay), proposer Safe 2-of-3",
          "required": true,
          "repo": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits"
        },
        {
          "name": "Circom circuits (MainEVMCircuit)",
          "role": "other",
          "public": true,
          "license": "BUSL-1.1",
          "operator": "Hinkal",
          "required": true,
          "repo": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits"
        },
        {
          "name": "Proving keys and circuit wasm (served from wallet-prodv12.hinkal.io)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Hinkal (Novelty Today, Inc.)",
          "required": true
        },
        {
          "name": "TypeScript SDK @hinkal/common (npm build output, no source repository)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "user",
          "required": true
        },
        {
          "name": "Ethereum mainnet and a JSON-RPC endpoint",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Ethereum validators; RPC from the user's wallet provider",
          "required": true,
          "repo": "https://github.com/ethereum/go-ethereum"
        },
        {
          "name": "Hinkal backend (snapshot, Merkle siblings, data server, token lists)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Hinkal",
          "required": false
        },
        {
          "name": "Allowlisted relayers (2 addresses in the helper's RelayStore)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Hinkal (relayer list set by the timelock)",
          "required": false
        },
        {
          "name": "Enclave API (remote proving, signature storage)",
          "role": "backend",
          "public": true,
          "license": "none",
          "operator": "Hinkal on Google Cloud",
          "required": false,
          "repo": "https://github.com/Hinkal-Protocol/Hinkal-API-Enclave"
        },
        {
          "name": "Chainalysis address screening at deposit",
          "role": "oracle",
          "public": false,
          "license": "proprietary",
          "operator": "Chainalysis via Hinkal backend",
          "required": false
        },
        {
          "name": "Integrity Check over $10,000 (CEX zkTLS attestation or zkKYC partner)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Reclaim Protocol, zkMe, Galxe, AiPrise, Authento, Binance BABt",
          "required": false
        },
        {
          "name": "Hinkal Pay and Hinkal Wallet apps (pay.hinkal.io, browser extension)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Hinkal",
          "required": false
        },
        {
          "name": "HinkalTimelockController and its proposer Safe",
          "role": "other",
          "public": true,
          "license": "BUSL-1.1",
          "operator": "Safe 0x4d28…D7fB, 2-of-3, signers undisclosed",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/HinkalBase.sol#L27-L50",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/HinkalBase.sol",
              "detail": "HINKAL_HELPER_MANAGER can replace hinkalHelper at any time (setHinkalHelper, L46-L50). transact() calls hinkalHelper.performHinkalChecks and uses its return value as the proof's public inputs (Hinkal.sol L38-L56), so the helper can block every transaction.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/VerifierFacade.sol#L13-L26",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/VerifierFacade.sol",
              "detail": "The owner can register or remove any verifier (registerVerifiers, removeVerifier). The helper's owner manages the relayer allowlist (RelayStore.sol L30-L57). The contracts contain no pause, freeze or address blacklist.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/address/0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "address": "0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "block_number": 26153565,
              "detail": "owner() of Hinkal is HinkalTimelockController 0xF043…b7D0 at block 26153565. The timelock also holds HINKAL_HELPER_MANAGER and DEFAULT_ADMIN_ROLE, and owns the helper 0x5f91…7C1b (helper owner() read at the same block).",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4 \"owner()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000f04310839973454155d9886a4023451f8d3db7d0"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/address/0xF04310839973454155d9886a4023451F8D3Db7D0",
              "address": "0xF04310839973454155d9886a4023451F8D3Db7D0",
              "block_number": 26153565,
              "detail": "HinkalTimelockController getMinDelay() returns 21600 s (6 h), raised from 180 s in a MinDelayChange event. PROPOSER, EXECUTOR, CANCELLER and TIMELOCK_ADMIN are all held by Safe 0x4d28…D7fB.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0xf27a0c92",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000005460"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/address/0x4d28b33517aB72e7e2f728FF6527F8256CceD7fB",
              "address": "0x4d28b33517aB72e7e2f728FF6527F8256CceD7fB",
              "block_number": 26153565,
              "detail": "Safe 1.4.1, getThreshold() 2 of 3 owners (0xBdc7…1942, 0x6c7F…6Fd7, 0xe799…66B6). getModulesPaginated(0x1,10) returns no modules, and the guard slot is zero.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000002"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The contracts have no explicit pause, freeze or blacklist. A timelocked role can still stop settlement: it can swap the helper that computes every proof's public inputs, swap or remove verifiers, and edit the relayer allowlist. HinkalTimelockController holds that power on Ethereum, with a 6-hour delay. Its proposer, executor, canceller and admin is a 2-of-3 Safe with no modules or guard. We found no disclosure of the signers, and no document sets the delay against a user exit. The factory 0x0c61…923c also still holds DEFAULT_ADMIN_ROLE, but its bytecode has no call path to Hinkal's admin functions. That contract is unverified, so we judge this from its function selectors only. Scored 1: a multisig behind a timelock, but the signers are undisclosed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/HinkalHelper.sol#L208-L236",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/HinkalHelper.sol",
              "detail": "performHinkalChecks accepts either relay == 0 with originalSender == msg.sender (the user submits the call) or a relay on the allowlist. A user can therefore call transact directly, with no relayer and no provider signature.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/contracts/HinkalHelper.sol?ref=61b6839aa80fc0c33bfdcde0323753c83cb2ce67\" --jq .content | base64 -d | sed -n 208,236p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/Hinkal.sol#L172-L230",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/Hinkal.sol",
              "detail": "_internalTransact pulls deposits from msg.sender and pays withdrawals to externalAddress. A relay fee is charged only when relay is non-zero.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "address": "0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "block_number": 26153565,
              "detail": "Sourcify exact_match. The Sourcify source of Hinkal.sol, HinkalBase.sol, Merkle.sol and VerifierFacade.sol is identical to the repo at 61b6839a apart from a trailing newline. The EIP-1967 implementation slot is zero, so this is not a proxy.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://sourcify.dev/server/v2/contract/1/0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4 | jq .match",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/security-and-compliance/smart-contract-addresses.md",
              "detail": "The contract addresses page lists Hinkal.sol at 0x7cb6…Cfa4 for Ethereum and the other EVM chains.",
              "checked_at": "2026-10-09",
              "quote": "0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer can deposit, and a holder can transfer or withdraw, by calling the public Hinkal contract directly with relay = 0, without Hinkal's relayer or a provider signature. The address is documented, and the ABI comes from the verified source. Building the proof needs the circuit wasm and zkey files. The SDK downloads these from Hinkal's own server (wallet-prodv12.hinkal.io/verifiers-v4/); they are in no repository, and only the circuit source is published. Judgment call: the direct contract path meets anchor 3 in substance. We take 2 because a direct call needs proving artifacts that only Hinkal hosts. No transaction was run.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@hinkal/common/0.3.16",
              "detail": "In the published SDK, common/src/functions/snarkjs/constant.mjs L4 builds every circuit wasm/zkey URL from BACK_END_URL + /verifiers-v4/. In common/src/constants/server.constants.mjs L105, BACK_END_URL is the hardcoded https://wallet-prodv12.hinkal.io, chosen by build mode and not by config. Relayers are optional (withdraw(..., isRelayerOff)), and proofs can be built locally (generateProofRemotely, Hinkal.mjs L81, default true).",
              "checked_at": "2026-10-09",
              "quote": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw==",
              "package": {
                "name": "@hinkal/common",
                "version": "0.3.16",
                "integrity": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw=="
              },
              "recheck": "curl -sL https://registry.npmjs.org/@hinkal/common/-/common-0.3.16.tgz | tar xzO package/common/src/functions/snarkjs/constant.mjs | sed -n 1,6p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/README.md#L5-L5",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "README.md",
              "detail": "The contracts repository states that it contains no tests, mocks, deployment scripts or off-chain infrastructure. The relayer, snapshot and data servers are not published.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Settlement does not need Hinkal's relayer: the contract allows self-submission, and the SDK has a relayer-off mode. The Merkle path can be rebuilt from RPC events instead of the snapshot server. Every proof, however, needs the circuit wasm and zkey files that the SDK fetches from a hardcoded Hinkal URL, and they are published nowhere else. Remote proving through Hinkal's enclave is the SDK default. The enclave source is published, without a licence. The relayer and the snapshot and data servers are closed. Scored 1: a required provider-hosted artifact, with no public copy and no configurable fallback.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/HinkalHelper.sol#L30-L35",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/HinkalHelper.sol",
              "detail": "The only caller check in the deployed helper is the relayer allowlist. A grep of contracts/ at this commit finds no sanctions list, blacklist or country check. The deployed helper source on Blockscout is identical to this file.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/security-and-compliance/compliance.md",
              "detail": "The compliance page says every deposit is screened against Chainalysis and that flagged depositors can only withdraw publicly to the original address.",
              "checked_at": "2026-10-09",
              "quote": "Every deposit is screened against Chainalysis before it enters the private balance",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/tos",
              "detail": "The Terms of Service say wallet addresses using the Interface are screened against sanctions and high-risk lists, and that Hinkal may block IP addresses.",
              "checked_at": "2026-10-09",
              "quote": "Wallet addresses interacting with the Interface are screened against sanctions and high-risk address lists before funds enter the Protocols",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The deployed contracts carry no address or country filter. Screening (Chainalysis) is disclosed in the docs, terms and privacy policy, and the direct contract path (C2) should bypass it. The docs describe enforcement that the contracts do not show: proofs checked against live Chainalysis state, and flagged funds limited to public withdrawal. That enforcement can only sit in Hinkal's closed backend or relayer. The SDK names a /check-risk route and a compliance-server path, but neither the screening logic nor its effect on self-submitted proofs is visible in code. Scored 1: the filtering is disclosed in docs only, and where it is enforced cannot be shown from code.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/security-and-compliance/risks.md",
              "detail": "The Risks page tells users that USDC, USDT and other tokens can blacklist the Hinkal contract, which would lock that token inside the pool.",
              "checked_at": "2026-10-09",
              "quote": "there is a risk that a token contract blacklists Hinkal from using their token",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-api/api-reference/supported-tokens.md",
              "detail": "Supported tokens are served by the hosted API endpoint /supported-tokens, with its OpenAPI schema on the docs site. The contract has no token allowlist.",
              "checked_at": "2026-10-09",
              "quote": "Returns a curated set of popular, non-rebasing",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
              "address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
              "block_number": 26153552,
              "detail": "USDC isBlacklisted(Hinkal 0x7cb6…Cfa4) returns false at block 26153552. Hinkal held 12,397 USDC and 469.6 USDT at that block.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0xfe575a870000000000000000000000007cb60446d7635c68edf1c568cac74a1f98c1cfa4",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Users are told plainly that token issuers can blacklist the Hinkal contract. The token list itself, however, is a hosted API response, documented in the API reference but not enumerated in code or onchain. Ethereum L1 has no sequencer, so no sequencer assumption is needed for this unit. Judgment call: issuer freeze risk is disclosed, and the token list exists only in the documented API, so we score 1 (docs only).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "address": "0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "block_number": 26153565,
              "detail": "Hinkal is an exact_match (creation and runtime) on Sourcify, solc 0.8.28 with optimizer runs 500. The helper 0x5f91…7C1b, verifiers 0x8c16…6c36 and 0xd7d9…a091, and the timelock have no Sourcify record. Blockscout shows the helper and verifiers fully verified and the timelock partially verified.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4 0x5f912cBBB7F14E4524faAe8559666e7C79227C1b 0x8c16D510bD236479bc4a61819599338bebe26c36; do curl -s https://sourcify.dev/server/v2/contract/1/$a | jq -r .match; curl -s https://eth.blockscout.com/api/v2/smart-contracts/$a | jq -c '{is_fully_verified,is_partially_verified}'; done"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/README.md#L5-L5",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "README.md",
              "detail": "The repository has no build configuration or deployment script, so nobody can reproduce the deployed bytecode from it.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every settlement contract we checked is verified. The main contract is an exact match on Sourcify, and the helper and the registered verifiers are fully verified on Blockscout. The repo source matches the verified source. There is no build script, so anchor 3 is out of reach. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/tree/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts",
              "detail": "Contracts and circuits are public. Other repos in the org are SDK wrappers (Go, iOS, WDK), demo apps, and the enclave-api source published as an attestation.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@hinkal/common/0.3.16",
              "detail": "The main TypeScript SDK is published only as an npm build (MIT, no repository field). The backend servers it calls (server, snapshot-server, data-server, compliance-server, relayer) are not in any public repository.",
              "checked_at": "2026-10-09",
              "quote": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw==",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Public: contracts, circuits, the enclave-api source and several SDK wrappers. Not public: the main TypeScript SDK's source (only its npm build is published), the relayer, the snapshot, data and compliance servers, the Hinkal Pay and Wallet frontends, and the proving keys. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/README.md#L5-L5",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "README.md",
              "detail": "The README says the repository contains no tests, mocks, deployment scripts or off-chain infrastructure.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No published path leads to a working self-hosted deployment. The contracts repo has no build or deploy scripts, the proving keys are not published, and the relayer and indexing servers are closed. Reproduction was not attempted. Scored 0: the README itself states the path is absent.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/types/IHinkalBase.sol#L7-L14",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/types/IHinkalBase.sol",
              "detail": "Interfaces and events (NewCommitment, Nullified, BlockedUtxosCreated) are in the repo, from which the ABI can be derived.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/security-and-compliance/compliance.md",
              "detail": "The docs offer viewing keys and a downloadable transaction history. The API's OpenAPI schema is on the hosted docs site only.",
              "checked_at": "2026-10-09",
              "quote": "Downloadable transaction history",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Contract interfaces and events are in the repo. The API schema (OpenAPI) and the export feature are documented on the hosted docs site only, and no export format is versioned with code. Judgment call: ABIs are in the repo, but the API schema is not, so we take the lower anchor, 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/Hinkal.sol#L1-L1",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/Hinkal.sol",
              "detail": "The contracts carry SPDX-License-Identifier BUSL-1.1, which is source-available. The repository has no LICENSE file, so the BUSL parameters (change date, additional use grant) are not stated.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents?ref=61b6839aa80fc0c33bfdcde0323753c83cb2ce67\" --jq '.[].name'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement contracts and circuits are BUSL-1.1, with no LICENSE file stating its terms. The proving keys are a required component that is closed. The Go and iOS SDKs and the enclave source have no licence. Scored 0: a required component is closed, and the critical contracts are source-available.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/README.md#L1-L10",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "README.md",
              "detail": "The root tree at this commit has only README.md, circuits/ and contracts/. The README makes no licence commitment, and there is no CLA or CONTRIBUTING file.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/git/trees/61b6839aa80fc0c33bfdcde0323753c83cb2ce67\" --jq '.tree[].path'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No CLA and no licence-stability commitment. The contracts have been BUSL-1.1 in this repository from the start, so we found no relicensing event. Scored 2. The licence is already source-available, which F1 covers.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@hinkal/common/0.3.16",
              "detail": "common/src/functions/snarkjs/constant.mjs L4 points every proving artifact at Hinkal's backend (/verifiers-v4/). No repository publishes the zkeys, so no third party can build proofs for the deployed verifiers without Hinkal's server.",
              "checked_at": "2026-10-09",
              "quote": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw==",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A third party running the open parts still needs Hinkal-hosted proving keys for the deployed verifiers. Running a fork with new keys would need a new trusted setup and new contracts, and the BUSL licence restricts that. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/privacy-policy",
              "detail": "The privacy policy lists Google Analytics and Microsoft Clarity (session replay) on the site and apps, and RB2B visitor identification, loaded only after cookie consent.",
              "checked_at": "2026-10-09",
              "quote": "through Google Analytics and Microsoft Clarity",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@hinkal/common/0.3.16",
              "detail": "In the published SDK, data-structures/Hinkal/hinkalDeposit.mjs L56 posts admin data after each deposit to the data server (/emit-tx-public-data). Per functions/pre-transaction/constructAdminData.mjs, that data is the chain, token, amount, timestamp, hashed depositor address and tx hash. The privacy policy does not list it.",
              "checked_at": "2026-10-09",
              "quote": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw==",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The apps run Google Analytics, Microsoft Clarity session replay and RB2B, disclosed and gated by consent according to the policy. The frontends are closed, so the gate could not be checked in code. The SDK also reports each deposit to Hinkal's data server by default, and the policy does not describe that. Judgment call: analytics are present and disclosed in policy, so we score 1. The undisclosed SDK deposit report would support 0, but it is first-party and covers deposits that are already public onchain.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/security-and-compliance/compliance-1.md",
              "detail": "Deposits over $10,000 through Hinkal Wallet and Hinkal Send need an Integrity Check, either a CEX account attestation or zkKYC through a partner.",
              "checked_at": "2026-10-09",
              "quote": "For deposits over $10,000, Hinkal requires an Integrity Check",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/privacy-policy",
              "detail": "The policy lists usage data (IP, location, device), business identification, an optional email, and the public wallet address, which is screened through Chainalysis.",
              "checked_at": "2026-10-09",
              "quote": "Before funds enter the Hinkal smart contract, the depositing public wallet address is screened against sanctions and high-risk lists through Chainalysis",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The protocol itself needs only addresses, amounts and tokens. The apps add analytics and wallet-address screening. Deposits over $10,000 in Hinkal's own apps need a CEX-ownership or zkKYC attestation. All of this is disclosed in policy and docs, not in code. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/HinkalBase.sol#L108-L131",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/HinkalBase.sol",
              "detail": "Private outputs are emitted as commitments with encrypted outputs. Only onchain-created UTXOs (proofless deposits, external actions) are emitted with their amount, token and stealth address in plaintext.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/contracts/HinkalBase.sol?ref=61b6839aa80fc0c33bfdcde0323753c83cb2ce67\" --jq .content | base64 -d | sed -n 108,131p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/Hinkal.sol#L263-L270",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/Hinkal.sol",
              "detail": "prooflessDeposit takes a string orderId that is unused onchain. The code comment says off-chain listeners read it from calldata to match the transaction to an order.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Private transfers inside the pool reveal only nullifiers and new commitments, and recipients use stealth addresses. Deposits reveal depositor, token and amount. Withdrawals reveal recipient, token and amount. Proofless deposits carry a plaintext orderId in calldata, and their UTXOs are emitted in plaintext. Amounts are arbitrary, not fixed denominations, so amount and timing matching across entry and exit is a behavioural risk; we note it here and do not score it. Judgment call: the core shielded transfer fits anchor 3, but the documented orderId and plaintext-UTXO path adds linkage, so we score 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/privacy-policy",
              "detail": "The policy names Chainalysis for screening, plus Google, Microsoft Clarity, RB2B, Cloudflare and AWS.",
              "checked_at": "2026-10-09",
              "quote": "Chainalysis - the sanctions check described above",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@hinkal/common/0.3.16",
              "detail": "The SDK's server.constants.mjs L105 hardcodes Hinkal's server, snapshot-server, data-server and compliance-server paths. It also names pro-api.coingecko.com, LI.FI and OKX routes (swaps and bridges).",
              "checked_at": "2026-10-09",
              "quote": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw==",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "In the default SDK flow, Hinkal's backend sees each request: Merkle siblings, risk checks and deposit reports. Chainalysis screens the depositing address. Swap and bridge flows add CoinGecko, LI.FI and OKX. These parties are named in the policy or visible in the npm build, but the endpoints are fixed by build mode and cannot be swapped by config. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@hinkal/common/0.3.16",
              "detail": "API/getServerURL.mjs picks the server, snapshot-server and data-server URLs from a build-time deployment mode. HinkalConfig (documented in the TypeScript SDK page) has no option for a server or indexer URL. RPC access goes through the user's ethers/wagmi provider.",
              "checked_at": "2026-10-09",
              "quote": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw==",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-sdk/sdk-description.md",
              "detail": "HinkalConfig options are caching, the cache path, generateProofRemotely, disableMerkleTreeUpdates and tronChainOverride. None of them sets an endpoint.",
              "checked_at": "2026-10-09",
              "quote": "Indicator controlling whether the proof should be constructed remotely in secure enclave",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The RPC comes from the user's wallet provider. Hinkal's snapshot, indexer and data endpoints are hardcoded per build, with no config option, and the indexer code is not public. Scored 0, matching the common failure where the RPC is configurable but the indexer is hardcoded.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/address/0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "address": "0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "block_number": 26153565,
              "detail": "Funds are held by the Hinkal contract. hinkalHelper() returns 0x5f91…7C1b, not the documented helper 0x62Af…03F5 from the constructor, so the helper has been swapped once. The timelock holds HINKAL_HELPER_MANAGER (hasRole returns true).",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4 \"hinkalHelper()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x9671084a",
                "expect": "0x0000000000000000000000005f912cbbb7f14e4524faae8559666e7c79227c1b"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/Hinkal.sol#L38-L56",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/Hinkal.sol",
              "detail": "transact() verifies the proof against public inputs returned by the replaceable helper, using a verifier looked up in the owner-managed verifierMap. A malicious helper or verifier swap could accept a proof that pays out funds it should not.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The pool is a non-upgradeable contract with no sweep function. Still, the timelock (Safe 2-of-3, 6-hour delay) can replace the helper that computes public inputs and the verifiers that check proofs, and either could redirect pooled funds. The docs give no exit procedure tied to the delay. Judgment call: in effect this is an escrow whose logic the provider can change behind a short timelock, which matches anchor 1 better than 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/address/0xF04310839973454155d9886a4023451F8D3Db7D0",
              "address": "0xF04310839973454155d9886a4023451F8D3Db7D0",
              "block_number": 26153565,
              "detail": "getMinDelay() returns 21600 s. Safe 0x4d28…D7fB holds PROPOSER_ROLE (hasRole true) and every other timelock role.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xF04310839973454155d9886a4023451F8D3Db7D0 \"getMinDelay()(uint256)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x91d14854b09aa5aeb3702cfd50b6b62bc4532604938f21248a27a1d5ca736082b6819cc10000000000000000000000004d28b33517ab72e7e2f728ff6527f8256cced7fb",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/address/0x4d28b33517aB72e7e2f728FF6527F8256CceD7fB",
              "address": "0x4d28b33517aB72e7e2f728FF6527F8256CceD7fB",
              "block_number": 26153565,
              "detail": "The Safe guard slot is zero, getModulesPaginated returns an empty list, and the threshold is 2 of 3.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "address": "0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "block_number": 26153565,
              "detail": "Hinkal has no proxy (EIP-1967 implementation slot zero), but the helper and verifiers it calls can be replaced by the timelock.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Hinkal itself is not upgradeable, but swapping the helper and verifiers changes its behaviour as much as an upgrade would. That authority sits with a 6-hour timelock controlled by a 2-of-3 Safe with no modules or guard. We found no disclosure of the signers and no notice channel named in the repo. Scored 2: a multisig with a timelock, but undisclosed signers and no notice channel.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@hinkal/common/0.3.16",
              "detail": "In the published SDK, functions/web3/functionCalls/approveToken.mjs L15-L21 approves exactly the deposit amount (approve(hinkal, amount)), and first resets a non-zero USDT allowance on Ethereum. The Hinkal contract pulls exactly amountChanges[i] (Hinkal.sol L182-L187).",
              "checked_at": "2026-10-09",
              "quote": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw==",
              "package": {
                "name": "@hinkal/common",
                "version": "0.3.16",
                "integrity": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw=="
              },
              "recheck": "curl -sL https://registry.npmjs.org/@hinkal/common/-/common-0.3.16.tgz | tar xzO package/common/src/functions/web3/functionCalls/approveToken.mjs | sed -n 15,28p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK asks for an exact-amount approval to the Hinkal contract. That fits anchor 3 in substance, but the only source is the npm build output; there is no source repository at a commit, which makes this documented-tier evidence. Judgment call: capped at 1 by the evidence tier, not by the behaviour.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@hinkal/common/0.3.16",
              "detail": "Every withdrawal proof needs the zkey and wasm files that constant.mjs fetches from https://wallet-prodv12.hinkal.io/verifiers-v4/. No public repository has them.",
              "checked_at": "2026-10-09",
              "quote": "sha512-CvPXI/bwB3VmDfzImP9afg/St0rpLRzqHkDVS9GBG4Ib6N3ssYW44KSGBqcPdUsRCPk8asRY5GQ511Atj0e/cw==",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/HinkalHelper.sol#L213-L219",
              "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
              "path": "contracts/HinkalHelper.sol",
              "detail": "The contract accepts a self-submitted withdrawal (relay == 0, originalSender == msg.sender).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=1, C2=2, C3=1 and O3=0. The contract would accept a self-submitted withdrawal (C2), and funds cannot be pulled out except through a valid proof. But a proof needs proving keys that only Hinkal serves (C3). The timelock can still change the helper and verifiers (S1), and nothing to self-host has been published (O3). A user who has not cached the zkeys depends on Hinkal's server staying online to withdraw. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/security-and-compliance/security-audits.md",
              "detail": "The page lists reviews by zkSecurity, Zokyo, Quantstamp, Secure3, Hexens and Neodyme, mostly as Google Drive links. It lists a HackenProof bounty as ongoing and an Immunefi boost as completed.",
              "checked_at": "2026-10-09",
              "quote": "have been reviewed by six independent firms",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Six audit reports are linked from the docs, and a HackenProof bounty is listed as ongoing. We did not tie any report to the deployed commit (the contracts were deployed at block 25543753 in 2026), and no fixes are linked to commits in the repo. Scored 1: audit reports only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "blocklist",
        "countries": [
          "CU",
          "IR",
          "KP",
          "SY"
        ],
        "note": "The Terms of Service bar persons in a Restricted Territory: Crimea, the so-called Donetsk and Luhansk People's Republics (regions of Ukraine; Ukraine as a whole is not listed), Cuba, Iran, North Korea and Syria. They add \"any other country to which the United States embargoes goods or imposes similar sanctions\", which they do not enumerate. Hinkal also reserves the right to block IP addresses. These terms govern Hinkal's Interface (site, apps, SDK and API). The Ethereum contracts have no country or address check (HinkalHelper.sol), so the protocol itself can be called from anywhere, subject to the proving-key dependency described in C2 and S4.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hinkal.io/tos",
            "detail": "Terms of Service, section 3, define the Restricted Territory and bar persons in it from using the Interface.",
            "checked_at": "2026-10-09",
            "quote": "means the Crimea region of Ukraine, Cuba, Donetsk",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/HinkalHelper.sol#L208-L236",
            "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
            "path": "contracts/HinkalHelper.sol",
            "detail": "performHinkalChecks has no country or address-list check. The only caller rule is the relayer allowlist.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: Ethereum mainnet Hinkal 0x7cb6…Cfa4 (deployed at block 25543753, Sourcify exact match to Hinkal-Contracts-Circuits@61b6839a), helper 0x5f91…7C1b and the registered verifiers. Onchain reads at block 26153565 via publicnode. Role history comes from the Blockscout logs API, because publicnode refuses archive log queries: RoleGranted/RoleRevoked on Hinkal, and RoleGranted/MinDelayChange on the timelock. The same Hinkal address is deployed on other EVM chains with different helpers (Base 0xf6aF…3746, Arbitrum 0x6Fac…8d12, Polygon 0x3CD1…1bAC); those were not assessed. Solana and TRON programs are out of scope. The main TypeScript SDK was read from its npm tarball (0.3.16) without running it. No transactions, UI runs, traces or self-host attempts were made.",
      "audits": {
        "searched": "Hinkal's Security audits docs page (hinkal-team.gitbook.io/hinkal/security-and-compliance/security-audits), which links eight reports, mostly on Google Drive; the Hinkal-Protocol GitHub repos (no audits folder); reports.zksecurity.xyz; github.com/zokyo-sec/audit-reports; Quantstamp's certificate site. The Secure3 link (github.com/Secure3Audit/Secure3Academy/tree/main/audit_reports/Hinkal) returns 404 and no Secure3 report was found elsewhere, so it is not listed. The Immunefi boost and HackenProof programme are bug bounties, not audits. The audited commits named in the reports (117e8ad, 492ca00, 2587160, 6174378, 37ba2894) are in private repos (Hinkal-Protocol/Hinkal-Protocol, Novelty-Today/Hinkal-Neo-Protocol), not in the public Hinkal-Contracts-Circuits.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Quantstamp",
            "date": "2026-08-28",
            "type": "audit",
            "scope": "Hinkal contracts and Circom circuits (MainEVMCircuit, MainEVMCircuitMin), including the Emporium controller and HinkalWallet",
            "url": "https://drive.google.com/file/d/1vq7FLvjocy2tD1PJB4pVBx3xB3Z-79Rg/view?usp=sharing",
            "commit": "6174378",
            "repo": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits",
            "covers_deployed": "partly",
            "findings": "14 total: 1 medium, 8 low, 5 informational; 9 fixed, 3 acknowledged, 2 mitigated (fix review at ef86e0b3, 2026-08-24)",
            "note": "Review ran 5-14 August 2026, after the Ethereum Hinkal contract was deployed (block 25543753, about 2026-07-16); the contract is not a proxy, so fixes that touch it would need a redeploy. Whether the deployed bytecode includes the fixes is not established."
          },
          {
            "auditor": "zkSecurity",
            "date": "2026-07-17",
            "type": "review",
            "scope": "Post-incident review of the circuit fix for the July 2026 double-spend (MainEVMCircuit and StealthAddressCalculator under libs/circom) plus automated scans; contracts out of scope",
            "url": "https://drive.google.com/file/d/10vv73BkXw7Zm_NlwWSJhb45vgZbI0Wn6/view?usp=sharing",
            "commit": "37ba2894",
            "covers_deployed": "partly",
            "findings": "Confirmed the fix closes the double-spend; 2 lower-severity defence-in-depth issues",
            "note": "The report states it is not a full audit and that no full audit has been performed on the current code. It records a security incident in early July 2026 caused by an under-constrained nullifying key; Hinkal redeployed after the fix."
          },
          {
            "auditor": "Neodyme",
            "date": "2026-02-13",
            "type": "audit",
            "scope": "Hinkal Solana on-chain program (confidential settlement); zero-knowledge constructions out of scope",
            "url": "https://drive.google.com/file/d/1SclKWU99HSVgVxfIh7zz4BWuJO46Jd9W/view?usp=sharing",
            "covers_deployed": "no",
            "findings": "1 critical, 1 high, 2 low, 1 informational; fixes verified by the auditor",
            "note": "Solana program, outside the assessed Ethereum deployment."
          },
          {
            "auditor": "Hexens",
            "date": "2025-04-01",
            "type": "audit",
            "scope": "Hinkal contracts (HinkalInLogic external calls), Circom circuits (SwapperM, access tokens) and relayer/server endpoints",
            "url": "https://drive.google.com/file/d/1A0kGmlg04X88-_c4uU0F5WvaMGTDUT3s/view?usp=sharing",
            "covers_deployed": "unknown",
            "findings": "1 critical, 1 high, 3 medium, 5 low, 1 informational; no fix status given",
            "note": "The PDF is a findings list (\"Hinkal Results 01/04/2025\") that does not name the firm or a commit; the attribution to Hexens comes from Hinkal's audits page."
          },
          {
            "auditor": "zkSecurity",
            "date": "2024-09-06",
            "type": "audit",
            "scope": "Hinkal Solidity contracts (hardhat/contracts, staking external action, Connext bridging) and Circom circuits (libs/circom)",
            "url": "https://reports.zksecurity.xyz/reports/hinkal-audit/",
            "commit": "117e8ad",
            "covers_deployed": "no",
            "findings": "2 medium, 2 low, 2 informational",
            "note": "zkSecurity's 2026 post-incident report says the codebase has changed meaningfully since this engagement."
          },
          {
            "auditor": "Zokyo",
            "date": "2024-02-20",
            "type": "pentest",
            "scope": "Hinkal TypeScript codebase, server, relayer and dApp endpoints (December 2023)",
            "url": "https://github.com/zokyo-sec/audit-reports/blob/main/Hinkal/Hinkal_Zokyo_Feb20th_2024.pdf",
            "commit": "258716071b5a2f939c46af9e95c2e8904378c24a",
            "covers_deployed": "unknown",
            "findings": "1 medium (acknowledged), 8 low and 1 informational (resolved)",
            "note": "Off-chain code that is not public, so it cannot be compared with what runs today."
          },
          {
            "auditor": "Quantstamp",
            "date": "2023-09-29",
            "type": "audit",
            "scope": "Hinkal Protocol contracts and Circom circuits (Hinkal-Neo-Protocol)",
            "url": "https://certificate.quantstamp.com/full/hinkal-protocol/66b9b783-8b42-4a4e-89ed-3ef2a2df5958/index.html",
            "commit": "492ca00",
            "covers_deployed": "no",
            "findings": "37 total: 4 high, 7 medium, 11 low, 8 undetermined, 7 informational; 32 fixed, 4 acknowledged, 1 mitigated",
            "note": "Review of 14-24 August 2023 code; superseded by later versions and the 2026 redeployment."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 1,
          "limiting": [
            "C1",
            "C3",
            "C4",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S4",
            "S5"
          ]
        }
      },
      "tally": {
        "holds": 5,
        "short": 17,
        "unk": 1,
        "total": 23
      }
    },
    {
      "slug": "holyheld-card",
      "name": "Holyheld Card",
      "type": "card",
      "website": "https://holyheld.com",
      "primary_chain": {
        "name": "Ethereum",
        "chain_id": 1,
        "basis": "The card top-up contract is the only onchain component. Its Ethereum deployment 0x6fC79dDD... (TransparentUpgradeableProxy, Sourcify exact match) emits CardTopup events continuously from block 16810662 to a top-up at block 26074697 (28 Sep 2026), found via the CardTopup topic on eth.blockscout.com. Excluded: Base (an unverified, non-proxy contract with the same address and the same CardTopup event; no event in the last 5,000 blocks read), Arbitrum (no code at that address, no CardTopup event in 240,000 blocks) and Solana, which the SDK also supports."
      },
      "repos": [
        {
          "url": "https://github.com/holyheld/hh-v1-sdk",
          "role": "sdk",
          "license": "source-available"
        }
      ],
      "contracts": [
        {
          "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
          "chain_id": 1,
          "role": "Card top-up proxy (TransparentUpgradeableProxy)",
          "verified": "sourcify"
        },
        {
          "address": "0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a",
          "chain_id": 1,
          "role": "Card top-up implementation (unverified)",
          "verified": "none"
        },
        {
          "address": "0xaf3d7e4cbB718Ec026d88B330dd68abBbDC6E5C3",
          "chain_id": 1,
          "role": "OpenZeppelin ProxyAdmin of the top-up proxy",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Holyheld card top-up contract (proxy + unverified implementation)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Holyheld Labs AG",
          "required": true
        },
        {
          "name": "Holyheld SDK (@holyheld/sdk)",
          "role": "sdk",
          "public": true,
          "license": "source-available",
          "operator": "Holyheld Labs AG",
          "required": false,
          "repo": "https://github.com/holyheld/hh-v1-sdk"
        },
        {
          "name": "@holyheld/web-app-shared (private library bundled into the SDK)",
          "role": "sdk",
          "public": false,
          "license": "proprietary",
          "operator": "Holyheld Labs AG",
          "required": false
        },
        {
          "name": "Holyheld app and web app",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Holyheld Labs AG",
          "required": true
        },
        {
          "name": "Holyheld API (apicore, apiassets, apiview) and top-up signer",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Holyheld Labs AG",
          "required": true
        },
        {
          "name": "Card settlement wallet (EOA receiving top-ups)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Holyheld Labs AG",
          "required": true
        },
        {
          "name": "Card issuer and e-money partner (not named in the Terms)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed licensed issuer",
          "required": true
        },
        {
          "name": "Card network (not named in the Terms)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        },
        {
          "name": "KYC vendors Sumsub and Idenfy",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub, Idenfy",
          "required": true
        },
        {
          "name": "Wallet and transaction screening vendors (unnamed)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        },
        {
          "name": "Settlement token (USDC by Circle in the sample top-up)",
          "role": "contracts",
          "public": true,
          "license": "proprietary",
          "operator": "Circle",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "block_number": 26139997,
              "detail": "hasRole(DEFAULT_ADMIN_ROLE, 0xa1391419CC2fEc5235161d7A6Deb988cB9A1d043) returns true; that address has no code (EOA), is the proxy deployer, and is the admin of TRUSTED_PAUSER_ROLE (getRoleAdmin returns 0x00). The only other RoleGranted event since deployment gives TRUSTED_EXETUTOR_ROLE to EOA 0x4C18D1aF4261DBb9E497E3DD883024e5eb51272b; no RoleRevoked events.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d148540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a1391419cc2fec5235161d7a6deb988cb9a1d043",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0x6fC79dDD0379Fd11d67dD73056465e822b843d13 \"hasRole(bytes32,address)(bool)\" 0x0000000000000000000000000000000000000000000000000000000000000000 0xa1391419CC2fEc5235161d7A6Deb988cB9A1d043 --rpc-url https://ethereum-rpc.publicnode.com; cast code 0xa1391419CC2fEc5235161d7A6Deb988cB9A1d043 --rpc-url https://ethereum-rpc.publicnode.com",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a",
              "address": "0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a",
              "block_number": 26139997,
              "detail": "The deployed implementation bytecode contains the selectors for setPaused(bool) 0x16c38b3c, pauseOperation() 0xc9d07020, emergencyTransfer(address,address,uint256) 0x1e84c725 and setCardSettleAddress(address) 0x4b0dea4d, matching the top-up ABI shipped in @holyheld/sdk 4.1.5; paused() reads false.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/terms-and-conditions",
              "detail": "The Terms let Holyheld suspend Services and account access when requested information is not provided.",
              "quote": "may be grounds for suspending the provision of Services to you",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The top-up contract has a pause (setPaused, pauseOperation) and an emergencyTransfer, and the role that controls them (DEFAULT_ADMIN_ROLE, which also administers TRUSTED_PAUSER_ROLE) is held by a single EOA. There is no multisig and no timelock. The implementation is unverified, so the exact scope of each function cannot be read from source; the selectors are present in the deployed bytecode. On the card side, the Terms let Holyheld suspend service and account access.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "block_number": 26140011,
              "detail": "backendSignatureCheck() (0xc52a188d) returns true, and the latest top-up (tx 0x34972db6...2472a, block 26074697) called CardTopupPermitSigned (0xd88a0d43), which carries a backend signature argument.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xc52a188d",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src/evm/offRamp/sdkEVMOffRamp.ts#L290-L300",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src/evm/offRamp/sdkEVMOffRamp.ts",
              "detail": "Before a top-up the SDK fetches the receiver tag code for the holytag from the Holyheld API (getTagTopUpCode); the contract addresses themselves come from the API at init.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Card payments to merchants settle offchain through the card issuer and network. The only onchain step, the top-up into the card balance, requires a Holyheld backend signature (the signature check is switched on) and a receiver code issued by the Holyheld API. Nobody can settle a card payment by calling the contract directly.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src/constants.ts#L1-L3",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src/constants.ts",
              "detail": "The SDK hardcodes apicore.holyheld.com, apiassets.holyheld.com and apiview.holyheld.com as its service base URLs; the constructor (src/sdk.ts) passes them to every service with no override option.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src/sdk.types.ts#L36-L39",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src/sdk.types.ts",
              "detail": "HolyheldSDKOptions takes only apiKey and logger; there is no endpoint option.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every top-up needs the Holyheld API (configuration, quotes, receiver code, backend signature), and the card itself needs the issuer and network. None of it is public, there is no self-host path and no fallback. Closed, single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/privacy-policy",
              "detail": "The privacy policy says Holyheld screens identity data against sanctions and PEP lists and screens blockchain data through third-party wallet and transaction screening providers.",
              "quote": "third party transaction and wallet screening service providers",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a",
              "address": "0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a",
              "block_number": 26139997,
              "detail": "The top-up implementation is not verified on Sourcify or Etherscan, so whether it filters addresses cannot be read from source.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Sanctions, PEP and wallet screening are disclosed in the privacy policy and run in Holyheld's closed backend and its vendors. Whether the settlement contract itself filters cannot be shown, because its implementation is unverified, and the screening cannot be bypassed (C2 = 0). Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src/sdk.ts#L135-L141",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src/sdk.ts",
              "detail": "init() loads the EVM and Solana network configuration (tokens, contract addresses) from the Holyheld API (/v4/external/client/references); no token list is in the repo.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/llms-full.txt",
              "detail": "Holyheld's own site text says the list of supported stablecoins and networks keeps changing and names networks (Ethereum, Arbitrum, Base, Solana) but no tokens or issuer freeze powers.",
              "quote": "the list of supported stablecoins and networks is constantly expanding",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Supported tokens exist only in a hosted API response, and no document lists them with their issuers' freeze powers. The sample top-up used USDC, whose issuer can blacklist addresses; that is not stated to users. Not enumerated, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/1/0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "block_number": 26139997,
              "detail": "Sourcify v2 reports exact_match for the proxy (OpenZeppelin TransparentUpgradeableProxy) and for ProxyAdmin 0xaf3d7e4cbB718Ec026d88B330dd68abBbDC6E5C3; the implementation in the EIP-1967 slot, 0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a, has no Sourcify match.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000001fd0fb3f9931a820ce63d6f4caefea30ee18a94a"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a",
              "address": "0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a",
              "block_number": 26139997,
              "detail": "Etherscan shows no verified source for the implementation (the code tab offers \"Verify and Publish\"), and eth.blockscout.com reports is_verified false.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Only the stock OpenZeppelin proxy and ProxyAdmin are verified. The implementation that holds the top-up logic, roles and pause is unverified everywhere checked, and no contract source is public. Some contracts verified, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/package.json#L45-L48",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "package.json",
              "detail": "The SDK builds against @holyheld/web-app-shared 4.3.21, which is not on the public npm registry (npm view returns 404) and supplies every API service and the contract ABIs.",
              "checked_at": "2026-10-07",
              "recheck": "npm view @holyheld/web-app-shared version",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src/constants.ts#L1-L3",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src/constants.ts",
              "detail": "The SDK is a client for three hosted Holyheld APIs; the holyheld org's other repos (erc1271, erc6492, gaelogrus, gointernals, BRRR, a web3-modal wrapper, a yearn-exporter fork) contain no contracts, backend, app or indexer for the card.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The public part is the SDK source, and it cannot even be built from the repo because its core library is private. Contracts, backend, app and indexer are closed. Judgment call: this is a client shell that cannot run without private services (0), rather than \"SDK only\" (1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/README.md#L1-L32",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "README.md",
              "detail": "The README covers npm install and links hosted docs; it has no build, deployment, contract address or backend instructions.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is nothing to self-host: no contracts, backend or app are public, and the README only explains installing the client SDK. No path, so 0. Reproduction not attempted.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/tree/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src",
              "detail": "The repo tree at this commit has no ABI files, event schemas, OpenAPI spec or export code; the top-up ABI exists only inside the compiled npm bundle (dist/index.js of @holyheld/sdk 4.1.5).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "No ABI, event schema, API schema or data export is versioned in a repo. The holyheld.com/documentation link in the README returns 404. Judgment call: an ABI embedded in a minified npm bundle is not a documented interface, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/LICENSE",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "LICENSE",
              "detail": "The SDK is Business Source License 1.1 (Licensor Holyheld Labs; additional use grant excludes hosted or embedded use competitive with Holyheld; change to GPL-2.0-or-later after four years).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The only public repo is source-available (BUSL-1.1), and the contracts, backend, app, issuer and network are closed. A closed required component cannot be forked, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/LICENSE",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "LICENSE",
              "detail": "LICENSE has one commit in its history (f2ca8cb, \"Initial commit\", 2023-10-27); the repo has no CLA, CONTRIBUTING or .github directory and no license-stability statement.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/holyheld/hh-v1-sdk/commits?path=LICENSE\" --jq '.[].sha'; gh api \"repos/holyheld/hh-v1-sdk/contents/.github?ref=c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516\"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No CLA and no commitment; the license has not changed since the first commit. That is the anchor for 2. It scores relicensing risk only; the license itself is BUSL (see F1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src/sdk.ts#L135-L141",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src/sdk.ts",
              "detail": "The SDK cannot initialise without the hosted Holyheld API and a Holyheld-issued apiKey (sent as X-Api-Key).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The product cannot run without Holyheld's hosted services, its private library and its card partners.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src/sdk.ts#L229-L251",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src/sdk.ts",
              "detail": "sendAudit posts event data with the user's wallet address and operation id to the Holyheld audit API; the off-ramp flows call it at each step with no opt-out. Sentry breadcrumbs from the bundled library are routed to the integrator's logger (L99-L107), not to Sentry.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/privacy-policy",
              "detail": "The privacy policy discloses cookies and tracking technologies on the platform.",
              "quote": "our servers automatically record information using cookies and other tracking technologies",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK ships no third-party analytics library in its dependencies, but it sends first-party audit telemetry (wallet address, transfer data) to Holyheld on by default. The Holyheld app is closed and the privacy policy discloses cookies and tracking. Present, on by default, disclosed in docs, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/privacy-policy",
              "detail": "The privacy policy lists identity, government ID, sanctions/PEP status, credit-reference and blockchain screening data, collected through KYC partners.",
              "quote": "ID verification partners like Sumsub and Idenfy",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Card use requires full KYC and screening beyond settlement needs. It is disclosed in the privacy policy, not in code or a versioned repo document, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/tx/0x34972db6c6224bf12c0e26aec6a32f59bcdcba584ec865c328d02f022492472a",
              "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "block_number": 26074697,
              "detail": "The sample top-up passes receiver code 0x5bd0f55e...979b1f as the last calldata argument; the CardTopup event (in the SDK bundle ABI) emits the payer account (indexed), token, amounts and _receiverHash, and USDC moves straight from payer 0x9D4BCa30F4De569e66eC01d7bb567F1D592933c0 to Holyheld wallet 0x6D2d1659B23C81Caf9DC59930609217AE65b866a.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Every top-up publishes a per-account receiver code next to the payer's address, so all top-ups to one Holyheld account can be linked onchain, and all top-ups visibly go to a single Holyheld wallet. I found no user-facing disclosure of this. Judgment call: the receiver code is a payee tag; with no disclosure found, this takes the lower anchor (0) rather than 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/privacy-policy",
              "detail": "Names Sumsub and Idenfy for identity verification and unnamed wallet and transaction screening providers, credit-reference and anti-fraud agencies.",
              "quote": "Sanction screening and politically exposed persons (PEP) listings",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC vendors, screening vendors and the card issuer and network all see payment or identity data. They are disclosed in the privacy policy (some only by category) and cannot be swapped. Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src/constants.ts#L1-L3",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src/constants.ts",
              "detail": "API and indexer endpoints (apicore, apiassets, apiview .holyheld.com) are constants with no override; RPC goes through the integrator's own wallet client.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "RPC follows the integrator's wallet client, but the Holyheld API, which serves balances, quotes and configuration, is hardcoded and its code is closed. Hardcoded, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x6D2d1659B23C81Caf9DC59930609217AE65b866a",
              "address": "0x6D2d1659B23C81Caf9DC59930609217AE65b866a",
              "block_number": 26139997,
              "detail": "The receiver of the sample top-up's USDC (tx 0x34972db6...2472a) has no code, so it is an EOA controlled by Holyheld.",
              "checked_at": "2026-10-07",
              "eoa": true
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a",
              "address": "0x1Fd0FB3F9931a820cE63d6f4caefeA30EE18A94a",
              "block_number": 26139997,
              "detail": "The implementation exposes setCardSettleAddress(address) and emergencyTransfer(address,address,uint256), callable by the EOA admin (see C1).",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/terms-and-conditions",
              "detail": "The Terms describe a top-up as a sale of crypto-assets to Holyheld, with the resulting fiat held by a licensed partner.",
              "quote": "Holyheld does not provide any custodial services",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A top-up sells the user's tokens to Holyheld: they go straight to a Holyheld EOA, and the card balance is fiat at the issuing partner. A single admin EOA can change the settle address. The provider holds the funds and can redirect them, so 0. Judgment call: the sale is disclosed, which alone would fit 1, but the redirect power sets 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "block_number": 26139997,
              "detail": "EIP-1967 admin slot holds ProxyAdmin 0xaf3d7e4cbB718Ec026d88B330dd68abBbDC6E5C3; seven Upgraded events since deployment.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x000000000000000000000000af3d7e4cbb718ec026d88b330dd68abbbdc6e5c3"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0xaf3d7e4cbB718Ec026d88B330dd68abBbDC6E5C3",
              "address": "0xaf3d7e4cbB718Ec026d88B330dd68abBbDC6E5C3",
              "block_number": 26139997,
              "detail": "ProxyAdmin owner() is 0xa1391419CC2fEc5235161d7A6Deb988cB9A1d043, an EOA (no code).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000a1391419cc2fec5235161d7a6deb988cb9a1d043"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The top-up contract can be upgraded at any time by one EOA through the ProxyAdmin, with no timelock and no multisig. EOA admin, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/tx/0x34972db6c6224bf12c0e26aec6a32f59bcdcba584ec865c328d02f022492472a",
              "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "block_number": 26074697,
              "detail": "The sample top-up of 3,474.158634 USDC carries an EIP-2612 permit for 3,647.866565 USDC (about 5% above the amount) to spender 0x6fC79dDD... with deadline 0x6aba3040; no standing approve transaction was needed.",
              "checked_at": "2026-10-07",
              "recheck": "cast calldata-decode \"CardTopupPermitSigned(address,uint256,uint256,bytes,bytes,uint256,bytes,bytes32)\" $(cast tx 0x34972db6c6224bf12c0e26aec6a32f59bcdcba584ec865c328d02f022492472a input --rpc-url https://ethereum-rpc.publicnode.com)"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/src/evm/offRamp/sdkEVMOffRamp.ts#L380-L405",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "src/evm/offRamp/sdkEVMOffRamp.ts",
              "detail": "The SDK picks between permit, Permit2 and approve flows via the private library; the allowance amount comes from that library, so the default for approve-only tokens is not visible in public source.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The observed default is a permit with an expiry for slightly more than the top-up amount. That is a bounded allowance, not exact-amount. The approve fallback's amount is set inside the private library and cannot be checked. Judgment call: 2 (bounded) rather than 3, because the permit exceeds the amount and the fallback is unverifiable.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x6D2d1659B23C81Caf9DC59930609217AE65b866a",
              "address": "0x6D2d1659B23C81Caf9DC59930609217AE65b866a",
              "block_number": 26139997,
              "detail": "Topped-up funds leave the user's wallet for a Holyheld EOA (S1); the card balance exists only at the issuing partner.",
              "checked_at": "2026-10-07",
              "eoa": true
            }
          ],
          "finding": "Derived: S1 = 0 (funds held by Holyheld, redirectable), C2 = 0 (no direct path), C3 = 0 (closed single-vendor API), O3 = 0 (nothing to self-host). A card balance can be spent or withdrawn only through Holyheld and its partner. Tokens never topped up stay in the user's own wallet, but that is outside the rail.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/holyheld/hh-v1-sdk/blob/c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516/examples/example-wagmi-off-ramp/index.js#L112-L120",
              "commit": "c3b91ee4ba6e9e75bbd7afbedb6f669536b9d516",
              "path": "examples/example-wagmi-off-ramp/index.js",
              "detail": "The reference browser example reads the API key from VITE_HOLYHELD_SDK_API_KEY, which Vite inlines into the client bundle, and passes it to the SDK, which sends it as X-Api-Key on every request.",
              "checked_at": "2026-10-07",
              "package": {
                "name": "@holyheld/sdk",
                "version": "4.1.5",
                "integrity": "sha512-cGXKqPpp5sSh9biKzlyYO8rUhjja7U+hPu8rGUDSy9qMTSfQK0hRoMSCi0kkBI+mFzr34H070N/zRihzqXPmXg=="
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK is built for the browser and authenticates with a partner API key, so the key ships to the client; no scoping, rotation or webhook verification is documented in the repo. Judgment call: what the key authorises is not documented, so it may be a publishable ID; with no evidence that it is scoped, this takes the lower anchor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The Terms (last updated 01.07.2026) say Holyheld is operated by Holyheld Labs AG, Zug (CHE-207.939.735), a member of a Swiss Self-Regulatory Organisation supervised for AML/CFT under the Swiss Anti-Money Laundering Act, and that e-money services are provided by regulated partners; the card is issued by a licensed payment-instrument issuer that the Terms do not name (https://holyheld.com/legal/terms-and-conditions). Personal data is processed under the Swiss FADP (https://holyheld.com/legal/privacy-policy). I found no primary source naming the issuer, its regulator or safeguarding arrangements.",
      "notes": "Eligibility: the public SDK repo holyheld/hh-v1-sdk (BUSL-1.1) and the Sourcify-verified top-up proxy on Ethereum make this a card provider, not an incumbent, although the logic contract is unverified. The top-up proxy address is not in the SDK source (it comes from the API at init); it was found by searching the CardTopup event topic 0x9ceec115... on eth.blockscout.com. Onchain reads pinned to Ethereum block 26139997 (backendSignatureCheck at 26140011). Holyheld now markets itself as an invitation-only membership for accounts and payments; the Terms still define the card. The README's documentation link (holyheld.com/documentation) returns 404.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "CH"
        ],
        "note": "The Terms and Conditions (last updated 01.07.2026) are the only customer terms Holyheld publishes, and their scope clause covers users resident in or located in Switzerland; s9.2 adds that the Platform is not provided where its use would violate local law. Holyheld markets the membership as being for \"global payments\" (SEPA, ACH, SWIFT), but no first-party page lists other countries, and no terms for other jurisdictions are published, so the more restrictive reading (Switzerland only) is used. The card itself is not given a separate country list. Membership is by invitation, reviewed per applicant.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://holyheld.com/legal/terms-and-conditions",
            "detail": "The Terms' scope clause limits them to users resident in or located in Switzerland.",
            "quote": "govern the access and use by users who are residents of, or located in the Switzerland",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://holyheld.com/legal/terms-and-conditions",
            "detail": "s9.2 excludes any jurisdiction where provision or use would violate applicable law, without naming any.",
            "quote": "The Holyheld Platform is not provided to, and may not be used in any jurisdiction where the provision or use thereof would violate applicable laws and regulations",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true,
            "chain_id": 1,
            "address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"
          }
        ],
        "conversion": "at_top_up",
        "note": "The card spends a fiat e-money balance, not a token. A top-up is a sale of USDC to Holyheld: the Terms say USDC is the only crypto-asset Holyheld supports for its exchange service, and the card is defined as the instrument that enables that sale and the use of the resulting fiat Funds balance (e-money such as EUR or USD, held by the licensed partner). Other tokens can reach a top-up only through third-party smart-contract integrations, which swap them before the USDC sale. The address is Ethereum USDC from the sample top-up; Holyheld's site also names Arbitrum, Base and Solana, where the native USDC of each chain would apply, but the hosted token list was not read.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://holyheld.com/legal/terms-and-conditions",
            "detail": "Terms s8.6 name USDC as the only crypto-asset Holyheld supports for its exchange service; other crypto-assets may be used only through third-party smart-contract integrations.",
            "quote": "USDC is the only Crypto-asset supported by Holyheld for the Crypto-asset exchange service",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://holyheld.com/legal/terms-and-conditions",
            "detail": "The Terms define the Card as the instrument that enables the sale of crypto-assets and the use of the resulting fiat Funds balance through the debit-card infrastructure.",
            "quote": "the use of the resulting Funds balance through the debit-card infrastructure",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://etherscan.io/tx/0x34972db6c6224bf12c0e26aec6a32f59bcdcba584ec865c328d02f022492472a",
            "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
            "block_number": 26074697,
            "detail": "A sample card top-up moves 3,474.158634 USDC from the payer straight to Holyheld wallet 0x6D2d1659..., through the top-up proxy.",
            "checked_at": "2026-10-12"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "holyheld.com (the homepage says Holyheld is PCI DSS Level 1 compliant and undergoes \"independent security audits yearly\"; no report is linked, and PCI DSS is not a code audit), the holyheld GitHub organisation including hh-v1-sdk (no audits/ folder), web searches for Holyheld audits by Hacken, Quantstamp, PeckShield, CertiK and MixBytes, and the Sherlock and Guardian report repositories. Sherlock's repo holds a deprecated 2023 Holyheld coverage agreement but no Holyheld audit report. No audit of the card top-up contract (whose implementation is unverified) is published.",
        "checked_at": "2026-10-13",
        "reports": []
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 2,
        "short": 20,
        "unk": 1,
        "total": 23
      }
    },
    {
      "slug": "houdini-swap",
      "name": "Houdini Swap",
      "type": "incumbent",
      "website": "https://docs.houdiniswap.com",
      "repos": [
        {
          "url": "https://github.com/HoudiniSwap/houdiniswap-agent",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/HoudiniSwap/houdini-api-examples",
          "role": "sdk",
          "license": "none"
        }
      ],
      "contracts": [],
      "components": [
        {
          "name": "Houdini Partner API (api-partner.houdiniswap.com, order creation and status)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Houdini Swap LLC",
          "required": true
        },
        {
          "name": "Houdini routing engine and order backend",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Houdini Swap LLC",
          "required": true
        },
        {
          "name": "CEX exchange partners holding deposits in flight (12 named in docs)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Third-party instant exchanges selected per order",
          "required": true
        },
        {
          "name": "Partner AML screening (e.g. Chainalysis) and partner KYC when triggered",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Exchange partners and their screening vendors",
          "required": false
        },
        {
          "name": "Public chains (source, destination, unnamed intermediary privacy L1)",
          "role": "ledger",
          "public": true,
          "license": "various",
          "operator": "Each chain's validators or miners",
          "required": true
        },
        {
          "name": "Houdini web app (houdiniswap.com)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Houdini Swap LLC",
          "required": false
        },
        {
          "name": "Embeddable swap widget (iframe)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Houdini Swap LLC",
          "required": false
        },
        {
          "name": "houdiniswap-agent (MCP server, AI SDK tools, shared HTTP client)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "user",
          "required": false,
          "repo": "https://github.com/HoudiniSwap/houdiniswap-agent"
        },
        {
          "name": "houdini-api-examples (Next.js and Node reference integrations)",
          "role": "sdk",
          "public": true,
          "license": "none",
          "operator": "integrator",
          "required": false,
          "repo": "https://github.com/HoudiniSwap/houdini-api-examples"
        },
        {
          "name": "x402 facilitator for pay-per-call API access (agent path only)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "unnamed x402 facilitator (USDC on Base)",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/69143df941a2491956546ef7/6a579a7d3db98c279dc6020b_Houdini%20Swap%20-%20Terms%20of%20Service-14673161-v6.pdf",
              "archive": "data/archive/houdini-swap-terms-of-service.txt",
              "quote": "We have the right to disable any username, password, digital wallet, or other identifier, whether chosen by you or provided by us, at any time in our sole discretion for any or no reason",
              "detail": "Terms of Service (last updated 2026-07-14), 'Accessing the Services': Houdini may restrict any user's access to part or all of the Services at its discretion and may disable any digital wallet or identifier for any or no reason.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/support-and-faqs/faqs",
              "quote": "Houdini does not control partner compliance processes and cannot override AML or recovery requirements",
              "detail": "FAQ, Exchange Partner Questions: an exchange partner can require KYC before releasing a swap, and Houdini cannot reverse or override it.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Two parties can stop an individual payment. Houdini can disable any wallet or identifier at its sole discretion, for any or no reason. The exchange partner holding the deposit can hold the swap pending KYC, and Houdini cannot override that. Neither power is constrained by a multisig, a timelock or notice.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/developer-hub/getting-started/authentication",
              "quote": "All API requests should be made to",
              "detail": "API docs: all API access is provisioned through the Houdini Partner Portal (API key and secret), and every request goes to https://api-partner.houdiniswap.com/.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/HoudiniSwap/houdiniswap-agent/blob/b29c75d9c3b2afeaa04e534a4a374f08292cb88f/packages/mcp-server/src/tools/swap-flow.ts#L88-L124",
              "commit": "b29c75d9c3b2afeaa04e534a4a374f08292cb88f",
              "path": "packages/mcp-server/src/tools/swap-flow.ts",
              "detail": "The official client creates an order with POST /exchanges on Houdini's API and receives a one-time depositAddress from it; the payer then sends funds to that address. The deposit address exists only because Houdini's backend opened the order with a partner.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every private or standard swap starts with an order that Houdini's hosted API creates. The API returns the partner deposit address, and Houdini's engine runs both legs. A payer cannot complete a Houdini swap without Houdini's servers. Going to an exchange partner directly is a different product.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/HoudiniSwap/houdiniswap-agent/blob/b29c75d9c3b2afeaa04e534a4a374f08292cb88f/packages/shared/src/client.ts#L5-L19",
              "commit": "b29c75d9c3b2afeaa04e534a4a374f08292cb88f",
              "path": "packages/shared/src/client.ts",
              "detail": "DEFAULT_BASE_URL is https://api-partner.houdiniswap.com/v2. config.baseUrl can override it, but no other server implements the API: the org's two public repos are clients.",
              "checked_at": "2026-10-09",
              "recheck": "gh api 'repos/HoudiniSwap/houdiniswap-agent/contents/packages/shared/src/client.ts?ref=b29c75d9c3b2afeaa04e534a4a374f08292cb88f' --jq .content | base64 -d | sed -n 5,19p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/developer-hub/overview/architecture",
              "quote": "When using CEX routes, funds briefly touch partner exchanges",
              "detail": "Architecture overview: the user's app calls the Houdini API, Houdini's routing engine selects CEX partners or DeFi protocols, and the partners execute.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The Houdini API and routing engine are required, closed and run only by Houdini. The exchange partners are also closed third-party services. There is no self-host path and no fallback operator.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/overview/getting-started/privacy-and-compliance",
              "quote": "Access to the website is restricted for users located in countries that are subject to sanctions imposed by the United States or the European Union",
              "detail": "Privacy and Compliance page: the website geo-blocks US- and EU-sanctioned countries (not named) and blocks Tor. Partners must screen all incoming deposits with tools like Chainalysis.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/69143df941a2491956546ef7/6a579a7d3db98c279dc6020b_Houdini%20Swap%20-%20Terms%20of%20Service-14673161-v6.pdf",
              "archive": "data/archive/houdini-swap-terms-of-service.txt",
              "quote": "compliance assessments of your use can be undertaken by Third-Party Services, the results of which are at the sole discretion of the third-party provider",
              "detail": "Terms of Service: third-party compliance assessments with undisclosed criteria; Houdini reserves automated screening including third-party analytics and IP geolocation tools.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Filtering sits in the settlement path itself. The exchange partners that hold and convert the deposit screen every deposit and can require KYC, and the ToS leaves the results to their sole discretion. Houdini adds IP geolocation, Tor blocking and wallet screening at its own edge. The categories are disclosed but the criteria and list sources are not: \"sanctioned countries\" are not named, and partner rules are unpublished. Nothing can be bypassed, because C2 = 0. Judgment call: 0 (filtering partly undisclosed and in the settlement path) rather than 1 (disclosed in docs only).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/overview/coverage-and-economy/chain-tokens-partners",
              "quote": "Houdini offers bridging or swaps between most EVM chains, native Bitcoin, Solana and SUI",
              "detail": "Chain Coverage and Partners page: supported chains are listed in a table, and the page names the API as the up-to-date token list. No issuer freeze powers or sequencer assumptions are stated.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Supported chains are enumerated in docs, and tokens through the hosted API. Issuer freeze or blacklist powers (USDT, USDC) and L2 sequencer assumptions are not stated to payees. Docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/HoudiniSwap/houdiniswap-agent/blob/b29c75d9c3b2afeaa04e534a4a374f08292cb88f/README.md",
              "commit": "b29c75d9c3b2afeaa04e534a4a374f08292cb88f",
              "path": "README.md",
              "detail": "github.com/HoudiniSwap has two public repos: houdiniswap-agent (MCP server, AI SDK tools and a shared HTTP client for the hosted API) and houdini-api-examples (reference integrations). Neither contains the routing engine, API server, web app, widget or deploy scripts.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Only client code for the hosted API is public. The backend, routing engine, web app and widget are closed. Judgment call: 1 (SDK only), consistent with other incumbents with public client libraries.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://api-partner.houdiniswap.com/v2/openapi.json",
              "quote": "Houdini Swap Partner API",
              "detail": "OpenAPI 3.0.0 spec (version 2.1.2, 32 paths) served by the hosted API; it is not committed to either public repo.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/HoudiniSwap/houdiniswap-agent/blob/b29c75d9c3b2afeaa04e534a4a374f08292cb88f/packages/mcp-server/src/resources/openapi.ts#L5-L16",
              "commit": "b29c75d9c3b2afeaa04e534a4a374f08292cb88f",
              "path": "packages/mcp-server/src/resources/openapi.ts",
              "detail": "The MCP server fetches the spec at runtime from `${baseUrl}/openapi.json` instead of shipping a versioned copy.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "An OpenAPI schema is published, but only on the hosted API, not versioned in a repo. No payee data export exists, and the privacy notice says transaction data is deleted after 72 hours. Documented only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/developer-hub/overview/architecture",
              "quote": "When using CEX routes, funds briefly touch partner exchanges",
              "detail": "Architecture overview: every swap runs through the Houdini API and routing engine, then through partner exchanges or DeFi protocols. None of them is published under any licence.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/HoudiniSwap/houdini-api-examples/blob/a536b91111f7a4d13145e03791a8b5ffe28b8028/README.md",
              "commit": "a536b91111f7a4d13145e03791a8b5ffe28b8028",
              "path": "README.md",
              "detail": "houdini-api-examples has no LICENSE file at this commit (root: .gitignore, README.md, nextjs-example, node-examples). houdiniswap-agent carries MIT.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The components needed to run a Houdini swap (API, routing engine, exchange partners) are closed, so nothing that runs the rail can be forked. Of the two public client repos, one is MIT and one is unlicensed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/HoudiniSwap/houdiniswap-agent/blob/b29c75d9c3b2afeaa04e534a4a374f08292cb88f/packages/shared/src/client.ts#L5-L19",
              "commit": "b29c75d9c3b2afeaa04e534a4a374f08292cb88f",
              "path": "packages/shared/src/client.ts",
              "detail": "The open-source client is a wrapper around the hosted API at api-partner.houdiniswap.com/v2; it has no local routing or execution logic.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/developer-hub/getting-started/authentication",
              "quote": "All API access is managed through the",
              "detail": "Production use needs Partner Portal credentials (API key and secret) or x402 pay-per-call payment to the hosted API.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The MIT client is the only open code, and it cannot do anything without Houdini's proprietary hosted API. The core cannot run without proprietary components.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/overview/getting-started/privacy-and-compliance",
              "quote": "All analytics are self-hosted and never shared with third parties",
              "detail": "Privacy and Compliance page: aggregated analytics, self-hosted.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/products/swap-transfer/privacy-notice",
              "quote": "analytics data and general geographic location data",
              "detail": "Privacy Notice (last updated 2024-01-25): automatically collected browsing data includes OS, browser type and ID, URLs, visit times, analytics data and general location; it also states 'We do not use cookies.'",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics run in the web app by default, and this is disclosed in docs and the privacy notice. Houdini states they are self-hosted. The web app could not be inspected: houdiniswap.com answers curl with a Cloudflare challenge, which we did not bypass, and no trace was run. Which SDKs ship, and whether they can be switched off, is not known. Documented only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/products/swap-transfer/privacy-notice",
              "quote": "the receiving wallet address, types and quantity of token sent and types and quantity of token received and internet protocol (IP) address",
              "detail": "Privacy Notice: Transaction Data includes the sending and receiving addresses, tokens and amounts, and the IP address. It is kept for 72 hours by default (longer for open support cases), and users can opt for immediate deletion.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/HoudiniSwap/houdini-api-examples/blob/a536b91111f7a4d13145e03791a8b5ffe28b8028/nextjs-example/lib/helpers.ts#L55-L60",
              "commit": "a536b91111f7a4d13145e03791a8b5ffe28b8028",
              "path": "nextjs-example/lib/helpers.ts",
              "detail": "The reference integration sends x-user-ip, x-user-agent and x-user-timezone headers to the Houdini API on each request (placeholder values in the example).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/support-and-faqs/faqs",
              "quote": "Houdini does not control partner compliance processes and cannot override AML or recovery requirements",
              "detail": "Exchange partners can require KYC on a swap, under their own policies.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Collection goes beyond settlement needs. Houdini takes the IP address, plus browsing and general location data in the web app. The reference API integration forwards the end user's IP, user agent and timezone. Partners can additionally require KYC under their own rules. All of this is disclosed in the privacy notice and docs, and the 72-hour retention is a mitigation. Disclosed in policy only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/overview/swaps-and-transfers/private-swaps",
              "quote": "routing the transaction through two separate non-custodial exchanges",
              "detail": "Private Swap: the payer deposits to exchange 1, which converts into an unnamed privacy-centric L1 token, and exchange 2 pays the recipient. Onchain, the payer sends to a deposit address and the payee receives from an exchange wallet.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/overview/getting-started/privacy-and-compliance",
              "quote": "these partners can reconcile their leg of a swap and provide the trace forward",
              "detail": "Privacy and Compliance page: exchange partners keep internal logs linking each leg and disclose them on valid legal request.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "By design, the chain shows a plain transfer from the payer to a one-time partner deposit address and a separate payout from a partner wallet to the payee. There is no contract call or memo linking the two. The link exists off-chain, in partner logs and in Houdini's 72-hour transaction data. Amount and timing correlation remain possible, and the docs say so for the single-hop flow. We examined no sample transactions, so this rests on docs only and is capped at 1. Judgment call: the substance looks like anchor 2 (minimal onchain linkage, documented), held at the documented cap.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/overview/coverage-and-economy/chain-tokens-partners",
              "quote": "Houdini does not execute swaps itself",
              "detail": "Chain Coverage and Partners page names the 12 CEX partners (ChangeNow, SimpleSwap, StealthEx, Swapuz, LetsExchange, ChangeHero, Changelly, Swapter, EasyBit, Nexchange, Coincraddle, QuickEx) and the DEX and bridge partners.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/overview/getting-started/privacy-and-compliance",
              "quote": "Partners must use tools like Chainalysis to screen all incoming deposits",
              "detail": "Partners run third-party AML screening on every deposit; the screening vendors are not fully named.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Each private swap exposes the deposit, amounts and payout address to two exchange partners and their screening vendors, plus Houdini itself. The partners are named in docs, while the screening vendors are named only by example. Houdini's engine picks the partners; the docs describe no user-side configuration that removes them. Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/developer-hub/overview/architecture",
              "quote": "When using CEX routes, funds briefly touch partner exchanges",
              "detail": "Architecture overview: on private and standard routes, the payer's funds sit at partner exchanges between deposit and payout.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/overview/swaps-and-transfers/no-wallet-connect",
              "quote": "observers can see the incoming and outgoing transfers",
              "detail": "No Wallet Connect page: the payer sends tokens to a one-time deposit address, an exchange partner converts them, and the output is sent to the receiver.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Houdini says it does not hold funds. In flight they are held by the exchange partners that Houdini's engine selects, at deposit addresses those partners control, for 3-50 minutes per the docs. This intermediary custody is disclosed. Whether Houdini or a partner could redirect the payout is not inspectable, because the engine and partners are closed. Judgment call: scored as disclosed third-party custody chosen by the provider (anchor 1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/HoudiniSwap/houdiniswap-agent/blob/b29c75d9c3b2afeaa04e534a4a374f08292cb88f/packages/mcp-server/src/tools/swap-flow.ts#L88-L124",
              "commit": "b29c75d9c3b2afeaa04e534a4a374f08292cb88f",
              "path": "packages/mcp-server/src/tools/swap-flow.ts",
              "detail": "For CEX (private and standard) orders the client tells the payer to send exactly the quoted amount to the deposit address; no approve or permit call exists on this path (approvals appear only in the separate DEX tools).",
              "checked_at": "2026-10-09",
              "recheck": "gh api 'repos/HoudiniSwap/houdiniswap-agent/contents/packages/mcp-server/src/tools/swap-flow.ts?ref=b29c75d9c3b2afeaa04e534a4a374f08292cb88f' --jq .content | base64 -d | sed -n 88,124p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The private flow uses a plain transfer of the exact amount to a deposit address, so no token allowance is granted. That is at least as tight as an exact-amount approval. Judgment call: held at 2 rather than 3, because the main payer client (the web app) is closed and not inspected, and no package or trace was recorded.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/support-and-faqs/faqs",
              "quote": "Houdini does not control partner compliance processes and cannot override AML or recovery requirements",
              "detail": "Once deposited, completion or recovery of a swap depends on the exchange partner's processes. Houdini's API and engine create and drive every order (see C2, C3).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived. S1 = 1 (partner custody in flight), C2 = 0 (no path without Houdini's API), C3 = 0 (closed single-vendor API), O3 unknown (nothing to self-host). If Houdini disappears, new payments stop. A deposit in flight can be recovered only through the exchange partner's support and recovery process. No verified path exists, so funds and access depend on provider and partner liveness.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/HoudiniSwap/houdini-api-examples/blob/a536b91111f7a4d13145e03791a8b5ffe28b8028/nextjs-example/lib/helpers.ts#L39-L60",
              "commit": "a536b91111f7a4d13145e03791a8b5ffe28b8028",
              "path": "nextjs-example/lib/helpers.ts",
              "detail": "The reference Next.js integration calls the Houdini API only from server-side API routes, with the comment 'API_KEY and API_SECRET must never be exposed to the browser'; .env.example L4-L6 marks the credentials server-side only.",
              "checked_at": "2026-10-09",
              "recheck": "gh api 'repos/HoudiniSwap/houdini-api-examples/contents/nextjs-example/lib/helpers.ts?ref=a536b91111f7a4d13145e03791a8b5ffe28b8028' --jq .content | base64 -d | sed -n 39,60p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/developer-hub/getting-started/authentication",
              "quote": "contact support to rotate credentials",
              "detail": "API docs: key and secret go in the Authorization header; rotation is by contacting support, not self-service.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The reference code keeps the API secret server-side. The API has no webhooks (status comes by polling or WebSocket), so webhook signing does not arise. Minor issues are documented: credential rotation needs a support request. The agent client takes a raw wallet private key (x402) from env and, per its README, may store it in plaintext. The closed web app and widget were not inspected, so 3 is not available. Judgment call: 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "blocklist",
        "countries": [
          "US"
        ],
        "note": "The Terms of Service (last updated 2026-07-14) exclude persons in the United States, including its territories and possessions, and politically exposed persons. They also exclude any \"Restricted Jurisdiction\": any country subject to sanctions or embargoes by the US, UK, Canada, the EU or any other jurisdiction. None of these is named, so only US is listed. The docs add that the website geo-blocks countries under US or EU sanctions (not named) and blocks Tor. The ToS prohibits VPNs and other location masking. Each exchange partner applies its own terms and can require KYC. Integrators using the iframe or API must enforce the same restrictions. Under the more restrictive reading, any comprehensively sanctioned country is also excluded, but we have not listed them.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://cdn.prod.website-files.com/69143df941a2491956546ef7/6a579a7d3db98c279dc6020b_Houdini%20Swap%20-%20Terms%20of%20Service-14673161-v6.pdf",
            "archive": "data/archive/houdini-swap-terms-of-service.txt",
            "quote": "HAVE A REGISTERED OFFICE OR PRINCIPAL PLACE OF BUSINESS IN THE UNITED STATES OF AMERICA (INCLUDING ITS TERRITORIES AND POSSESSIONS), ANY RESTRICTED JURISDICTION",
            "detail": "Terms of Service preamble: the Services are not offered to persons residing in, citizens of, located in or incorporated in the US, or in any Restricted Jurisdiction.",
            "checked_at": "2026-10-09"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.houdiniswap.com/overview/getting-started/privacy-and-compliance",
            "quote": "We proactively block access from the Tor network and restricted jurisdictions",
            "detail": "Privacy and Compliance page: Tor and restricted jurisdictions are blocked, and the website geo-blocks countries under US or EU sanctions.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Incumbent under the eligibility rule. Houdini Swap is a hosted aggregator. Private swaps route the payer's deposit through two third-party instant exchanges and an unnamed privacy-centric L1 token, and standard swaps through one. Houdini runs no contracts in that path, and nothing needed to run it is public. github.com/HoudiniSwap (org created 2022-12) has two public repos, both API clients: houdiniswap-agent (MIT) and houdini-api-examples (no licence). Unit of assessment: the Private Swap (and private-send) flow via the web app or the Partner API. The DEX/bridge route, which calls third-party aggregator and bridge contracts, and the staking service are excluded. houdiniswap.com and app.houdiniswap.com answer curl with a Cloudflare challenge (403), which we did not bypass, so the website field points at the official docs. The ToS is a PDF linked from the docs and is archived as text. Contracting entity: Houdini Swap LLC; governing law and arbitration in the Cayman Islands (ToS). PSE's Private Transfers Analysis was used only to locate the product. Search log: docs/research/houdini-swap.md.",
      "audits": {
        "searched": "The Houdini docs (docs.houdiniswap.com, full text including the Partner FAQs \"Security & Audit\" entry), the Terms of Service and the public HoudiniSwap GitHub repos. The FAQ says Houdini has not been audited and is pursuing SOC 2 certification with Deloitte, which would not be a code audit. No published report covers the API, routing engine or order backend.",
        "checked_at": "2026-10-13",
        "reports": []
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C4"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S4",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 2,
        "short": 15,
        "unk": 6,
        "total": 23
      }
    },
    {
      "slug": "hyperbeat-card",
      "name": "Hyperbeat Card",
      "type": "incumbent",
      "website": "https://hyperbeat.org",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Liquid Bank contracts (ManagementAccount, factory, registries; source private)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Hyperbeat (Zoeion Ltd Corporation)",
          "required": true
        },
        {
          "name": "Hyperbeat Operator (settlement contract and backend)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Hyperbeat",
          "required": true
        },
        {
          "name": "Hyperbeat Pay app and backend (web dapp, iOS app, card authorisation)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Zoeion Ltd Corporation (Panama)",
          "required": true
        },
        {
          "name": "Turnkey (owner key management)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Turnkey",
          "required": true
        },
        {
          "name": "Card issuer and program manager (not named in public documents)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "unknown",
          "required": true
        },
        {
          "name": "Visa (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "KYC and screening provider (not named)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "unknown",
          "required": true
        },
        {
          "name": "Morpho (credit-mode borrowing)",
          "role": "other",
          "public": true,
          "license": "GPL-2.0-or-later",
          "operator": "Morpho",
          "required": false
        }
      ],
      "context": "The Terms of Use say the Platform is provided and operated by Zoeion Ltd Corporation; the Privacy Policy gives a Panama City address. The Terms refer to a separate \"Hyperbeat Pay Cardholder Agreement\", which is not published on hyperbeat.org or docs.hyperbeat.org, so the card issuer and its regulator are not named publicly.",
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/terms",
              "quote": "The Company may suspend or block your access to the Platform and/or any Services, whether for a period of time or indefinitely",
              "detail": "Terms of Use (updated 1 Mar 2026) let the Company suspend or block access, for a period or indefinitely, on a breach finding; no notice period is stated.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Hyperbeat can block an individual user's access to the card and Platform with no stated notice. The settlement and operator contracts are not verified, so who holds any onchain pause or role cannot be read. Judgment call: documented per-account blocking with no notice meets anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
              "quote": "the Operator calls",
              "detail": "The architecture doc says card swipes are settled when the Hyperbeat Operator calls settle() on the user's ManagementAccount.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Card settlement requires Hyperbeat's Operator; there is no documented direct path for payer or payee.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
              "quote": "Withdrawing the settlement token requires a cooldown and operator approval",
              "detail": "The Operator role is required for settlement, settlement-token withdrawals and collateral withdrawals.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card path depends on Hyperbeat's closed Operator and backend, an unnamed card issuer and Visa. None is public and there is no fallback.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/terms",
              "quote": "subject to sanctions or otherwise designated on any list of prohibited or restricted parties",
              "detail": "Terms exclude Restricted Jurisdictions and sanctioned persons (UN, Panama, UK, US lists).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Sanctions and jurisdiction screening is disclosed in the Terms only; the contracts are unverified, so settlement-layer neutrality cannot be shown. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 999,
              "url": "https://hyperevmscan.io/address/0xd9CcDB269f41046Df5783cf17B24084B752aDf76",
              "address": "0xd9CcDB269f41046Df5783cf17B24084B752aDf76",
              "block_number": 47900593,
              "detail": "The Operator contract named in Hyperbeat's own Pay dapp bundle (OPERATOR in chunk 97b00ce1712acb99.js) has 11107 bytes of code on HyperEVM, shows \"Verify and Publish\" (unverified) on HyperEVMScan, and has no Sourcify match; MORPHO_SERVICE 0xb90759Ff..., MORPHO_REPAY_SERVICE 0xb4a03802... and WRAPPER_SERVICE 0x4c70eCA9... are likewise unverified.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://sourcify.dev/server/v2/contract/999/0xd9CcDB269f41046Df5783cf17B24084B752aDf76"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/_next/static/chunks/97b00ce1712acb99.js",
              "archive": "data/archive/hyperbeat-card-pay-dapp.txt",
              "quote": "OPERATOR:\"0xd9CcDB269f41046Df5783cf17B24084B752aDf76\"",
              "detail": "The Pay dapp's contract config names the Operator and service addresses.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Hyperbeat Pay's contracts are deployed but not verified on HyperEVMScan or Sourcify, and the audited Liquid-Bank repository is private. Unverified, so 0. Judgment call: the provider has contracts, so O1 is scored rather than left unknown.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xhyperbeat/Audits/tree/990f60173c016971a4c910e1378f20bb472e37d8/liquid-bank",
              "commit": "990f60173c016971a4c910e1378f20bb472e37d8",
              "path": "liquid-bank",
              "detail": "The only Hyperbeat-owned non-fork repo is Audits (PDFs only); the Zellic report's scope names github.com/0xhyperbeat/Liquid-Bank at 431de44b, which returns 404 (private).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "No part of the card stack is public: contracts unverified, Liquid-Bank repo private, app and backend closed. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xhyperbeat/Audits/tree/990f60173c016971a4c910e1378f20bb472e37d8/liquid-bank",
              "commit": "990f60173c016971a4c910e1378f20bb472e37d8",
              "path": "liquid-bank",
              "detail": "No public source, README or deploy script exists for the card stack.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "There is no public code, so no self-host path. Reproduction not attempted.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 999,
              "url": "https://hyperevmscan.io/address/0xd9CcDB269f41046Df5783cf17B24084B752aDf76",
              "address": "0xd9CcDB269f41046Df5783cf17B24084B752aDf76",
              "block_number": 47900593,
              "detail": "Unverified contracts publish no ABI; no repo or API schema exists.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "No ABIs, event schemas, API schema or export are published. The docs name functions (settle, approveService) in prose only. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xhyperbeat/Audits/tree/990f60173c016971a4c910e1378f20bb472e37d8/liquid-bank",
              "commit": "990f60173c016971a4c910e1378f20bb472e37d8",
              "path": "liquid-bank",
              "detail": "The repo needed to run the product (Liquid-Bank) is private; no licence applies to any public code.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "All required components are closed. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
              "quote": "Withdrawals of collateral in Credit Mode require Operator approval",
              "detail": "Settlement and withdrawals depend on the Hyperbeat Operator.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card cannot run without Hyperbeat's proprietary Operator and backend. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/dapp/pay",
              "archive": "data/archive/hyperbeat-card-pay-dapp.txt",
              "quote": "googletagmanager.com/gtag/js?id=AW-17122504444",
              "detail": "The Pay dapp page loads a Google Ads tag (AW-17122504444) after interaction, and its bundles include the Datadog browser SDK and Intercom.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/privacy",
              "quote": "know-your-customer and screening service providers",
              "detail": "The Privacy Policy lists categories of processors (including \"data analytics service providers\") but names no analytics or advertising vendor and does not mention Google tags.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The Pay web app ships Google Ads tagging, Datadog browser monitoring and Intercom. The privacy policy mentions analytics providers only as a category and does not disclose advertising tags. Judgment call: present and not specifically disclosed, so 0. No network trace was run; this rests on the served page and bundles.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/privacy",
              "quote": "know-your-customer and screening service providers",
              "detail": "The Privacy Policy covers identity verification data shared with KYC and screening providers.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Collection beyond settlement needs (identity verification) is disclosed in the privacy policy only. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
              "quote": "Liquid Banking uses Turnkey to provide secure, non-custodial key management",
              "detail": "Docs name Turnkey; the privacy policy names processor categories (KYC, analytics, hosting); the card issuer is not named.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties (Turnkey, KYC provider, card issuer, Visa, analytics) are in the flow and disclosed only partly, in documents. Judgment call: 1, because the main ones are disclosed by name or category; the unnamed issuer keeps it from anything higher.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
              "quote": "Withdrawing the settlement token requires a cooldown and operator approval",
              "detail": "Docs say assets sit in a user-owned UUPS-upgradeable ManagementAccount; the Operator settles up to a user-set limit, and withdrawing the settlement token needs Operator approval.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Per the docs, funds sit in an upgradeable smart account the user owns, with the Operator able to settle up to a spending limit and to gate settlement-token and collateral withdrawals. Upgradeable escrow-like account, disclosed: 1 (documented cap). The contracts are unverified, so none of this can be checked.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
              "quote": "upgrades are strictly gated by the",
              "detail": "Docs say accounts are UUPS proxies upgradeable by an UPGRADER_ROLE limited to factory-whitelisted implementations; the role holder and any timelock are not disclosed.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every account is upgradeable and the upgrade authority is undisclosed (and unverifiable, since the contracts are unverified). Undisclosed proxy admin, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
              "quote": "the Operator calls",
              "detail": "Docs say the Operator settles from the account up to a spending limit the user sets.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A user-set spending limit bounds what the Operator can settle, per the docs. Judgment call: bounded allowance would be 2, but documented-only evidence caps at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
              "quote": "Withdrawals of collateral in Credit Mode require Operator approval",
              "detail": "Settlement-token and collateral withdrawals need Operator approval per the docs.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "S1 documented only, C2 = 0, C3 = 0, O3 = 0. Per the docs, withdrawing the settlement token or collateral needs the Operator, so funds depend on Hyperbeat's liveness. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xhyperbeat/Audits/blob/990f60173c016971a4c910e1378f20bb472e37d8/liquid-bank/Zellic.pdf",
              "commit": "990f60173c016971a4c910e1378f20bb472e37d8",
              "path": "liquid-bank/Zellic.pdf",
              "detail": "Zellic \"Hyperbeat Pay Smart Contract Security Assessment\" (6 Nov 2025) scopes Liquid-Bank at 431de44b (1 critical, 3 medium, 7 low); Nethermind NM-0697 (Management Account) lists fix commits such as d527b144 and 8489657e.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Two audit reports are public and pin commits, but the audited repo is private and the deployed contracts are unverified, so neither the audited commit nor the fixes can be matched to what runs. No bug bounty found. Judgment call: audit report only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "notes": "Eligibility: no verified contract and no public repository needed to run the card, so type is incumbent. Searched 2026-10-07: GitHub orgs 0xhyperbeat (Audits plus forks; Liquid-Bank named in the Zellic scope returns 404) and hyperbeat (unrelated 2015 user); docs.hyperbeat.org (Liquid Banking architecture, Hyperbeat Pay, addresses, audits, legal pages; no card contract addresses); hyperbeat.org terms, privacy, sitemap; the Pay dapp at hyperbeat.org/dapp/pay and its 61 JS chunks (Operator and service addresses found, factory not); HyperEVMScan and Sourcify for the Operator, Morpho service, repay service, wrapper service, a beatUSD batchSettle contract 0xFc29c432... and a sample ERC1967 account 0xd9c6a70b... with implementation 0x6e209362... (all unverified). The Hyperbeat Pay Cardholder Agreement referenced in the Terms is not published, so the card issuer is unknown. HyperEVM onchain reads pinned to block 47900593.",
      "availability": {
        "model": "blocklist",
        "countries": [
          "CU",
          "IR",
          "KP",
          "SD",
          "SY"
        ],
        "note": "The hyperbeat.org Terms (which cover the Pay Service, i.e. the card) bar nationals and residents of Cuba, Iran, North Korea, Sudan and Syria \"or any other country subject to United States embargo\", UN Security Council resolutions or HM Treasury sanctions; only the five named countries are listed here. The Terms also exclude residents of Ontario, Canada, and say geo-blocking may be used. US residents and citizens may use the Pay Service subject to a separate \"Hyperbeat Pay Cardholder Agreement (U.S.)\", which is not published, so any US state limits are unknown. The longer country list in the Terms applies only to Beatpot, a different service, and is not used here. The Pay web app bundle contains no country gate that I could find.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hyperbeat.org/terms",
            "detail": "The Terms bar nationals and residents of five named embargoed countries from the Platform and every Service.",
            "quote": "national or resident of Cuba, Iran, North Korea, Sudan, or Syria",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hyperbeat.org/terms",
            "detail": "The Terms exclude residents of Ontario, Canada, and allow US residents to use the Pay Service subject to a US cardholder agreement.",
            "quote": "subject to specific eligibility requirements detailed in the applicable Hyperbeat Pay Cardholder Agreement (U.S.), may also use the Pay Service",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "beatUSD",
            "class": "platform",
            "issuer": "Hyperbeat",
            "chain_id": 999,
            "address": "0x669abe85F96a9e3B34723F7Be9bC6F250aBC0Cc1"
          },
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "chain_id": 999,
            "address": "0xb88339CB7199b77E23DB6E890353E22632Ba630f"
          }
        ],
        "conversion": "at_spend",
        "note": "Cards spend from the user's ManagementAccount on HyperEVM. In Cash mode the account holds the settlement token and the Hyperbeat Operator calls settle() to deduct each card amount; in Credit mode the Operator borrows the settlement token from Morpho or Aave against the user's deposited collateral, which is not itself spent. The architecture doc names the settlement token only by example (\"beatUSD or USDC\"), enforced by a TokenWhitelistRegistry whose contents were not read, so no default is marked. Hyperbeat's Pay app bundle displays beatUSD (\"Hyperbeat USD\", onchain name) to the user as their \"USD\" balance, which suggests beatUSD is the usual spending balance. beatUSD is Hyperbeat's own dollar token; its reserves or backing are not documented in the sources read (the bundle mentions a BeatUSD Teller for USDC withdrawals via Paxos). The docs' Hyperbeat Pay page also says users can spend USDC/USDT; how USDT is handled is not stated.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
            "detail": "The TokenWhitelistRegistry enforces the specific stablecoin used for card settlements, given as \"e.g., beatUSD or USDC\"; in Cash mode the user holds that settlement token in the ManagementAccount.",
            "quote": "In this mode, you hold the settlement token directly in your ManagementAccount",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
            "detail": "In Credit mode the Operator borrows the settlement token on the user's behalf for each swipe.",
            "quote": "the Operator is authorized to borrow the settlement token from the DeFi protocol on your behalf",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hyperbeat.org/_next/static/chunks/97b00ce1712acb99.js",
            "archive": "data/archive/hyperbeat-card-settlement.txt",
            "detail": "Hyperbeat Pay's own app bundle configures beatUSD (0x669abe85...) and USDC (0xb88339CB...) on HyperEVM and maps beatUSD to the \"USD\" balance shown to the user.",
            "quote": "usdcAddress:\"0xb88339CB7199b77E23DB6E890353E22632Ba630f\",beatUsdAddress:\"0x669abe85F96a9e3B34723F7Be9bC6F250aBC0Cc1\"",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://hyperevmscan.io/address/0x669abe85F96a9e3B34723F7Be9bC6F250aBC0Cc1",
            "address": "0x669abe85F96a9e3B34723F7Be9bC6F250aBC0Cc1",
            "chain_id": 999,
            "block_number": 48338520,
            "detail": "name() returns \"Hyperbeat USD\", symbol() \"beatUSD\", decimals() 6 on HyperEVM (eth_call via https://rpc.hyperliquid.xyz/evm).",
            "recheck": "cast call 0x669abe85F96a9e3B34723F7Be9bC6F250aBC0Cc1 'name()(string)' --rpc-url https://rpc.hyperliquid.xyz/evm",
            "checked_at": "2026-10-12"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "github.com/0xhyperbeat/Audits (folders liquid-bank, BeatPot, USD+, Vault-Infra, Vaults-Solver, Withdrawal-Queue, beHYPE), docs.hyperbeat.org audits page, and the audits/ folder of github.com/morpho-org/morpho-blue for the credit-mode Morpho dependency. Only the liquid-bank reports cover the Hyperbeat Pay card path; the other folders cover Hyperbeat vaults, staking and BeatPot and are not listed (any of them may relate to the beatUSD settlement token, which is context only). No audit of the Hyperbeat Operator backend or the Pay app was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Nethermind Security",
            "date": "2025-12-17",
            "type": "review",
            "scope": "Hyperbeat Pay Management Account (NM-0697): ManagementAccount, ManagementAccountFactory, MorphoService, ServiceRegistry, TokenWhitelistRegistry and libraries (1785 lines of Solidity)",
            "url": "https://github.com/0xhyperbeat/Audits/blob/990f60173c016971a4c910e1378f20bb472e37d8/liquid-bank/Nethermind.pdf",
            "commit": "33f200c",
            "covers_deployed": "unknown",
            "findings": "2 medium, 10 low, 14 informational, 3 best practices; 5 fixed, 24 acknowledged",
            "note": "Initial report 25 November 2025 on commit 09e970; 33f200c is the final commit. The audited Liquid-Bank repo is private and the deployed contracts are unverified on HyperEVMScan and Sourcify, so the audited code could not be matched to the deployment."
          },
          {
            "auditor": "Zellic",
            "date": "2025-11-06",
            "type": "audit",
            "scope": "Hyperbeat Pay smart contracts in Liquid-Bank: ManagementAccount, ManagementAccountFactory, ManagementAccountStorage, ManagementAccountLib, MorphoService, ServiceRegistry, TokenWhitelistRegistry",
            "url": "https://github.com/0xhyperbeat/Audits/blob/990f60173c016971a4c910e1378f20bb472e37d8/liquid-bank/Zellic.pdf",
            "commit": "431de44bc37ea1b647da376bee1a3031affff435",
            "repo": "https://github.com/0xhyperbeat/Liquid-Bank",
            "covers_deployed": "unknown",
            "findings": "1 critical, 3 medium, 7 low, 1 informational; 11 marked fixed, 3 acknowledged only",
            "note": "Review window 24-31 October 2025. The Liquid-Bank repo returns 404 (private) and the deployed contracts are unverified, so neither the audited commit nor the fixes can be matched to what runs."
          },
          {
            "auditor": "Cantina",
            "date": "2024-01-05",
            "type": "contest",
            "scope": "Shared component (credit mode only): Morpho Blue core lending contract, public competition",
            "url": "https://github.com/morpho-org/morpho-blue/blob/main/audits/2024-01-05-morpho-blue-cantina-competition.pdf",
            "repo": "https://github.com/morpho-org/morpho-blue",
            "covers_deployed": "unknown",
            "findings": "0 critical, 1 high, 8 medium, 151 low, 36 gas, 163 informational submissions",
            "note": "Competition ran 16 November to 7 December 2023. Morpho Blue is used only when a user borrows in Credit mode; the Morpho deployment on HyperEVM was not compared with the audited code."
          },
          {
            "auditor": "Cantina",
            "date": "2023-11-13",
            "type": "audit",
            "scope": "Shared component (credit mode only): Morpho Blue core lending contract, managed review",
            "url": "https://github.com/morpho-org/morpho-blue/blob/main/audits/2023-11-13-morpho-blue-cantina-managed-review.pdf",
            "repo": "https://github.com/morpho-org/morpho-blue",
            "covers_deployed": "unknown",
            "findings": "0 critical, 4 high, 1 medium, 4 low, 1 gas, 17 informational",
            "note": "Review ran 28 September to 16 October 2023 on commit 11e69b...810c53 (abbreviated in the report)."
          },
          {
            "auditor": "OpenZeppelin",
            "date": "2023-10-13",
            "type": "audit",
            "scope": "Shared component (credit mode only): Morpho Blue core lending contract and the Speed Jump IRM",
            "url": "https://github.com/morpho-org/morpho-blue/blob/main/audits/2023-10-13-morpho-blue-and-speed-jump-irm-open-zeppelin.pdf",
            "repo": "https://github.com/morpho-org/morpho-blue",
            "covers_deployed": "unknown",
            "note": "The PDF's text is encrypted and could not be extracted, so findings are not summarised here."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S4",
            "S5"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 18,
        "unk": 5,
        "total": 23
      }
    },
    {
      "slug": "jupiter-card",
      "name": "Jupiter Card",
      "type": "incumbent",
      "website": "https://docs.jup.ag/user-docs/global/spend/jupiter-card",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Jupiter app (Spend tab) and Global ID account (email, Google or Apple sign-in)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Jupiter",
          "required": true
        },
        {
          "name": "Jupiter Spend backend and per-user deposit address",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Jupiter",
          "required": true
        },
        {
          "name": "Rain card programme (issuer outside APAC; collateral claimed onchain)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Rain (Signify Holdings, Inc.)",
          "required": true
        },
        {
          "name": "DCS card programme (issuer for nine APAC countries)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "DCS",
          "required": false
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "SumSub identity verification (Global ID)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub",
          "required": true
        },
        {
          "name": "Noah off-ramp (card balance to bank)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Noah",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/jupiter-card",
              "quote": "Purchases go through the Visa network and are settled in fiat.",
              "detail": "The Jupiter Card page says deposits fund a USD-denominated Spend balance and purchases settle over Visa in fiat through the issuer (Rain or DCS by country).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Merchants are paid by the issuer over Visa. No contract path for payer or payee is documented or published.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/risks-and-security",
              "quote": "Jupiter Spend relies on regulated financial partners to issue cards, process payments, and handle transfers.",
              "detail": "Risks & Security lists Rain and DCS (card), Noah (off-ramp and remittance) and DCS (QR Pay) as the partners each product runs through.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card payment needs Jupiter's closed Spend backend plus Rain or DCS and Visa. None is public and there is no fallback. Closed and single-vendor per user (each user gets one issuer, assigned by country).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/jupiter-card",
              "quote": "Eligibility is reviewed case by case during KYC",
              "detail": "The card page lists supported countries and US states, says eligibility is by country of residence and reviewed during KYC; the FAQ says some merchant categories are declined for compliance and risk reasons.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Geographic and KYC gating is disclosed in the docs; where and how it runs (Jupiter backend, SumSub, issuer) is not inspectable, and it cannot be bypassed because there is no direct path (C2 = 0). Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/jupiter-card",
              "quote": "Users deposit USDC (on Solana, Ethereum, Sui, Arbitrum, or Base) or USDT (on Solana)",
              "detail": "Deposit tokens and chains are enumerated on the card page and the Fees & Limits page; neither states the USDC or USDT issuers' freeze powers or any L2 sequencer assumption.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12",
              "drift": true
            }
          ],
          "finding": "Tokens and chains are listed in docs only, with no statement of issuer freeze powers or sequencer assumptions for Arbitrum and Base. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/risks-and-security",
              "quote": "Jupiter Spend relies on regulated financial partners to issue cards, process payments, and handle transfers.",
              "detail": "The card stack is Jupiter's app and backend plus partner services; none of the 202 repositories in github.com/jup-ag relates to Spend or the card (searched names and descriptions for spend, card, global, pay, rain, kyc, offramp).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No part of the card stack is public. The Solana-pay repos in jup-ag are unrelated forks. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/risks-and-security",
              "quote": "Users are subject to the terms, conditions, and operational stability of these partners.",
              "detail": "The product runs on Jupiter's closed app and backend and on partner programmes; no repository needed to run it is public.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Required components are closed, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/risks-and-security",
              "quote": "Jupiter Spend relies on regulated financial partners to issue cards, process payments, and handle transfers.",
              "detail": "The card cannot work without Jupiter's Spend service and the Rain or DCS card programme.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The product cannot run without proprietary hosted services. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/faq",
              "quote": "Identity verification is required by law to help prevent fraud, money laundering, and misuse of financial services.",
              "detail": "Global ID verification requires an identity document, phone number, liveness check, personal information and a questionnaire, plus proof of address in APAC; verification data is handled by SumSub and a Global ID cannot be deleted once created.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC data beyond settlement needs is collected and its legal purpose is stated, but only in hosted docs; no privacy policy for Jupiter Spend was found. Documented cap, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend",
              "quote": "All verification is handled by SumSub.",
              "detail": "The Spend overview names SumSub for identity verification; Risks & Security names Rain, DCS and Noah for card, QR Pay, off-ramp and remittance.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The third parties that see a card payment (issuer, Visa, SumSub, Noah for withdrawals) are named in docs and are not swappable; each user gets one issuer by country. No trace was run. Present, disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend",
              "quote": "Spend balances are managed by the regulated financial partners.",
              "detail": "Deposits go to a per-user Spend deposit address and credit a USD balance; with a Rain card the docs say the stablecoins stay onchain as collateral, but no address or contract is published.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Between deposit and merchant, funds are held by Jupiter's partners, which is disclosed. The Rain \"onchain collateral\" statement could not be checked, because no collateral address or program id is published. Provider-held, disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/faq",
              "quote": "With a Rain-issued card, a refund is added to your spend balance so you can keep using it, but it cannot be withdrawn.",
              "detail": "The FAQ says withdrawals from the card balance go to a bank account via Noah, are region-dependent, are not possible for USDT deposits, and refunds on Rain cards cannot be withdrawn; no crypto withdrawal path is documented.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived: custody is with partners (S1 = 1), there is no direct settlement path (C2 = 0), every service is closed and single-vendor (C3 = 0), and nothing can be self-hosted. The only documented exit is a partner-run, region-dependent bank withdrawal, so funds depend on the provider and its partners being live. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The docs say the card is issued through regulated partners, Rain outside APAC and DCS for Australia, Japan, Malaysia, the Philippines, Singapore, South Korea, Taiwan, Thailand and Vietnam, and that off-ramp and remittance run through Noah. I found no Jupiter Spend terms, cardholder agreement or privacy policy that names an issuing bank, licence or regulator.",
      "notes": "Eligibility: no verified contract and no public repository needed to run the card, so type is incumbent. Searched 2026-10-07: docs.jup.ag (llms.txt index; Spend overview, Jupiter Card, Risks & Security, Fees & Limits, FAQ); github.com/jup-ag (202 repos; none for Spend, card, Global ID or Rain); jupiter.global and jup.ag for terms or privacy pages (404); Rain's GitHub org SignifyHQ, whose collateral-contract-integration-examples repo has Solana IDLs (v2.00-2.05) but no mainnet program id, and whose Android SDK test fixtures name only a devnet program (A7oUtbpm..., absent on mainnet). The docs say Rain-card deposits stay onchain as collateral; if Rain or Jupiter publishes the collateral program or a user's collateral account, re-assess as type card. Deposits are also accepted on Ethereum, Sui, Arbitrum and Base. Card Map was not used.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "AG",
          "AR",
          "AU",
          "BS",
          "BB",
          "BZ",
          "BO",
          "BR",
          "KY",
          "CO",
          "CR",
          "CI",
          "DM",
          "DO",
          "EC",
          "EG",
          "SV",
          "GH",
          "GD",
          "GT",
          "GY",
          "HN",
          "JP",
          "KE",
          "MY",
          "MX",
          "MA",
          "NZ",
          "PK",
          "PA",
          "PY",
          "PE",
          "PH",
          "KN",
          "LC",
          "VC",
          "SN",
          "SG",
          "ZA",
          "KR",
          "SR",
          "TW",
          "TH",
          "TT",
          "TC",
          "UG",
          "AE",
          "UY",
          "VN",
          "ZM",
          "US"
        ],
        "note": "Jupiter's docs list where the Jupiter Card is \"actively offered\", by country of residence (not citizenship). Bangladesh and Nigeria are on the list but marked \"on pause until further notice\", so they are left out. United States: only residents of the 31 listed states (Alabama, Alaska, Arkansas, California, Colorado, Connecticut, Florida, Hawaii, Illinois, Indiana, Iowa, Kansas, Kentucky, Maine, Massachusetts, Michigan, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, New York, North Carolina, Oklahoma, Pennsylvania, South Carolina, Texas, Utah, Virginia, West Virginia, Wyoming). Two issuers: DCS for residents of Australia, Japan, Malaysia, the Philippines, Singapore, South Korea, Taiwan, Thailand and Vietnam; Rain elsewhere. The docs add that residents of unlisted countries are reviewed case by case during KYC. No Jupiter Spend terms of service or cardholder agreement was found, so there is no prohibited-country list.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/jupiter-card",
            "detail": "The Jupiter Card docs list supported countries of residence and supported US states, and name the issuer for each region.",
            "quote": "The list below shows where the Jupiter Card is actively offered",
            "archive": "data/archive/jupiter-card-supported-countries.txt",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/jupiter-card",
            "detail": "The list marks Bangladesh as paused; Nigeria is marked the same way further on.",
            "quote": "Bangladesh (on pause until further notice)",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true,
            "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"
          },
          {
            "symbol": "USDT",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Tether",
            "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"
          }
        ],
        "conversion": "at_spend",
        "note": "USDC is the base asset. The Solana deposit address takes USDC or USDT directly; tokens from Ethereum, Base, Arbitrum, Sui, BSC and Robinhood Chain arrive through Universal Deposit and are converted to USDC, and Send to Spend in Jupiter Mobile swaps any other token into USDC. Deposits are not converted to USD on arrival (the app only displays a USD balance); with a Rain-issued card they stay onchain as collateral and purchases settle over Visa in fiat. The DCS (Asia-Pacific) card's settlement mechanics are not documented separately.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/jupiter-card",
            "detail": "The Jupiter Card page says USDC and USDT deposits are not converted to USD on arrival and stay onchain as collateral with a Rain card.",
            "quote": "The USDC and USDT you deposit are not converted to USD when they arrive",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend",
            "detail": "The Spend page names USDC as the base deposit asset and says other tokens are converted to USDC.",
            "quote": "USDC is the base deposit asset.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/jupiter-card",
            "detail": "Purchases settle over Visa in fiat.",
            "quote": "Purchases go through the Visa network and are settled in fiat.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "Jupiter's Spend docs (overview, Jupiter Card, Risks & Security, Fees & Limits, FAQ; none mentions an audit), the jup-ag GitHub org (no Spend or card repo), Rain's security page (audits under NDA, Sherlock named), Rain's GitHub org SignifyHQ, and the Sherlock report repo (one Rain report). No audit of Jupiter Spend, DCS's card programme or Rain's Solana collateral program is published. Noah (off-ramp) is not in the card payment path.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Sherlock",
            "date": "2025-02-11",
            "type": "contest",
            "scope": "Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest",
            "url": "https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2025.02.11%20-%20Final%20-%20Rain%20Private%20Best%20Efforts%20Audit%20Contest%20Report.pdf",
            "commit": "6f578d5b9c9fa35bbe857959a50fa5aab4fa611a",
            "repo": "https://github.com/SignifyHQ/collateral-contract-evm-v2",
            "covers_deployed": "unknown",
            "findings": "0 high, 2 medium (statement payoff rounding; missing Chainlink min/max answer check)",
            "note": "Logged because Rain issues the card outside APAC and the docs say Rain-card deposits stay onchain as collateral. Rain publishes no collateral address for this card and deposits are Solana-first, so these EVM contracts may not hold Jupiter Card collateral. The Rain repo is private; contest ran 2-8 December 2024."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 10,
        "unk": 13,
        "total": 23
      }
    },
    {
      "slug": "m-pesa",
      "name": "M-Pesa",
      "type": "incumbent",
      "website": "https://developer.safaricom.co.ke",
      "repos": [
        {
          "url": "https://github.com/safaricom/mpesa-node-library",
          "role": "sdk",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/safaricom/LNMOnlineAndroidSample",
          "role": "sdk",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/safaricom/mpesa_c2b_php_confirmation_validation",
          "role": "sdk",
          "license": "GPL-3.0"
        },
        {
          "url": "https://github.com/safaricom/mpesa_listener",
          "role": "sdk",
          "license": "none"
        },
        {
          "url": "https://github.com/safaricom/mpesa-php-sdk",
          "role": "sdk",
          "license": "none"
        },
        {
          "url": "https://github.com/safaricom/mpesa-java-sdk",
          "role": "sdk",
          "license": "none"
        },
        {
          "url": "https://github.com/safaricom/mpesa-api-C-Sharp",
          "role": "sdk",
          "license": "none"
        }
      ],
      "contracts": [],
      "components": [
        {
          "name": "M-Pesa core platform (e-money ledger and transaction processing)",
          "role": "ledger",
          "public": false,
          "license": "proprietary",
          "operator": "Safaricom PLC",
          "required": true
        },
        {
          "name": "M-Pesa customer register (identity behind each wallet)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Safaricom PLC",
          "required": true
        },
        {
          "name": "Daraja API gateway and OAuth token service (api.safaricom.co.ke)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Safaricom PLC",
          "required": false
        },
        {
          "name": "Customer channels (SIM Toolkit, USSD, M-Pesa app, Safaricom app)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Safaricom PLC",
          "required": false
        },
        {
          "name": "M-PESA Org portal (org.ke.m-pesa.com)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Safaricom PLC",
          "required": false
        },
        {
          "name": "Trust fund holding e-money balances (trustees, banks not named)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Trustees and Kenyan commercial banks (unnamed)",
          "required": false
        },
        {
          "name": "mpesa-node-library",
          "role": "sdk",
          "public": true,
          "license": "Apache-2.0",
          "operator": "github.com/safaricom (attribution is a judgment call, see notes)",
          "required": false,
          "repo": "https://github.com/safaricom/mpesa-node-library"
        },
        {
          "name": "LNMOnlineAndroidSample",
          "role": "sdk",
          "public": true,
          "license": "Apache-2.0",
          "operator": "github.com/safaricom (attribution is a judgment call, see notes)",
          "required": false,
          "repo": "https://github.com/safaricom/LNMOnlineAndroidSample"
        },
        {
          "name": "mpesa_c2b_php_confirmation_validation",
          "role": "sdk",
          "public": true,
          "license": "GPL-3.0",
          "operator": "github.com/safaricom (attribution is a judgment call, see notes)",
          "required": false,
          "repo": "https://github.com/safaricom/mpesa_c2b_php_confirmation_validation"
        },
        {
          "name": "mpesa_listener",
          "role": "sdk",
          "public": true,
          "license": "none",
          "operator": "github.com/safaricom (attribution is a judgment call, see notes)",
          "required": false,
          "repo": "https://github.com/safaricom/mpesa_listener"
        },
        {
          "name": "mpesa-php-sdk",
          "role": "sdk",
          "public": true,
          "license": "none",
          "operator": "github.com/safaricom (attribution is a judgment call, see notes)",
          "required": false,
          "repo": "https://github.com/safaricom/mpesa-php-sdk"
        },
        {
          "name": "mpesa-java-sdk",
          "role": "sdk",
          "public": true,
          "license": "none",
          "operator": "github.com/safaricom (attribution is a judgment call, see notes)",
          "required": false,
          "repo": "https://github.com/safaricom/mpesa-java-sdk"
        },
        {
          "name": "mpesa-api-C-Sharp",
          "role": "sdk",
          "public": true,
          "license": "none",
          "operator": "github.com/safaricom (attribution is a judgment call, see notes)",
          "required": false,
          "repo": "https://github.com/safaricom/mpesa-api-C-Sharp"
        }
      ],
      "context": "Authorisation: the Central Bank of Kenya (CBK) Directory of Authorized Payment Service Providers as at August 10, 2026 (centralbank.go.ke, PDF read 2026-10-07) lists Safaricom PLC, first licensed January 1, 2016, approved \"to issue, process, store, send and facilitate mobile money payments\". Safeguarding: the National Payment System Regulations, 2014 (CBK copy: https://www.centralbank.go.ke/wp-content/uploads/2018/12/NPSRegulationsNew2014-1.pdf) require a provider to hold all monies received in a Trust Fund never less than what is owed to customers, not move them to its operating account or commingle them, and place them in licensed commercial banks or Government of Kenya securities (reg 25(3)); to file separate audited statements for the Trust accounts and an independent system security audit (reg 29); and on revocation let CBK take over the business to distribute Trust Fund balances, with any shortfall recoverable from each trustee (reg 10). The same Regulations require a register of customers with ID or passport numbers verified against the Integrated Population Registration System (reg 12) and transaction screening for AML and counter-terrorism laws (reg 31). These are legal requirements; no document confirming Safaricom's own trust arrangement or screening was read, because safaricom.co.ke returned 403.",
      "notes": "Incumbent. M-Pesa is a closed, custodial mobile-money ledger run by Safaricom; the repos listed are sample clients and callback listeners for the Daraja REST API, not code that runs the rail. Attribution of github.com/safaricom is a judgment call: the org is not GitHub-verified and developer.safaricom.co.ke does not link to it, but the org profile links to developer.safaricom.co.ke and commits in mpesa-php-sdk and mpesa-java-sdk come from safaricom.net addresses, and the mpesa-php-sdk composer.json author uses a safaricom.co.ke address. Forks in that org (android-daraja-sdk, mpesa-py, mpesa-api-go, Mpesa.Net), unrelated repos (kubernetes, kubespray, cisco-anyconnect) and the empty mpesa-perl-sample are excluded. www.safaricom.co.ke, including the data privacy statement and M-Pesa terms, returned HTTP 403 (bot protection) to every non-browser request on 2026-10-07, so neither document could be read or cited; the website field therefore points at the Daraja developer portal, which does resolve. Daraja pages are a client-rendered app: page URLs return 200 and their content loads from the portal's /api/graphql populateApi query, which is how the docs were read. The static Postman collection is the one fully fetchable interface artifact.",
      "scores": {
        "C1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/collections/Safaricom%20APIs.postman_collection.json",
              "detail": "Daraja Postman collection (v2.1): every M-Pesa operation (stkpush, c2b registerurl/simulate, b2c, b2b, reversal, transactionstatus, accountbalance) is a POST to sandbox/api.safaricom.co.ke carrying 'Authorization: Bearer <Access-Token>' from Safaricom's /oauth/v1/generate.",
              "checked_at": "2026-10-07",
              "quote": "sandbox.safaricom.co.ke/mpesa/stkpush/v1/processrequest",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Settlement happens only inside Safaricom's M-Pesa platform, reached through Safaricom's authenticated API or its own channels (SIM toolkit, USSD, app). No direct settlement path exists.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/apis/CustomerToBusiness",
              "detail": "C2B docs (loaded via the portal's populateApi query): production endpoints are api.safaricom.co.ke; access needs a Safaricom-issued OAuth token; enabling external validation requires emailing apisupport@safaricom.co.ke.",
              "checked_at": "2026-10-07",
              "quote": "C2B Transaction Validation is optional and must be activated by emailing",
              "archive": "data/archive/m-pesa-daraja-c2b.txt"
            }
          ],
          "finding": "Every integration depends on Safaricom's hosted API and on Safaricom provisioning shortcodes and credentials. No intermediary code is public and no fallback exists, so the dependency is closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "unknown": true,
          "finding": "Re-assessed under the updated anchors on 2026-10-07; still unknown. The NPS Regulations require transaction screening (reg 31, see context), but no Safaricom document read discloses what M-Pesa filters: a search of all 31 Daraja API docs (populateApi) for sanction, AML, blacklist, watchlist and KYC found only KYC fields for organisation operators and a C2B error code \"Invalid KYC Details\", and the customer terms and privacy statement returned 403. Settlement runs in Safaricom's closed ledger, so neither disclosure nor its absence could be shown.",
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/safaricom/mpesa-node-library/tree/678e3c33b20c1447c209eb88eded89f1bb751e11/src",
              "commit": "678e3c33b20c1447c209eb88eded89f1bb751e11",
              "path": "src",
              "detail": "github.com/safaricom has 15 public repos; the non-fork M-Pesa ones are client libraries (Node, PHP, Java, C#), an Android STK sample, and callback-listener samples. None contains the M-Pesa backend, an indexer, or deploy scripts.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Only client SDKs and samples are public. The platform itself (ledger, API gateway, USSD/STK services) is closed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/collections/Safaricom%20APIs.postman_collection.json",
              "detail": "Public Postman v2.1 collection 'Safaricom APIs' (_postman_id 21f972ff-40aa-439e-a906-e52cff4bcf63) with request schemas for M-Pesa Express, C2B, B2C, B2B, reversal, transaction status, account balance and Pull Transactions.",
              "checked_at": "2026-10-07",
              "quote": "21f972ff-40aa-439e-a906-e52cff4bcf63",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/apis/CustomerToBusiness",
              "detail": "C2B docs define the callback payload fields (TransactionType, TransID, TransTime, TransAmount, BusinessShortCode, BillRefNumber, MSISDN, FirstName, MiddleName, LastName, ...); merchants recover missed notifications through the Pull Transaction API or the M-PESA Org portal.",
              "checked_at": "2026-10-07",
              "quote": "For failed notifications, use Pull Transaction API or check the",
              "archive": "data/archive/m-pesa-daraja-c2b.txt"
            }
          ],
          "finding": "API and callback schemas are documented on a hosted portal, with a Postman collection in place of OpenAPI. None of this is versioned in a repo, and no payee export format is specified, so the score is 1 (documented only).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/safaricom/mpesa-java-sdk/blob/0a3667515b2d8b4abff7a454e8d2934cdb3c1d18/pom.xml",
              "commit": "0a3667515b2d8b4abff7a454e8d2934cdb3c1d18",
              "path": "pom.xml",
              "detail": "mpesa-java-sdk at this commit: pom.xml has no <licenses> element and the repo root (.idea, MpesaMaven.iml, README.md, out, pom.xml, src, target) has no LICENSE file. mpesa-api-C-Sharp (7f3d6e9e9c979c79e4c5bedd43de646623a4d6cd) likewise has no LICENSE file and no license statement in its README.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/safaricom/mpesa_listener/blob/ccc202b610f5cda15d3efae90501f84bc11e1208/package.json#L10",
              "commit": "ccc202b610f5cda15d3efae90501f84bc11e1208",
              "path": "package.json",
              "detail": "mpesa_listener has no LICENSE file; package.json L10 carries the npm-init default license: ISC. mpesa-php-sdk (5effb808e79ba6b3d8631ef83c2b9b31fa450152) has no LICENSE file; composer.json L10 declares license: mit with no license text.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/safaricom/mpesa-node-library/blob/678e3c33b20c1447c209eb88eded89f1bb751e11/LICENSE",
              "commit": "678e3c33b20c1447c209eb88eded89f1bb751e11",
              "path": "LICENSE",
              "detail": "mpesa-node-library LICENSE is Apache License 2.0; LNMOnlineAndroidSample (74eced63f0cd5fd2f9869f9fcaf9b14823dcadb8) is Apache-2.0; mpesa_c2b_php_confirmation_validation (96a55227d6191c0717edb0293bbd4c3bde1709c1) is GPL-3.0.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Two of the seven listed SDK repos (Java, C#) carry no license at all, so they cannot legally be forked. Two more (listener, PHP) declare ISC/MIT only in a package manifest, with no license text; they are recorded as \"none\" in repos. The platform needed to run the rail has no public code at all. Judgment call: scored on the listed SDK repos because no repo can run the product.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/apis/CustomerToBusiness",
              "detail": "C2B v2 callback payload sent to the merchant includes the payer's FirstName, MiddleName and LastName 'as per the M-Pesa register' and a masked MSISDN (C2B v1 sends a SHA-256 hash of the MSISDN, which is not anonymising for phone-number inputs).",
              "checked_at": "2026-10-07",
              "quote": "Customer's first name as per the M-Pesa register.",
              "archive": "data/archive/m-pesa-daraja-c2b.txt"
            }
          ],
          "finding": "Each C2B payment sends the payee the payer's name as held in the M-Pesa register and a partial phone number (v2) or an enumerable SHA-256 of it (v1); settlement does not need either. Re-assessed under the updated anchors: 1 needs collection beyond settlement needs \"disclosed in a policy\", and 0 covers undisclosed collection or collection beyond the stated legal requirement. The only disclosure read is the integrator documentation; Safaricom's data privacy statement returned 403, so no payer-facing disclosure and no stated legal basis for passing the name to payees was read. The National Payment System Regulations, 2014 (see context) require Safaricom to keep a register of customer ID details (reg 12), not to pass customer names to payees. Score lowered from 1 to 0. Judgment call: between 1 and 0 the lower anchor is taken because the evidence for 1 (policy disclosure within a stated legal requirement) was not seen; a reviewer who can read the privacy statement and finds a disclosed legal basis for this sharing could restore 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/apis/CustomerToBusiness",
              "detail": "C2B docs: 'Funds originate from the customer wallet and are transferred to the merchant's short code'; the confirmation payload's OrgAccountBalance is the shortcode's balance held on M-PESA.",
              "checked_at": "2026-10-07",
              "quote": "Funds originate from the customer wallet and are transferred to the merchant",
              "archive": "data/archive/m-pesa-daraja-c2b.txt"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/apis/AccountBalance",
              "detail": "Account Balance API docs: organizations query 'their M-PESA account balances' through Safaricom's endpoint.",
              "checked_at": "2026-10-07",
              "quote": "enables organizations to programmatically check their M-PESA account balances",
              "archive": "data/archive/m-pesa-daraja-account-balance.txt"
            }
          ],
          "finding": "Payer and payee funds sit in M-Pesa accounts on Safaricom's platform, so the provider holds custody, and the API docs disclose this. Neither the trust arrangement behind the e-money nor any limit on redirecting funds could be read (the terms returned 403).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/collections/Safaricom%20APIs.postman_collection.json",
              "detail": "All settlement, balance and reversal operations are Safaricom-hosted endpoints (see C2, C3); no exit path outside Safaricom's platform is documented.",
              "checked_at": "2026-10-07",
              "quote": "sandbox.safaricom.co.ke/mpesa/reversal/v1/request",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived. S1 = 1 (provider custody), C2 = 0 (no direct settlement), C3 = 0 (closed single-vendor API), O3 unknown (nothing to self-host). Both funds and the ability to settle depend on Safaricom's liveness.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/apis/CustomerToBusiness",
              "detail": "C2B docs: M-PESA POSTs confirmation/validation results as application/json to the registered URLs; the documented payload and URL requirements (public IP/domain, HTTPS in production) include no signature, HMAC, or shared-secret field or header.",
              "checked_at": "2026-10-07",
              "quote": "The result is posted with a POST request method in application/json format.",
              "archive": "data/archive/m-pesa-daraja-c2b.txt"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/safaricom/mpesa_listener/blob/ccc202b610f5cda15d3efae90501f84bc11e1208/listener.js#L66-L82",
              "commit": "ccc202b610f5cda15d3efae90501f84bc11e1208",
              "path": "listener.js",
              "detail": "Reference C2B ConfirmationURL handler logs req.body and returns ResultCode 0 with no authenticity check; the B2C/B2B result handlers in the same file (L18-L29, L88-L99) do the same.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/safaricom/mpesa_c2b_php_confirmation_validation/blob/96a55227d6191c0717edb0293bbd4c3bde1709c1/confirm.php#L1-L33",
              "commit": "96a55227d6191c0717edb0293bbd4c3bde1709c1",
              "path": "confirm.php",
              "detail": "Reference PHP confirmation handler reads php://input, logs it and acknowledges, with no signature or source verification.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Payment callbacks are unsigned per the Daraja docs, and the reference handlers accept them without verification, so a party who learns a merchant's callback URL can forge payment confirmations unless the merchant re-queries Transaction Status. Handling of API credentials (consumer key/secret, SecurityCredential) in client bundles was not assessed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "allowlist",
        "countries": [
          "KE"
        ],
        "note": "Scoped to what this file assesses: Safaricom's M-Pesa and its Daraja API. Safaricom's own Daraja docs describe M-Pesa as a mobile money service in Kenya, and every Daraja example uses Kenyan (254) MSISDNs. M-Pesa services in other countries (for example those run by Vodacom and other operators) are separate operators with their own ledgers, terms and APIs, and are not covered here. Safaricom's customer terms (safaricom.co.ke) returned HTTP 403 to automated requests, so any further limits stated there (for example on roaming or international transfers) were not read.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://developer.safaricom.co.ke/apis/GettingStarted",
            "archive": "data/archive/m-pesa-daraja-getting-started.txt",
            "quote": "A mobile money transfer service in Kenya for storing and transferring money via mobile phones",
            "detail": "Daraja \"Getting Started\" terminology section defines M-PESA. Page is client-rendered; text read from the portal's own GraphQL populateApi response and archived.",
            "checked_at": "2026-10-09"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "audits": {
        "searched": "Safaricom's Daraja developer portal (developer.safaricom.co.ke), the 15 public repos of github.com/safaricom (no audits folders or security reports), web searches for M-Pesa and Daraja security audits and penetration tests, and news coverage. Safaricom has said an internal M-Pesa fraud investigation report is not for public consumption. No published code audit or penetration test of the M-Pesa platform or the Daraja API was found; the public repos are sample clients only.",
        "checked_at": "2026-10-13",
        "reports": []
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C4",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P2",
            "P3",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 9,
        "unk": 14,
        "total": 23
      }
    },
    {
      "slug": "metamask-card",
      "name": "MetaMask Card",
      "type": "card",
      "website": "https://metamask.io/card",
      "primary_chain": {
        "name": "Linea",
        "chain_id": 59144,
        "basis": "Linea is the chain with the fullest card config in the MetaMask Mobile defaults (metamask-mobile b513a4b, app/selectors/featureFlagController/card/defaults.ts#L37-L102: FoxConnect spender addresses, a balance scanner and eight spendable tokens), and Crypto Life's product page says cardholders spend USDC, USDT and WETH from their wallet on Linea. Unit: the Global FoxConnect spender 0x9dd23A4a... at Linea block 32253699. Excluded: the US FoxConnect 0xA90b298d... (noted in C1 and S2), the Base, Monad and Solana configs, and the Immersve-run UK card on Base."
      },
      "repos": [
        {
          "url": "https://github.com/MetaMask/metamask-mobile",
          "role": "frontend",
          "license": "source-available"
        }
      ],
      "contracts": [
        {
          "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
          "chain_id": 59144,
          "role": "FoxConnect (Global) card spender, non-upgradeable",
          "verified": "sourcify"
        },
        {
          "address": "0xA90b298d05C2667dDC64e2A4e17111357c215dD2",
          "chain_id": 59144,
          "role": "FoxConnect (US) card spender, non-upgradeable",
          "verified": "sourcify"
        },
        {
          "address": "0x1b7A8fF58B58Ad2ABFd731A164298A06A82D9c99",
          "chain_id": 59144,
          "role": "FoxConnect (Global) owner, Safe 1.4.1 2-of-4",
          "verified": "none"
        },
        {
          "address": "0x8dFE562Cbb4E93D5029f39DA26BB6B501a8d1D3e",
          "chain_id": 59144,
          "role": "FoxConnect (Global) beneficiary, Safe 1.4.1 2-of-13",
          "verified": "none"
        },
        {
          "address": "0x576371678e97DfE55f60577cDe2905A1768b5cb6",
          "chain_id": 59144,
          "role": "FoxConnect (Global) treasury, Safe 1.4.1 2-of-10",
          "verified": "none"
        },
        {
          "address": "0xED9f04F2da1B42Ae558d5E688fe2Ef7080931C9A",
          "chain_id": 59144,
          "role": "Card balance scanner (read-only helper)",
          "verified": "none"
        },
        {
          "address": "0xacA92E438df0B2401fF60dA7E4337B687a2435DA",
          "chain_id": 59144,
          "role": "MetaMask USD (mUSD) token proxy",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "FoxConnect (Global) spender contract",
          "role": "contracts",
          "public": true,
          "license": "none",
          "operator": "Baanx / Crypto Life (owner Safe 0x1b7A...9c99)",
          "required": true
        },
        {
          "name": "Cardholder's own MetaMask account (EOA) holding the spendable tokens",
          "role": "wallet",
          "public": true,
          "license": "source-available",
          "operator": "Cardholder",
          "required": true,
          "repo": "https://github.com/MetaMask/metamask-mobile"
        },
        {
          "name": "Spendable tokens on Linea (USDC, USDT, WETH, EURe, GBPe, aUSDC, mUSD, amUSD)",
          "role": "contracts",
          "public": true,
          "license": "source-available",
          "operator": "Each token's issuer (mUSD source is BUSL-1.1; USDC is Circle FiatToken)",
          "required": true
        },
        {
          "name": "FoxConnect withdraw operators (33 EOAs) and multiSend signer EOA",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Baanx / Crypto Life",
          "required": true
        },
        {
          "name": "Crypto Life (Baanx) API and card authorisation backend (api.baanx.com)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Baanx Group / Crypto Life (program manager)",
          "required": true
        },
        {
          "name": "Baanx beneficiary Safe (receives every card pull)",
          "role": "contracts",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Baanx / Crypto Life",
          "required": true,
          "repo": "https://github.com/safe-global/safe-smart-account"
        },
        {
          "name": "KYC and eligibility screening (vendor not named)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Crypto Life",
          "required": true
        },
        {
          "name": "Monavate (card issuer, e-money institution)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "UAB Monavate",
          "required": true
        },
        {
          "name": "Mastercard (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Mastercard",
          "required": true
        },
        {
          "name": "MetaMask Mobile card screens (onboarding, spending limit, card details)",
          "role": "frontend",
          "public": true,
          "license": "source-available",
          "operator": "Consensys",
          "required": false,
          "repo": "https://github.com/MetaMask/metamask-mobile"
        },
        {
          "name": "Infura RPC (card reads on Linea, Base, Monad)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Consensys (Infura)",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/address/0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32253699,
              "detail": "FoxConnect (Global) getWithdrawOperators() returns 33 addresses (all sampled ones are EOAs, e.g. 0x4C893CF4... nonce 166378); withdraw() pulls from any approving wallet to the beneficiary and only an operator can call it; owner() is Safe 0x1b7A8fF5...9c99, which can add or remove operators.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000001b7a8ff58b58ad2abfd731a164298a06a82d9c99"
              },
              "recheck": "cast call 0x9dd23A4a0845f10d65D293776B792af1131c7B30 \"getWithdrawOperators()(address[])\" --rpc-url https://rpc.linea.build --block 32253699",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/address/0x1b7A8fF58B58Ad2ABFd731A164298A06A82D9c99",
              "address": "0x1b7A8fF58B58Ad2ABFd731A164298A06A82D9c99",
              "block_number": 32253699,
              "detail": "Owner Safe (v1.4.1) getThreshold() = 2 with 4 owners (0xce5ff475..., 0x3707C120..., 0x71144589..., 0xE9701D60...); getModulesPaginated(0x1,10) returns no modules and the guard slot is zero. No timelock sits in front of it.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000002"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/address/0xA90b298d05C2667dDC64e2A4e17111357c215dD2",
              "address": "0xA90b298d05C2667dDC64e2A4e17111357c215dD2",
              "block_number": 32253699,
              "detail": "The US FoxConnect's owner() is 0x0AB5e068fA215bA0A317c93DCaF73fcdDF9c814A, an address with no code (EOA, nonce 41), and its single withdraw operator is EOA 0x4C893CF4....",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000000ab5e068fa215ba0a317c93dcaf73fcddf9c814a"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://public.withcl.com/Monavate-Issuer-Terms-2023-Nov.pdf",
              "detail": "Monavate's cardholder terms (linked from Crypto Life's legal page) let the issuer close the card or suspend access immediately, including where it believes continued use could damage its reputation.",
              "quote": "We may close your Card and E-wallet or otherwise suspend access to the Services immediately",
              "archive": "data/archive/metamask-card-monavate-issuer-terms.txt",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "FoxConnect has no pause or blacklist, but every card settlement is a withdraw() that only an allowlisted operator can call, and the operators are EOAs run by Baanx. Any one of them can stop or selectively skip settlement, which meets anchor 0 on its own. The operator list is set by a 2-of-4 Safe with undisclosed signers, no modules, no guard and no timelock. On the excluded US deployment the owner is a single EOA. On the card side, Monavate's terms allow it to close or suspend a card immediately. Both the EOA-held settlement role (verified) and the documented card suspension meet anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/59144/0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32253699,
              "detail": "Verified FoxConnect.sol has two entry points that move tokens. withdraw() requires withdrawOperatorMap[msg.sender]. multiSend() requires multiSendOperatorMap[msg.sender] and an EIP-712 signature from signerAddress (EOA 0x11084c82...56CB).",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/tx/0xdd18b6eaa171dcf4974129304f80c9550040ce57be64785a175184d054cab7c7",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32250700,
              "detail": "Sample card pull. Operator EOA 0x2AcFE192... called withdraw() (selector 0xf7ece0cf), moving 68,698 base units of mUSD from cardholder 0x0edC0eA6... to beneficiary Safe 0x8dFE562C....",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The merchant is paid by Mastercard and Monavate offchain. The only onchain step is a pull from the cardholder's wallet that only Baanx's operator keys can execute. Neither payer nor payee can complete a card payment by calling the contract directly.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/core/Engine/controllers/card-controller/services/baanx-config.ts#L13-L20",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/core/Engine/controllers/card-controller/services/baanx-config.ts",
              "detail": "The card provider's base URL and API key come from build-time env (BAANX_API_URL, MM_CARD_BAANX_API_CLIENT_KEY); builds.yml#L44 sets production to https://api.baanx.com. No Baanx backend code is public.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://support.metamask.io/trade/metamask-card/card-faq/",
              "detail": "MetaMask's FAQ names Crypto Life as the card provider, Monavate (spelled Monovate) as issuer and Mastercard as network.",
              "quote": "Crypto Life is the provider of the MetaMask Card",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card payment needs Baanx's closed authorisation backend and its operator keys, plus Monavate and Mastercard. None of these is public and none has a fallback, so the card path is closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/components/UI/Card/components/Onboarding/SignUp.tsx#L139-L170",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/components/UI/Card/components/Onboarding/SignUp.tsx",
              "detail": "Sign-up preselects the country from device geolocation, and eligibility comes from registrationSettings fetched from the Baanx API. The client contains no sanctions list; screening runs server-side.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/679758c14272c334b6975a26/67ed139f59c727d6e69de3ea_CL%20Platform%20Terms%20of%20Use%20-%20Monavate%202025.pdf",
              "detail": "Crypto Life's platform terms require users not to be on UK, EU, US OFAC or UN sanctions lists and reserve the right to restrict service by country.",
              "quote": "restrict or deny the provision of Services in certain countries",
              "archive": "data/archive/metamask-card-cl-platform-terms.txt",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "FoxConnect itself has no address or country filter. Sanctions and country screening exist and are disclosed in the terms, but they run in the closed Baanx backend and cannot be bypassed, because there is no direct settlement path (C2 = 0). Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/selectors/featureFlagController/card/defaults.ts#L37-L102",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/selectors/featureFlagController/card/defaults.ts",
              "detail": "The Linea card config enumerates eight tokens by address (USDC, USDT, WETH, EURe, GBPe, aUSDC, mUSD, amUSD). Base, Monad and Solana are enumerated in the same file.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://raw.githubusercontent.com/MetaMask/metamask-mobile/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/selectors/featureFlagController/card/defaults.ts | sed -n 37,102p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/address/0x176211869cA2b568f2A7D4EE941E073a821EE1ff",
              "address": "0x176211869cA2b568f2A7D4EE941E073a821EE1ff",
              "block_number": 32253699,
              "detail": "Linea USDC (FiatToken proxy) has blacklister() 0x349570f5Dab10ba630FCd4050FBFcdffCdA42bA5 and pauser() 0xa537b946f3baB9453F664AAF6876F4a29260A02b.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xbd102430",
                "expect": "0x000000000000000000000000349570f5dab10ba630fcd4050fbfcdffcda42ba5"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/59144/0x58a3a9c561591bab0dd11110eca755ea455f1841",
              "address": "0xacA92E438df0B2401fF60dA7E4337B687a2435DA",
              "block_number": 32253699,
              "detail": "The mUSD proxy points to implementation 0x58a3a9c5... (Sourcify exact match, BUSL-1.1), which exposes freeze, freezeAccounts, forceTransfer and pause under FREEZE_MANAGER_ROLE, FORCED_TRANSFER_MANAGER_ROLE and PAUSER_ROLE.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x00000000000000000000000058a3a9c561591bab0dd11110eca755ea455f1841"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens and chains are enumerated in code. The tokens carry issuer controls: USDC has a blacklister and a pauser, and mUSD can freeze accounts and force transfers. Linea also runs a centralised sequencer. None of these assumptions appears in the MetaMask support pages or the Crypto Life terms I read. Enumerated in code, assumptions not stated, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/59144/0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32253699,
              "detail": "Sourcify v2 returns match (partial, not exact_match) for FoxConnect Global and US; Lineascan shows \"Source Code Verified (Exact Match)\" for FoxConnect Global, compiler 0.8.23, license None.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://sourcify.dev/server/v2/contract/59144/0x9dd23A4a0845f10d65D293776B792af1131c7B30 | jq .match"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/address/0xED9f04F2da1B42Ae558d5E688fe2Ef7080931C9A",
              "address": "0xED9f04F2da1B42Ae558d5E688fe2Ef7080931C9A",
              "block_number": 32253699,
              "detail": "The balance scanner the app reads through is not on Sourcify (match null). It is read-only and holds no funds.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The settlement contract is verified: an exact match on the explorer and a partial match on Sourcify. Its source exists only in verification metadata. No public repository or build script reproduces it, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/tree/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/components/UI/Card",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/components/UI/Card",
              "detail": "The card client (onboarding, spending limit, delegation, card details) is public in metamask-mobile. No Baanx organisation or repo exists on GitHub, and no FoxConnect, backend, operator or API-schema repo was found.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Public: the app-side card client (source-available) and the verified FoxConnect source on Sourcify and Lineascan. Closed: the Baanx API (no published schema), the authorisation backend and the operator service. Judgment call: this is more than \"SDK or contracts only\", but without the backend or an API schema it does not reach 2, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/README.md#L35-L81",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "README.md",
              "detail": "The README covers building the app (Infura key, .js.env, Expo, yarn setup). The card needs MM_CARD_BAANX_API_CLIENT_KEY and the hosted Baanx API, which the README does not provide.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Build docs exist for the client. Reproduction not attempted. The README alone shows blockers: card features need a Baanx-issued client key and Baanx's hosted API, and there is no self-host path for the card backend.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/59144/0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32253699,
              "detail": "FoxConnect's ABI and events (WithdrawalStatus, MultiSendStatus, operator and treasury events) are available from Sourcify metadata. No repo versions them.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/components/UI/Card/sdk/balanceScannerAbi.json",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/components/UI/Card/sdk/balanceScannerAbi.json",
              "detail": "The only card ABI committed in the client repo is the read-only balance scanner's. No Baanx API schema or cardholder export was found in the repo.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Interfaces are available only through verification metadata, not versioned in a provider repo. There is no API schema, and I found no payee or cardholder export in the repo. Judgment call: between \"documented only\" and \"none\"; ABIs are recoverable, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/LICENSE#L1-L7",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "LICENSE",
              "detail": "The metamask-mobile LICENSE grants only a \"limited non-exclusive license to inspect and study the code\", with no right to modify or redistribute.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12",
              "drift": true
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/59144/0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32253699,
              "detail": "The verified FoxConnect.sol carries SPDX-License-Identifier UNLICENSED.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Nothing in the payment path is under an OSI license. The client is inspect-only, the settlement contract is UNLICENSED, and the backend, operator keys, issuer and network are closed. Closed required components alone set F1 to 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/.github/workflows/cla.yml#L18-L24",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": ".github/workflows/cla.yml",
              "detail": "A CLA bot enforces the MetaMask CLA (metamask.io/cla), which grants MetaMask a perpetual, sublicensable copyright license to contributions.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/LICENSE#L1-L3",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "LICENSE",
              "detail": "The LICENSE says Consensys is \"still working through licensing considerations\" and wishes to \"preserve our licensing options\".",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12",
              "drift": true
            }
          ],
          "finding": "A CLA permits relicensing, and the LICENSE itself reserves future licensing choices instead of committing to stability. That meets anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/core/Engine/controllers/card-controller/services/baanx-config.ts#L13-L20",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/core/Engine/controllers/card-controller/services/baanx-config.ts",
              "detail": "The card controller cannot run without a Baanx API key and base URL; the Baanx service has no open implementation.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Card payments cannot run without Baanx's proprietary backend and operators, Monavate and Mastercard.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/util/sentry/utils.ts#L657-L750",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/util/sentry/utils.ts",
              "detail": "Sentry initialises with enabled = forceEnabled || hasConsent. captureExceptionForced() turns it on without consent for critical errors.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/components/UI/Card/hooks/useSpendingLimit.ts#L549-L563",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/components/UI/Card/hooks/useSpendingLimit.ts",
              "detail": "Card screens emit MetaMetrics events (e.g. CARD_BUTTON_CLICKED via trackEvent), which go through MetaMask's consent-gated analytics.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics (MetaMetrics) and error reporting (Sentry) ship in the app and are consent-gated, but a forced Sentry path reports critical errors before consent. The Baanx-hosted KYC and web dashboard were not inspected, and no trace was run. Judgment call: mostly opt-in (2), but the forced pre-consent path and the unseen hosted flows put this between anchors, so I took the lower one, 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/679758c14272c334b6975a26/67ed139f59c727d6e69de3ea_CL%20Platform%20Terms%20of%20Use%20-%20Monavate%202025.pdf",
              "detail": "Crypto Life's platform terms list identity data requested at registration (name, email, contact details, phone, username, government ID, date of birth), state that it is a regulatory requirement, and set a five-year retention period.",
              "quote": "This information required is a regulatory requirement and used in the prevention and detection",
              "archive": "data/archive/metamask-card-cl-platform-terms.txt",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://public.withcl.com/Monavate-Issuer-Terms-2023-Nov.pdf",
              "detail": "Monavate's terms say the card is not issued until identity is verified, and that data may be passed to fraud prevention and credit reference agencies.",
              "quote": "We are required by law to verify certain details about you.",
              "archive": "data/archive/metamask-card-monavate-issuer-terms.txt",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Full KYC is required and is disclosed with a legal basis in the terms, but only in policy documents, not in a code or repo document. Collection goes well beyond settlement needs. Disclosed in policy, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/tx/0xdd18b6eaa171dcf4974129304f80c9550040ce57be64785a175184d054cab7c7",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32250700,
              "detail": "A card pull emits only an ERC-20 Transfer (cardholder 0x0edC0eA6... to beneficiary 0x8dFE562C..., amount) and WithdrawalStatus(result, batchSize). It carries no merchant or order data.",
              "checked_at": "2026-10-07",
              "recheck": "cast receipt 0xdd18b6eaa171dcf4974129304f80c9550040ce57be64785a175184d054cab7c7 --rpc-url https://rpc.linea.build"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://www.withcl.com/products/metamask",
              "detail": "Crypto Life tells cardholders that each payment is recorded onchain.",
              "quote": "Every payment creates a blockchain record.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No merchant or order data goes onchain. Every card spend is still a public transfer from the cardholder's everyday wallet to a known Baanx address, and the FoxConnect approval flags the wallet as a MetaMask Card holder. Anyone can read spend amounts and timing. There are no fresh addresses. Minimal linkage that the provider discloses, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/components/UI/Card/constants.ts#L6-L19",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/components/UI/Card/constants.ts",
              "detail": "Card reads go to Infura URLs built from MM_INFURA_PROJECT_ID (Linea falls back to rpc.linea.build). These are hardcoded constants, not user settings.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://support.metamask.io/trade/metamask-card/security-privacy/",
              "detail": "MetaMask's support page says Crypto Life runs KYC and processes personal data under its own privacy policy, and that MetaMask does not see it.",
              "quote": "Crypto Life manages this step",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A card payment is seen by Baanx/Crypto Life, Monavate and Mastercard; the app also reads through Infura. These parties are named in docs and code but cannot be swapped. The KYC vendor behind Crypto Life is not named. No trace was run. Present and disclosed, not swappable, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/components/UI/Card/constants.ts#L6-L19",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/components/UI/Card/constants.ts",
              "detail": "Card RPC URLs are constants. Linea uses Infura or rpc.linea.build, and Base and Monad use Infura only.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/core/Engine/controllers/card-controller/services/baanx-config.ts#L13-L20",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/core/Engine/controllers/card-controller/services/baanx-config.ts",
              "detail": "Card transaction history and balances come from the Baanx API, set at build time.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card module's RPC endpoints are hardcoded constants. Card data comes from Baanx's closed API, which is fixed at build time and has no public indexer. A user cannot point the card at their own endpoints.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/59144/0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32253699,
              "detail": "Verified withdraw(tokens, sources, amounts) calls transferFrom(source, beneficiary, amount) for arbitrary sources, with no cardholder signature and no per-payment authorisation; setBeneficiary() is onlyOwner.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/address/0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32253699,
              "detail": "getBeneficiary() = Safe 0x8dFE562C...1D3e (v1.4.1, 2-of-13, no modules, no guard).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x565a2e2c",
                "expect": "0x0000000000000000000000008dfe562cbb4e93d5029f39da26bb6b501a8d1d3e"
              },
              "recheck": "cast call 0x9dd23A4a0845f10d65D293776B792af1131c7B30 \"getBeneficiary()(address)\" --rpc-url https://rpc.linea.build --block 32253699",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "At rest, tokens stay in the cardholder's own wallet. Any of 33 Baanx operator EOAs can pull up to the full approved allowance from any approving wallet at any time, without a cardholder signature. The owner Safe can change where pulled funds go. Pulled funds then sit in a Baanx-held Safe and settle offchain. The provider can redirect funds within the allowance, which meets anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/address/0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 32253699,
              "detail": "The EIP-1967 implementation and admin slots are zero. The verified FoxConnect source (Ownable2Step, EIP712) has no delegatecall, proxy or selfdestruct path, so the code is immutable.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "recheck": "cast storage 0x9dd23A4a0845f10d65D293776B792af1131c7B30 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://rpc.linea.build --block 32253699",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "FoxConnect is not upgradeable, and the same holds for the US deployment. Its owner can still change operators, signer, treasury and beneficiary, which is scored under C1 and S1, not here. The tokens are upgradeable by their issuers (USDC and mUSD are proxies), which is covered under C5.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/components/UI/Card/hooks/useSpendingLimit.ts#L156-L160",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/components/UI/Card/hooks/useSpendingLimit.ts",
              "detail": "Limit type defaults to 'full'; at L516-L520 'full' maps to BAANX_MAX_LIMIT = '2199023255551' tokens (constants.ts#L43). 'restricted' (a custom amount) is opt-in. The UI labels the full option \"Full access\".",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/components/UI/Card/hooks/useCardDelegation.ts#L104-L136",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/components/UI/Card/hooks/useCardDelegation.ts",
              "detail": "The amount is sent as a plain ERC-20 approve(delegationContract, amount); there is no expiry and no permit.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/address/0xacA92E438df0B2401fF60dA7E4337B687a2435DA",
              "address": "0xacA92E438df0B2401fF60dA7E4337B687a2435DA",
              "block_number": 32253699,
              "detail": "Sample cardholder 0x0edC0eA6...De3E's mUSD allowance to FoxConnect is 2199023255543896596 base units, about 2.2 trillion mUSD, i.e. the full-access default less spends.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The default approval is effectively unbounded (2.2 trillion tokens), with no expiry, to a spender that operator EOAs can pull from. A restricted amount is available as an opt-in. The default is labelled \"Full access\" in the UI, and the support page tells users they set a spending cap. Judgment call: labelled in the UI, so \"unbounded by default, disclosed\" (1) rather than 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/address/0x0edC0eA676C5e608D628ecc659a13A213476De3E",
              "address": "0x0edC0eA676C5e608D628ecc659a13A213476De3E",
              "eoa": true,
              "block_number": 32253699,
              "detail": "The sample cardholder is an EOA (no code) holding 29.451877 mUSD in its own balance. The tokens never leave the wallet until an operator pull, so the holder can transfer them, or approve(FoxConnect, 0), with their own key.",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0xacA92E438df0B2401fF60dA7E4337B687a2435DA \"balanceOf(address)(uint256)\" 0x0edC0eA676C5e608D628ecc659a13A213476De3E --rpc-url https://rpc.linea.build --block 32253699"
            }
          ],
          "finding": "Chain of reasoning. By S1, funds at rest stay in the cardholder's own EOA and Baanx holds no key over it, so the holder can move funds or revoke the allowance through the token contract without Baanx. By C2 = 0 and C3 = 0, card settlement stops if Baanx disappears. By O3 = 1, no self-host path is proven. Funds already pulled to the beneficiary Safe stay with Baanx. A standing unbounded allowance also stays live until the user revokes it, so a compromised operator key could drain it (see S1 and S3). Funds retained and retrievable, settlement stops, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/core/Engine/controllers/card-controller/providers/BaanxProvider.ts#L421-L439",
              "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
              "path": "app/core/Engine/controllers/card-controller/providers/BaanxProvider.ts",
              "detail": "The build-time MM_CARD_BAANX_API_CLIENT_KEY is sent as both client_id and client_secret, and elsewhere as an x-secret-key header, from the mobile app. The OAuth flow uses PKCE (S256) and user email, password and OTP.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A key labelled as a secret ships in every app bundle. What it authorises on Baanx's side is not visible. The code shows a mitigation: PKCE plus per-user credentials, so the key works as a public client identifier. There are no webhooks in the client. Judgment call: \"secrets in client with a mitigation\" (1). Whether the mitigation is disclosed beyond the code is unknown.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. Monavate's cardholder terms, linked from Crypto Life's legal page, state that UAB Monavate is authorised and regulated by the Bank of Lithuania (authorisation code LB002139) and is required by law to verify cardholder identity (https://public.withcl.com/Monavate-Issuer-Terms-2023-Nov.pdf). Crypto Life's platform terms state that its cryptocurrency-based services are not regulated financial services and are not covered by the Financial Ombudsman Service or the FSCS, and that KYC and transaction records are kept five years after account closure. US cards run under separate Baanx US terms with Cross River Bank (privacy notice linked in metamask-mobile constants.ts), and UK cards are moving to Immersve on Base (cards issued before 28 Sep 2026 stop on 29 Dec 2026); neither was assessed.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "AD",
          "AR",
          "AT",
          "BE",
          "BG",
          "BH",
          "BR",
          "CA",
          "CH",
          "CL",
          "CO",
          "CR",
          "CY",
          "DE",
          "DK",
          "DO",
          "ES",
          "FI",
          "FR",
          "GB",
          "GG",
          "GI",
          "GR",
          "GT",
          "HR",
          "HU",
          "IE",
          "IM",
          "IS",
          "IT",
          "JE",
          "LI",
          "LU",
          "MC",
          "MT",
          "MX",
          "NL",
          "NO",
          "OM",
          "PA",
          "PL",
          "PT",
          "RO",
          "SE",
          "SI",
          "SK",
          "SV",
          "UY"
        ],
        "note": "MetaMask's support article lists 48 countries eligible for sign-up. The list does not include the whole EU (for example Czechia, Estonia, Latvia and Lithuania are absent), so countries are listed one by one. The United States is excluded: the same page says the card is not currently available for sign-ups there, and existing US cardholders under the separate Baanx US / Cross River programme can keep using their cards. Product variants: the UK programme is migrating to Immersve on Base, and the US programme was not assessed. The Crypto Life platform terms require residence \"in a country where Baanx products & services are available\" and let CL restrict countries at its discretion, but they name none. The FAQ says ineligible regions limit sign-ups, not spending; the card can be used wherever Mastercard is accepted. Only virtual cards are open to new sign-ups.",
        "evidence": [
          {
            "tier": "claimed",
            "by": "provider",
            "kind": "document",
            "url": "https://support.metamask.io/trade/metamask-card/what-is-metamask-card/",
            "archive": "data/archive/metamask-card-eligible-countries.txt",
            "detail": "MetaMask support article \"What is MetaMask Card?\" lists 48 countries under \"What countries are eligible to sign up for MetaMask Card?\" and says US sign-ups are not currently available.",
            "checked_at": "2026-10-09",
            "quote": "What countries are eligible to sign up for MetaMask Card?",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://cdn.prod.website-files.com/679758c14272c334b6975a26/67ed139f59c727d6e69de3ea_CL%20Platform%20Terms%20of%20Use%20-%20Monavate%202025.pdf",
            "archive": "data/archive/metamask-card-cl-platform-terms.txt",
            "detail": "CL Platform Terms (Monavate 2025), section 3 Eligibility, require residence in a country where Baanx products and services are available, without naming countries.",
            "checked_at": "2026-10-09",
            "quote": "Reside in a country where Baanx products & services are available."
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Scored the Global FoxConnect spender on Linea at block 32253699, from the MetaMask Mobile card defaults at metamask-mobile b513a4b. MetaMask Card is run by Crypto Life (Baanx), issued by Monavate, on Mastercard. Funding works by an ERC-20 approval from the cardholder's own wallet; Baanx operator EOAs pull through FoxConnect.withdraw. No Baanx or FoxConnect repository exists; contract source comes from Sourcify and Lineascan only. The Baanx global privacy policy (secure.baanx.co.uk) timed out from this network and is not cited. No audit of FoxConnect was found, so S6 is unknown.",
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "chain_id": 59144,
            "address": "0x176211869cA2b568f2A7D4EE941E073a821EE1ff"
          },
          {
            "symbol": "USDT",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Tether",
            "chain_id": 59144,
            "address": "0xA219439258ca9da29E9Cc4cE5596924745e12B93"
          },
          {
            "symbol": "WETH",
            "class": "other",
            "chain_id": 59144,
            "address": "0xe5D7C2a44FfDDf6b295A15c148167daaAf5Cf34f"
          },
          {
            "symbol": "EURe",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Monerium",
            "chain_id": 59144,
            "address": "0x3ff47c5Bf409C86533FE1f4907524d304062428D"
          },
          {
            "symbol": "GBPe",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Monerium",
            "chain_id": 59144,
            "address": "0x3Bce82cf1A2bc357F956dd494713Fe11DC54780f"
          },
          {
            "symbol": "aUSDC",
            "class": "other",
            "chain_id": 59144,
            "address": "0x374D7860c4f2f604De0191298dD393703Cce84f3"
          },
          {
            "symbol": "mUSD",
            "class": "platform",
            "chain_id": 59144,
            "address": "0xacA92E438df0B2401fF60dA7E4337B687a2435DA"
          },
          {
            "symbol": "amUSD",
            "class": "other",
            "chain_id": 59144,
            "address": "0x61B19879F4033c2b5682a969cccC9141e022823c"
          }
        ],
        "conversion": "at_spend",
        "note": "Tokens stay in the user's wallet under a spending delegation and are sold for fiat when a payment is made. There is no fixed default: the card spends the token the user ranks first in 'Manage', and the FAQ's example uses USDC. The list is the Linea card config in MetaMask Mobile; Base, Monad and Solana have their own token lists in the same file and the UK programme is moving to Immersve on Base. Classes: WETH is wrapped ETH; aUSDC and amUSD are Aave interest-bearing deposit tokens for USDC and mUSD; mUSD (MetaMask USD) is MetaMask's own-branded dollar stablecoin, so it is classed as platform. mUSD is also the cashback and withdrawal currency.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/MetaMask/metamask-mobile/blob/b513a4b65ab0a9f84ff0913108a19deb43003e98/app/selectors/featureFlagController/card/defaults.ts#L37-L102",
            "commit": "b513a4b65ab0a9f84ff0913108a19deb43003e98",
            "path": "app/selectors/featureFlagController/card/defaults.ts",
            "detail": "The Linea card config enumerates eight spendable tokens by address (USDC, USDT, WETH, EURe, GBPe, aUSDC, mUSD, amUSD) next to the FoxConnect spender addresses.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "claimed",
            "by": "provider",
            "kind": "document",
            "url": "https://support.metamask.io/trade/metamask-card/what-is-metamask-card/",
            "archive": "data/archive/metamask-card-eligible-countries.txt",
            "detail": "MetaMask's support article says the card converts the user's tokens into fiat at the time of the transaction.",
            "quote": "At the time of your transaction, the MetaMask Card converts your available tokens into fiat currency",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "claimed",
            "by": "provider",
            "kind": "document",
            "url": "https://support.metamask.io/trade/metamask-card/card-faq/",
            "archive": "data/archive/metamask-card-ops-faq.txt",
            "detail": "The card FAQ says the balance reflects the highest-priority token the user sets in Manage.",
            "quote": "Your MetaMask Card balance reflects the balance of the highest priority token you have set in",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "The MetaMask Card support pages and metamask-mobile repo (no card or FoxConnect audit), web searches for FoxConnect and Baanx / Crypto Life audits, the Consensys Diligence audit list (MetaMask Delegation Framework audits only; the card uses a plain ERC-20 approve, not that framework), and the docs/ audit folder of github.com/safe-fndn/safe-smart-account for the Baanx owner, beneficiary and treasury Safes. No audit of the FoxConnect spender contracts is published. A 2021 Blockchain Foundry report on a Baanx ERC-20 token exists but is not in the card path. Spendable-token audits (USDC, mUSD) are not logged here.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Ackee Blockchain",
            "date": "2023-03-28",
            "type": "audit",
            "scope": "Shared component: Safe smart account v1.4.0 core contracts (singleton, proxy, factory, handlers), used by the Baanx FoxConnect owner, beneficiary and treasury Safes",
            "url": "https://github.com/safe-fndn/safe-smart-account/blob/main/docs/Safe_Audit_Report_1_4_0.pdf",
            "commit": "eb93dbb0f62e2dc1b308ac4c110038062df0a8c9",
            "repo": "https://github.com/safe-fndn/safe-smart-account",
            "covers_deployed": "partly",
            "findings": "2 medium, 1 low, 6 warnings, 2 info; one warning fixed, the rest acknowledged",
            "note": "The Linea Safes use the canonical SafeL2 v1.4.1 singleton 0x29fcB43b... (slot 0 read 2026-10-13). Safe says 1.4.1 added one ERC-4337 opcode bugfix after this audit and was not re-audited. Does not cover FoxConnect itself."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 5,
        "short": 15,
        "unk": 3,
        "total": 23
      }
    },
    {
      "slug": "minipay",
      "name": "Opera MiniPay",
      "type": "incumbent",
      "website": "https://minipay.to",
      "repos": [],
      "contracts": [],
      "notes": "Incumbent by the eligibility rule: no verified contract and no public repository needed to run MiniPay was found. MiniPay is a closed, self-custodial stablecoin wallet app (Android, iOS, inside Opera Mini) offered by Blueboard Limited (Opera Group) on Celo mainnet (chain 42220). It settles in third-party stablecoins (USDm, USDC, USDT) and maps phone numbers through Celo's generic SocialConnect stack (ODIS plus the FederatedAttestations core contract 0x0aD5b1d0C25ecF6266Dd951403723B2687d6aff2). The one MiniPay-specific onchain element is its SocialConnect issuer, 0x7888612486844Bb9BE598668081c59A9f7367FBc, which has no code (an EOA), so it is not a verified contract. MiniPay-related public repos all belong to celo-org (snippets, Mini App templates, workshops); none runs the wallet. The Opera and operasoftware GitHub orgs have no MiniPay repo, and github.com/minipay is an unrelated 2019 org. www.opera.com/products/minipay redirects to minipay.to, which links the terms, privacy statement and docs.minipay.xyz. The FAQ on minipay.to is support content, so it is claimed tier and holds no score up. Search log: docs/research/minipay.md.",
      "components": [
        {
          "name": "MiniPay app (Android, iOS, Opera Mini embed)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Blueboard Limited (Opera Group)",
          "required": true
        },
        {
          "name": "MiniPay backend (account, phone verification, transaction metadata)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Blueboard Limited (Opera Group)",
          "required": true
        },
        {
          "name": "MiniPay SocialConnect issuer and attestation signer",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Blueboard Limited (Opera Group)",
          "required": false
        },
        {
          "name": "ODIS (phone-number obfuscation service)",
          "role": "oracle",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Celo / cLabs",
          "required": false,
          "repo": "https://github.com/celo-org/social-connect"
        },
        {
          "name": "FederatedAttestations core contract",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Celo governance",
          "required": false,
          "repo": "https://github.com/celo-org/celo-monorepo"
        },
        {
          "name": "Celo L2 mainnet (chain 42220)",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Celo network (sequencer operator not verified here)",
          "required": true,
          "repo": "https://github.com/celo-org/op-geth"
        },
        {
          "name": "Celo RPC endpoint used by the app (not identified)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "unknown",
          "required": true
        },
        {
          "name": "USDm stablecoin (Mento)",
          "role": "other",
          "public": true,
          "license": "source-available",
          "operator": "Mento",
          "required": false,
          "repo": "https://github.com/mento-protocol/mento-core"
        },
        {
          "name": "USDC stablecoin issuer",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Circle",
          "required": false
        },
        {
          "name": "USDT stablecoin issuer",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Tether",
          "required": false
        },
        {
          "name": "On-ramp, off-ramp and swap providers",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Third parties (not enumerated in the policy)",
          "required": false
        },
        {
          "name": "Third-party KYC (e.g. SumSub) for ramp and card services",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Third parties",
          "required": false
        },
        {
          "name": "AppsFlyer and Firebase Cloud Messaging SDKs",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "AppsFlyer; Google",
          "required": false
        },
        {
          "name": "Google Drive key backup",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Google",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "reserves the right at any time to modify or discontinue the Services in whole or in part, and to terminate your access to the Services at any time, with or without notice",
              "detail": "Blueboard Terms of Service, general section: Blueboard may terminate an individual user's access to the Services at any time, with or without notice.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Blueboard can cut an individual user off from the MiniPay app at any time with no notice, which blocks the MiniPay payment path for that user. MiniPay has no settlement contracts of its own: transfers are plain stablecoin transfers on Celo, and issuer freeze powers over USDC and USDT belong under C5. Judgment call: scored 0 on the termination power over the app path. The user's keys stay with the user (see C2 and S4), so the funds themselves are not frozen by this power.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "Any Crypto Asset, however, is stored, sent and received by and within the CELO blockchain network",
              "detail": "MiniPay service terms: the app stores a key pair with an encrypted private key; assets live on Celo; 'Neither your key pair nor the Secret Recovery Phrase is available to us.'",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.celo.org/build/mini-apps/overview.md",
              "quote": "MiniPay holds USDm, USDC and USDT",
              "detail": "Celo docs list MiniPay's three stablecoins with their Celo mainnet addresses and show a payment as a plain ERC-20 transfer() call.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A MiniPay payment is an ERC-20 transfer on Celo signed with a key the user holds, so a user holding the recovery phrase can settle by calling the token contract directly from any Celo wallet. This is shown by terms and docs only. No trace of exporting a MiniPay key and settling elsewhere was run, so the documented cap of 1 applies.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/privacy-statement",
              "quote": "mobile phone number: to set up a MiniPay account and use MiniPay",
              "detail": "Privacy statement section 2: a phone number is collected to set up a MiniPay account; Technical Data (IP, UID, device data) and Transactional Data are collected by Blueboard when the app is used.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "attempt to derive the source code of",
              "detail": "Terms EULA section: the Software Services are licensed as executable code only; copying, decompiling and deriving source are prohibited.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Using MiniPay requires an account with Blueboard's closed backend, reached only through Blueboard's closed app. No intermediary code is public and no alternative operator exists. The RPC endpoint the app uses was not identified. Judgment call: anchor 1 (documented, no public code) and anchor 0 (closed, single-vendor) both fit; took 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "The MiniPay Service is available only to users in qualifying countries",
              "detail": "Terms: MiniPay is limited to qualifying countries (the general section excludes the People's Republic of China); users warrant they are not on any trade embargo or economic sanction list.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Geographic and sanctions gating at the app edge is disclosed in the terms. The terms do not name the list source or the country list. Whether the closed app or backend filters addresses or transactions cannot be checked from code. The settlement layer (Celo plus the stablecoin contracts) is outside MiniPay and was not examined here.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.celo.org/build/mini-apps/overview.md",
              "quote": "MiniPay runs only on Celo (mainnet) and Celo Sepolia (testnet)",
              "detail": "Celo's MiniPay page enumerates the chain (Celo mainnet 42220) and the three tokens (USDm 0x765DE816845861e75A25fCA122bb6898B8B1282a, USDC 0xcebA9300f2b948710d2653dD7B07f33A8B32118C, USDT 0x48065fbBE25f71C9282ddf5e1cD6D6A887483D5e).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The chain and supported tokens are listed in docs. No user-facing document read states the USDC and USDT issuers' freeze or blacklist powers or the Celo sequencer assumptions. No MiniPay code is public, so the token list cannot be shown in code.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/celo-org/minipay/blob/a25a3a23be100835d1f0f9af46a82c20607212e3/README.md",
              "commit": "a25a3a23be100835d1f0f9af46a82c20607212e3",
              "path": "README.md",
              "detail": "The only repo named for MiniPay that carries MiniPay-specific values is celo-org/minipay ('MiniPay snippet code for external partners'): balance, gas and SocialConnect lookup snippets, no LICENSE file. github.com/opera (13 repos) and github.com/operasoftware (137 repos) contain no MiniPay code.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "The Software Services are licensed and not sold to you",
              "detail": "Terms EULA: the app's source code is described as a trade secret and Blueboard's exclusive property.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No component of MiniPay itself (app, backend, issuer service) is public. The public MiniPay code is Celo's partner snippets and Mini App templates, which do not run the wallet.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.minipay.xyz/technical-references.md",
              "quote": "MiniPay injects an Ethereum provider when it loads your app",
              "detail": "MiniPay developer docs document the injected EIP-1193 provider, custom methods (getExchangeRate, scanQrCode, requestContact) and token transfer examples for Mini Apps.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The Mini App interface is documented on a hosted docs site, not versioned in a public repo. No payee data export format is documented. Settlement uses standard ERC-20 ABIs that MiniPay does not define.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "you may not copy, decompile, reverse engineer, disassemble, attempt to derive the source code of",
              "detail": "Terms EULA: a personal, non-transferable licence to the executable code only; copying, modification and derivative works are prohibited.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The app and backend needed to run MiniPay are proprietary and closed. A third party cannot fork them.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/privacy-statement",
              "quote": "MiniPay includes third-party technology or code, some of which may use your data in different ways",
              "detail": "Privacy statement section 5 names AppsFlyer and Firebase Cloud Messaging as third-party code in MiniPay and lists 'analytic system technology providers' among processors.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "An attribution/analytics SDK (AppsFlyer) and Firebase messaging are in the app, disclosed in the privacy statement. Whether they are on by default, and what they send, could not be checked: the app is closed and no trace was run.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/privacy-statement",
              "quote": "your IP address, a unique user ID (UID)",
              "detail": "Privacy statement: collects phone number, receiver phone number, IP, UID, device data and in-app actions, wallet address and holdings, and transaction type and amount linked to the UID; processed for contract, legitimate interests, legal compliance and marketing.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/privacy-statement",
              "quote": "to send you marketing information about our products and services",
              "detail": "Privacy statement section 3 lists marketing and preference analysis among the purposes of processing.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "MiniPay collects identity, device and behavioural data and links transactions to a user ID, well beyond addresses and amounts. All of this is disclosed in the privacy statement, and part of it is used for marketing and product analytics rather than any legal requirement. Judgment call: anchor 1 (disclosed in a policy) and anchor 0 (collection beyond the stated legal requirement) both fit; took 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://celoscan.io/address/0x0aD5b1d0C25ecF6266Dd951403723B2687d6aff2",
              "address": "0x0aD5b1d0C25ecF6266Dd951403723B2687d6aff2",
              "chain_id": 42220,
              "block_number": 79459279,
              "detail": "FederatedAttestations emitted 1975 AttestationRegistered events with issuer = MiniPay issuer 0x7888612486844Bb9BE598668081c59A9f7367FBc in blocks 79454281-79459279. Example: lookupIdentifiers(0xad14248c1A6401162Abbe73047c941397b22F5c2, [MiniPay issuer]) at block 79459279 returns the phone-derived identifier 0xda87e60402949f20227d37ae0693c65441a0cafe18435dd982c5b2cf1eafb9a5.",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0x0aD5b1d0C25ecF6266Dd951403723B2687d6aff2 'lookupIdentifiers(address,address[])(uint256[],bytes32[])' 0xad14248c1A6401162Abbe73047c941397b22F5c2 '[0x7888612486844Bb9BE598668081c59A9f7367FBc]' --rpc-url https://forno.celo.org --block 79459279"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/celo-org/minipay/blob/a25a3a23be100835d1f0f9af46a82c20607212e3/README.md#L264-L270",
              "commit": "a25a3a23be100835d1f0f9af46a82c20607212e3",
              "path": "README.md",
              "detail": "Celo's MiniPay partner snippets name 0x7888612486844Bb9BE598668081c59A9f7367FBc as 'the MiniPay issuer address on Mainnet' for phone-number lookups.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/privacy-statement",
              "quote": "Blockchain networks and related providers with whom you might complete a Crypto Assets transaction (no personal data)",
              "detail": "The privacy statement says no personal data is shared with blockchain networks.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Each payment is a plain stablecoin transfer, which links payer and payee publicly. In addition, MiniPay's issuer publishes onchain an attestation that ties each registered wallet address to an ODIS-obfuscated phone identifier. That marks the address as a MiniPay account, and anyone with ODIS quota can resolve a phone number to it. The user-facing privacy statement says no personal data goes to blockchain networks. Judgment call: the attestation is described in developer docs but not to users, so the linkage is treated as undisclosed; 0 rather than 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/privacy-statement",
              "quote": "on-ramp providers, off-ramp providers, swaps providers",
              "detail": "Privacy statement section 5 lists Opera Group companies, text-message, support and analytics providers, on/off-ramp and swap providers, AppsFlyer, Firebase Cloud Messaging, WhatsApp and Telegram (Indonesia).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties in and around the payment flow are disclosed by category in the privacy statement. The ramp providers and the RPC provider are not named, and none of this can be checked or swapped in code because the app is closed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "Neither your key pair nor the Secret Recovery Phrase is available to us",
              "detail": "MiniPay service terms: the app generates the key pair on the device, stores an encrypted private key, and backs up the recovery phrase to the user's Google account; Blueboard says it has no access to either.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "By the terms, MiniPay is self-custodial and payments go directly from payer to payee as token transfers. That matches anchor 3, but it rests on documents only: key generation and storage in the closed app cannot be checked. The documented cap of 1 applies.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "Neither your key pair nor the Secret Recovery Phrase is available to us",
              "detail": "Terms: user-held keys and recovery phrase; assets held on Celo, not by Blueboard (see S1, C2).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived. S1 = 1 (self-custody per terms, documented cap), C2 = 1 (direct ERC-20 transfer possible with the user's key, documented only), C3 = 0 (closed single-vendor app and backend), O3 unknown (nothing public to self-host). If Blueboard disappears, a user with the recovery phrase can move funds through another Celo wallet. This is documented, not verified, and the MiniPay app path itself stops.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "blocklist",
        "countries": [
          "CN"
        ],
        "note": "The terms say the MiniPay Service is available only to users in \"qualifying countries\" and is void where prohibited, but neither the terms, the FAQ nor the site publishes the list of qualifying countries. The only country the terms name is the People's Republic of China, where Blueboard offers no crypto-related services, so CN is the only entry. This is a floor, not a claim that MiniPay is offered everywhere else: availability elsewhere depends on the unpublished qualifying-country list, and users also warrant they are not on any trade embargo or sanctions list (no list named). The site's \"send to 70+ countries\" and the FAQ's \"53 countries\" and \"over 60 countries\" for local top-up describe transfer and ramp reach, not where the wallet is offered. The MiniPay Card is offered only \"in selected supported markets\", also unlisted. The underlying Celo contracts have no country restriction; this block describes the MiniPay app.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://minipay.to/terms-of-service",
            "quote": "we do not offer or make available any crypto-related services to users located in the People's Republic of China",
            "detail": "MiniPay (Blueboard Limited) terms of service, general terms; same section says the Services are made available to users in qualifying countries and are void where prohibited.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://minipay.to/terms-of-service",
            "quote": "The MiniPay Service is available only to users in qualifying countries",
            "detail": "MiniPay Service section of the terms; the qualifying countries are not listed anywhere on minipay.to.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "audits": {
        "searched": "minipay.to and Opera's press and security blog pages (no MiniPay audit linked), github.com/celo-org/minipay, the security-reviews folders of celo-org/celo-monorepo and celo-org/optimism (the latter holds upstream OP Stack reviews, not listed here), the Celo forum (L2 audit and Core Contracts Release 8 posts), mento.org/audits and ChainSecurity's Mento reports, and web searches for MiniPay, ODIS and SocialConnect audits. No audit of the MiniPay app, backend or issuer service was found. Not listed: Immunefi's Nov-Dec 2024 Celo competition (L1-to-L2 migration tooling and stCelo); Mento's Hats, Sherlock and Macro entries (no report linked); the ChainSecurity Mento Liquity v2 audit.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "ChainSecurity",
            "date": "2026-02-17",
            "type": "audit",
            "scope": "Shared component: Mento Core v3, including StableTokenV3 and StableTokenSpoke (the USDm token contracts), FPMM swaps, liquidity strategies, oracle adapter and ReserveV2",
            "url": "https://reports.chainsecurity.com/Mento/ChainSecurity_Mento_MentoCoreV3_Audit.pdf",
            "commit": "0e07807c222fabf93556bd48b263483f994b9332",
            "repo": "https://github.com/mento-protocol/mento-core",
            "covers_deployed": "unknown",
            "findings": "0 critical, 0 high, 7 medium, 9 low; 9 code corrected, 1 specification changed, 1 partly corrected, 5 risk accepted",
            "note": "Five review rounds from 22 October 2025 (683af1f) to the final version 0e07807. USDm is one of the tokens MiniPay users hold and send; whether the USDm proxy on Celo points to the audited StableTokenV3 was not checked."
          },
          {
            "auditor": "Trail of Bits",
            "date": "2024-12-19",
            "type": "audit",
            "scope": "Celo L2 blockchain (OP Stack fork): token duality, fee currencies, alt-DA, L1-to-L2 data migration; celo-monorepo contracts, celo-org/op-geth and celo-org/optimism",
            "url": "https://github.com/celo-org/celo-monorepo/blob/551bc1b6d76f7a08047573d70fb35b804dd84a00/packages/protocol/security-reviews/2024_12-Cel2-TrailOfBits.pdf",
            "repo": "https://github.com/celo-org/op-geth",
            "commit": "c6d7b55",
            "covers_deployed": "partly",
            "findings": "0 high, 2 medium, 4 low, 4 informational",
            "note": "Targets: celo-monorepo 89591e1 and PR #11261, op-geth c6d7b55, optimism 50977c3; review October-November 2024. Celo mainnet has since moved to later rebases of op-geth and optimism (celo-rebase-17/18), so the audit covers an earlier version of the chain MiniPay settles on."
          },
          {
            "auditor": "Verilog Solutions",
            "date": "2022-09-20",
            "type": "audit",
            "scope": "Shared component: Celo OdisPayments contract and proxy (ODIS quota payments made by SocialConnect issuers such as MiniPay's), celo-monorepo PR #9740",
            "url": "https://www.verilog.solutions/audits/celo_pr_9740/",
            "commit": "4bf959b",
            "repo": "https://github.com/celo-org/celo-monorepo",
            "covers_deployed": "unknown",
            "findings": "1 medium (cUSD paid in cannot be withdrawn; acknowledged), 1 informational (resolved)",
            "note": "Listed as a Core Contracts Release 8 audit in the Celo forum release post. Used only in the optional phone-number lookup flow."
          },
          {
            "auditor": "Hacken",
            "date": "2022-07",
            "type": "audit",
            "scope": "Shared component: Celo Core Contracts Release 8 (per the Celo forum post, the release that added FederatedAttestations and updated Escrow); exact contract list not read",
            "url": "https://hacken.io/wp-content/uploads/2022/08/CLABS_04072022_SCAudit_Report2-5.pdf",
            "blocked_to_bots": true,
            "covers_deployed": "unknown",
            "note": "Linked as the Core Contracts Release 8 audit report in the Celo forum post \"Core Contracts Release 8\" (forum.celo.org/t/core-contracts-release-8/4050) and in the cLabs Identity Team milestone post. The URL returns HTTP 403 to scripted requests, so the report was not read; the date is taken from the file name. FederatedAttestations holds the MiniPay issuer's phone attestations."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P2",
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S3",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 14,
        "unk": 9,
        "total": 23
      }
    },
    {
      "slug": "monero",
      "name": "Monero",
      "type": "transfer",
      "website": "https://www.getmonero.org",
      "primary_chain": {
        "name": "Monero mainnet",
        "caip2": "monero:418015bb9ae982a1975da7d79277c270",
        "basis": "Monero is its own proof-of-work chain, so the unit is Monero mainnet as defined by the reference node monerod at tag v0.18.5.3 (mainnet_hard_forks in src/hardforks/hardforks.cpp L34-L76; current fork v16 since height 2,689,608). CAIP-2 id from the registered monero namespace (ChainAgnostic/namespaces monero/caip2.md, mainnet genesis hash prefix). Excluded: stagenet, testnet, Wownero and other forks, exchanges and atomic-swap tools."
      },
      "repos": [
        {
          "url": "https://github.com/monero-project/monero",
          "role": "backend",
          "license": "BSD-3-Clause"
        },
        {
          "url": "https://github.com/monero-project/monero-gui",
          "role": "frontend",
          "license": "BSD-3-Clause"
        },
        {
          "url": "https://github.com/monero-project/monero-site",
          "role": "docs",
          "license": "BSD-3-Clause"
        }
      ],
      "contracts": [],
      "components": [
        {
          "name": "Monero mainnet consensus (proof-of-work miners and full nodes)",
          "role": "ledger",
          "public": true,
          "license": "BSD-3-Clause",
          "operator": "miners and node operators; rule changes ship as scheduled hard forks",
          "required": true,
          "repo": "https://github.com/monero-project/monero"
        },
        {
          "name": "monerod reference node (own node or a remote node run by someone else)",
          "role": "backend",
          "public": true,
          "license": "BSD-3-Clause",
          "operator": "user, or any public remote-node operator",
          "required": true,
          "repo": "https://github.com/monero-project/monero"
        },
        {
          "name": "wallet2 library and monero-wallet-cli (in the monero repo)",
          "role": "wallet",
          "public": true,
          "license": "BSD-3-Clause",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/monero-project/monero"
        },
        {
          "name": "Monero GUI wallet",
          "role": "wallet",
          "public": true,
          "license": "BSD-3-Clause",
          "operator": "user",
          "required": false,
          "repo": "https://github.com/monero-project/monero-gui"
        },
        {
          "name": "Public remote and bootstrap nodes (GUI simple mode picks one via P2P)",
          "role": "api",
          "public": true,
          "license": "BSD-3-Clause",
          "operator": "independent node operators",
          "required": false,
          "repo": "https://github.com/monero-project/monero"
        },
        {
          "name": "MoneroPulse DNS records (advisory checkpoints, update notices)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Monero core team domains (moneropulse.se/.org/.net/.co)",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_core/cryptonote_core.cpp#L119-L151",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/cryptonote_core/cryptonote_core.cpp",
              "detail": "monerod fetches checkpoints from the MoneroPulse DNS domains (checkpoints.cpp L315-L338), but enforce-dns-checkpointing defaults to false and disable-dns-checkpoints turns the lookup off; enforcement is the operator's opt-in.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/cryptonote_core/cryptonote_core.cpp?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 119,151p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/hardforks/hardforks.cpp#L34-L76",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/hardforks/hardforks.cpp",
              "detail": "Rule changes are hard forks compiled into releases at fixed heights; the last mainnet fork (v16) was at height 2,689,608 in August 2022.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The consensus rules contain no admin key, pause, freeze, blacklist or allowlist role, and recipients are one-time addresses that a filter could not target. The core team runs the MoneroPulse DNS domains, which publish checkpoints; nodes look them up by default but only enforce them if the operator opts in. Rule changes need a hard fork that miners and node operators choose to run. Judgment call: the substance is anchor 3, but a 3 needs onchain evidence about a deployed contract, which a chain with no contract addresses cannot supply, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/rpc/core_rpc_server_commands_defs.h#L614-L650",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/rpc/core_rpc_server_commands_defs.h",
              "detail": "The node's send_raw_transaction RPC takes only the signed transaction hex (plus relay and sanity flags) and relays it to the P2P network; any monerod, the user's own or a remote one, accepts it.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/rpc/core_rpc_server_commands_defs.h?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 614,650p"
            }
          ],
          "finding": "A payer signs a transaction in their own wallet and submits it to any Monero node; the payee detects it by scanning with their view key. No company, API or signer is in the path. Judgment call: this is direct settlement in substance, but anchor 3 is defined by calls to public contracts and needs onchain evidence about a deployed contract, which this chain has none of, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/rpc/core_rpc_server.cpp#L197-L250",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/rpc/core_rpc_server.cpp",
              "detail": "With bootstrap-daemon-address set to auto (the GUI's simple modes, main.qml L792), monerod picks a public node advertised on the P2P network, so there is no vendor endpoint; the local node takes over once synced.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/rpc/core_rpc_server.cpp?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 197,250p"
            }
          ],
          "finding": "No relayer, paymaster or API is required. A user can run monerod and a wallet locally; light users can point the wallet at any remote node, and the GUI's simple mode picks one from public nodes advertised on the P2P network rather than from a vendor list. All node code is public.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_core/blockchain.cpp#L3264-L3325",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/cryptonote_core/blockchain.cpp",
              "detail": "Transaction validation checks ring sizes, key images and proofs; it has no address or country rule.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero-gui/blob/d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c/main.qml#L786-L795",
              "commit": "d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c",
              "path": "main.qml",
              "detail": "GitHub code search on 2026-10-09 for country, analytics and telemetry in monero-project/monero-gui returned nothing; in monero-project/monero, country matched only an old English mnemonic word list.",
              "checked_at": "2026-10-09",
              "recheck": "gh search code --repo monero-project/monero-gui country --json path --jq '.[].path'; gh search code --repo monero-project/monero country --json path --jq '.[].path'"
            }
          ],
          "finding": "The settlement layer is neutral: consensus has no address or country rules, and recipients are unlinkable one-time addresses. We found no screening in the node, the CLI or the GUI. A remote node can refuse to relay, but the wallet can switch node or use its own. Judgment call: the substance fits 3, but 3 needs a distributed-package or trace record for the client, which we do not have, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/README.md#L120-L150",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "README.md",
              "detail": "The README's upgrade table lists every mainnet fork and states that upgrades are scheduled; the chain carries only XMR, with no issued tokens and no sequencer.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/README.md?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 120,150p"
            }
          ],
          "finding": "The rail carries one asset, XMR, on one proof-of-work chain, so there is no issuer freeze and no sequencer to inherit. The upgrade schedule is published in the README. Neither the GUI nor the CLI states to payees that the chain depends on scheduled hard forks and miner adoption. Scored 2: enumerated in code, assumptions not stated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "finding": "Not applicable as worded: Monero has no contracts, and its rules run in node software that each operator builds or downloads. The repo has reproducible-build tooling (contrib/guix), but we did not verify any release binary against source.",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/tree/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src",
              "detail": "The monero repo at v0.18.5.3 contains the node (daemon, cryptonote_core, p2p, rpc), the wallet library and CLI (wallet, simplewallet), the wallet RPC server and reproducible-build scripts (contrib/guix); the GUI is in monero-project/monero-gui at v0.18.5.3 (d7c2f13d).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq '.[].name'"
            }
          ],
          "finding": "Every layer of a payment is public: node, wallet library, CLI and GUI wallets, RPC servers and build scripts. Remote nodes run the same public code. Scored 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/README.md#L560-L600",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "README.md",
              "detail": "The README documents dependencies and build steps for each platform and how to run monerod; the GUI README covers its build.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Build and run documentation exists for the node and wallets. Reproduction not attempted, so the score is capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/simplewallet/simplewallet.cpp#L9025-L9045",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/simplewallet/simplewallet.cpp",
              "detail": "The CLI's export_transfers command writes the wallet's transfer history to a CSV file (output<N>.csv by default); node RPC messages are defined in src/rpc/core_rpc_server_commands_defs.h and wallet RPC in src/wallet/wallet_rpc_server_commands_defs.h.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/simplewallet/simplewallet.cpp?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 9025,9045p"
            }
          ],
          "finding": "A payee can export transfers to CSV from the CLI, and the RPC request and response types are versioned in the repo. There are no contract ABIs. The RPC interface is defined as C++ serialization structs; the human-readable RPC reference lives on the website, not in the repo. Judgment call: the export would support 3, but we are not sure the C++ definitions count as an API schema equivalent to OpenAPI, so we take the lower anchor, 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/LICENSE",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "LICENSE",
              "detail": "monero, monero-gui and monero-site carry the BSD 3-clause licence; the meta repo (process documents) has no licence file and no running component needs it.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero-gui/contents/LICENSE?ref=d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c\" --jq .content | base64 -d | head -12",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every repository needed to run the rail (node, wallet library, CLI and GUI) is BSD-3-Clause. The meta repository (process documents) has no licence file, but nothing needs it to run. It is not listed under repos because nothing runs from it.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/docs/CONTRIBUTING.md#L104-L110",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "docs/CONTRIBUTING.md",
              "detail": "The contribution contract says the project MUST use a share-alike licence, patches MUST use the project licence, patches are owned by their authors, and there MUST NOT be any copyright assignment process.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/docs/CONTRIBUTING.md?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 104,110p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/LICENSE",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "LICENSE",
              "detail": "The LICENSE file's commit history since 2016 (14f75384) shows only copyright-year updates.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no CLA, copyright stays with each contributor, and the repo's contribution contract forbids copyright assignment, so no single party can relicense the code. No relicensing has happened. Judgment call: we read the no-assignment and share-alike rules as the written licence-stability commitment anchor 3 asks for.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_core/cryptonote_core.cpp#L119-L180",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/cryptonote_core/cryptonote_core.cpp",
              "detail": "The only external services the node consults by default are the MoneroPulse DNS records (checkpoints, update notices), and both can be disabled by flag.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/cryptonote_core/cryptonote_core.cpp?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 119,180p"
            }
          ],
          "finding": "A production deployment needs no proprietary component: node and wallets are public and run on their own. The default DNS lookups are optional. Judgment call: the code supports 3, but with no O3 reproduction we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero-gui/blob/d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c/main.qml#L1530-L1548",
              "commit": "d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c",
              "path": "main.qml",
              "detail": "The GUI's persistent settings hold node addresses and display options and no analytics setting; code search of monero-gui for analytics and telemetry returned nothing, and in monero only a Trezor protobuf matched telemetry.",
              "checked_at": "2026-10-09",
              "recheck": "gh search code --repo monero-project/monero-gui analytics --json path --jq '.[].path'; gh search code --repo monero-project/monero-gui telemetry --json path --jq '.[].path'"
            }
          ],
          "finding": "We found no analytics, telemetry or crash-reporting SDK in the node, CLI or GUI. The node's default update check is a DNS lookup, counted under P4. We ran no trace. Judgment call: absence shown only in code is capped at 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/rpc/core_rpc_server_commands_defs.h#L614-L650",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/rpc/core_rpc_server_commands_defs.h",
              "detail": "Submitting a payment sends only the signed transaction; no RPC on the payment path takes account, identity or contact fields.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/rpc/core_rpc_server_commands_defs.h?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 614,650p"
            }
          ],
          "finding": "The flow collects only what settlement needs: a transaction whose outputs, amounts and optional encrypted payment ID are readable only by the recipient. No required component holds an account or identity. A remote node, if used, sees the user's IP and the transactions and outputs they request (see P4).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_core/blockchain.cpp#L3264-L3325",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/cryptonote_core/blockchain.cpp",
              "detail": "From fork v15 every input must use a ring of 16 (15 decoys plus the real output) and all rings in a transaction must be the same size; amounts are hidden by RingCT with Bulletproofs+ (cryptonote_config.h HF_VERSION_BULLETPROOF_PLUS 15).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/cryptonote_core/blockchain.cpp?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 3264,3325p"
            }
          ],
          "finding": "By default every payment goes to a one-time stealth address, hides the amount, and hides the spent output among 16 ring members. Fee, transaction size, input and output counts, timing and tx_extra contents are visible. The sender is hidden only probabilistically: decoy-selection and timing heuristics, and transactions that spend outputs created together, can narrow the ring; we record these in the finding and do not score them. Judgment call: we score what the protocol reveals by default, which is anchor 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_core/cryptonote_core.cpp#L172-L176",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/cryptonote_core/cryptonote_core.cpp",
              "detail": "check-updates defaults to notify (a DNS lookup of MoneroPulse records), and DNS checkpoints are looked up hourly unless disabled (L272-L280).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/cryptonote_core/cryptonote_core.cpp?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 172,176p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/rpc/core_rpc_server.cpp#L197-L250",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/rpc/core_rpc_server.cpp",
              "detail": "In simple mode the wallet's requests go through a bootstrap public node until the local node syncs.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "With a local node, only the user's DNS resolver (for MoneroPulse lookups) and P2P peers see anything. With a remote or bootstrap node, that node sees the user's IP, the transactions they submit and the outputs they request. Both are named in code and can be swapped or disabled by setting. Scored 2: third parties present, named in code, swappable.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero-gui/blob/d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c/main.qml#L1530-L1548",
              "commit": "d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c",
              "path": "main.qml",
              "detail": "The GUI stores a user-editable list of remote nodes (remoteNodesSerialized, edited in components/RemoteNodeEdit.qml) and a bootstrap node address; the CLI takes --daemon-address.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero-gui/contents/main.qml?ref=d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c\" --jq .content | base64 -d | sed -n 1530,1548p"
            }
          ],
          "finding": "The node endpoint, which is both RPC and indexer for a Monero wallet, is configurable in the GUI and CLI, and the node code is public.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_core/blockchain.cpp#L3264-L3325",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/cryptonote_core/blockchain.cpp",
              "detail": "A transaction spends the payer's outputs and creates one-time outputs only the payee's keys can spend; there is no escrow or intermediary account.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/cryptonote_core/blockchain.cpp?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 3264,3325p"
            }
          ],
          "finding": "Value moves directly from the payer's outputs to the payee's one-time outputs in one transaction; keys stay in the user's wallet. No one holds funds in flight. Judgment call: anchor 3 in substance, but 3 needs onchain evidence about a deployed contract, which this chain has none of, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/README.md#L120-L150",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "README.md",
              "detail": "The README states that upgrades are scheduled hard forks whose software is released before the fork date, and tabulates every fork with its height and minimum version; the next fork is listed as undetermined.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/README.md?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 120,150p"
            }
          ],
          "finding": "No key can change the rules. Upgrades are hard forks compiled into node releases at fixed heights, announced in the README schedule ahead of time, and effective only if miners and node operators run them; the last one was in August 2022. The core team's MoneroPulse checkpoints are advisory unless an operator enforces them. Judgment call: notice is given by schedule but there is no enforced delay, and 3 would also need onchain evidence this chain cannot supply, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/rpc/core_rpc_server_commands_defs.h#L614-L650",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/rpc/core_rpc_server_commands_defs.h",
              "detail": "Wallets submit fully signed transactions; Monero has no allowance or delegated-spend mechanism.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/rpc/core_rpc_server_commands_defs.h?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 614,628p"
            }
          ],
          "finding": "There are no token approvals; each payment is a signed transaction and nothing can pull funds later. Judgment call: this beats exact-amount approvals in substance, but 3 needs a distributed-package or trace record for the client, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/rpc/core_rpc_server.cpp#L197-L250",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "path": "src/rpc/core_rpc_server.cpp",
              "detail": "Node discovery and bootstrap rely on the P2P network, not on a vendor service.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero/contents/src/rpc/core_rpc_server.cpp?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 197,250p"
            }
          ],
          "finding": "Derived from S1=2 (anchor 3 in substance), C2=2 (direct in substance), C3=3 and O3=1. Funds are outputs controlled by the user's keys (S1), any node accepts a payment (C2), and no hosted service is required (C3). There is no provider whose disappearance would stop the rail; if the project's maintainers stopped, the released code would keep running. We did not reproduce a self-hosted setup (O3=1). Judgment call: 2, not 3, for that reason.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero-gui/blob/d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c/main.qml#L1530-L1548",
              "commit": "d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c",
              "path": "main.qml",
              "detail": "Remote-node credentials in the GUI are per-node username and password entered by the user; no service keys are bundled.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/monero-project/monero-gui/contents/main.qml?ref=d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c\" --jq .content | base64 -d | sed -n 1530,1548p"
            }
          ],
          "finding": "Spend and view keys stay in the user's wallet file. The protocol has no API keys or webhooks, and we found no bundled service keys. Judgment call: absence shown only in code is capped at 2, since 3 needs a distributed-package or trace record.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/monero-site/blob/5a596d19334d647cdad65cdb9f1287729c9d140d/resources/research-lab/audits/clsag.pdf",
              "commit": "5a596d19334d647cdad65cdb9f1287729c9d140d",
              "path": "resources/research-lab/audits/clsag.pdf",
              "detail": "The CLSAG audit report by JP Aumasson and Antony Vennard (2020) is in the website repo; research-lab/audits/BP holds Bulletproofs audit statements of work.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/monero-project/meta/blob/97fb74b0bfffafa553b8ca6b4978218b4ca13362/VULNERABILITY_RESPONSE_PROCESS.md#L1-L30",
              "commit": "97fb74b0bfffafa553b8ca6b4978218b4ca13362",
              "path": "VULNERABILITY_RESPONSE_PROCESS.md",
              "detail": "A live bug bounty paid in XMR from community donations, with scope (code only, not live sites) and HackerOne intake, is defined in the meta repo; the monero README links it.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Audit reports exist for protocol components (CLSAG, Bulletproofs), and a bug bounty with scope is in a repo. We did not read the audit PDFs for a pinned commit, and the current release has not been shown to be the audited code. Scored 1: audit reports, no pinned commit shown.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "The protocol has no country or address rules, and the official node, CLI and GUI wallets contain no country or IP-geolocation gate in GitHub code search on 2026-10-09. The GUI picks bootstrap nodes from the P2P network, not by region. Optional DNS lookups (MoneroPulse) and remote nodes chosen by the user are outside the protocol. Legality of use and exchange access vary by jurisdiction; that is not an availability restriction by the protocol.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/monero-project/monero-gui/blob/d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c/main.qml#L786-L795",
            "commit": "d7c2f13d88e0f2f2d5d1488be64da66f698ccb7c",
            "path": "main.qml",
            "detail": "The GUI starts the local node with bootstrap address auto and no location check; code search of monero-gui for country returns nothing.",
            "checked_at": "2026-10-09",
            "recheck": "gh search code --repo monero-project/monero-gui country --json path --jq '.[].path'"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_core/blockchain.cpp#L3264-L3325",
            "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
            "path": "src/cryptonote_core/blockchain.cpp",
            "detail": "Transaction validation has no address or country rule.",
            "checked_at": "2026-10-09"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: Monero mainnet transfers. Pins: monero@22578c3f (v0.18.5.3), monero-gui@d7c2f13d (v0.18.5.3), meta@97fb74b0, monero-site@5a596d19. The chain has no contracts, so cells whose top anchor needs onchain contract evidence (C1, C2, S1, S2) are capped at 2 with the reason in each finding, and O1 is unknown. No transactions, node runs, builds, traces or self-host attempts were made. No primary legal source was cited: EUR-Lex refused automated requests (HTTP 202 challenge), so the EU AML Regulation's treatment of anonymity-enhancing coins is not recorded here.",
      "audits": {
        "searched": "The monero-site repo (resources/research-lab/audits and blog posts on CLSAG, Bulletproofs and Bulletproofs+), the monero and meta repos, the CCS proposal pages for the Bulletproofs+ audits, the RandomX repo's audits folder (RandomX is the proof-of-work in the node, vendored as external/randomx), OSTIF's and Quarkslab's posts, and the Trail of Bits publications list. Not logged: JP Aumasson's second Bulletproofs+ audit (CCS milestone completed March 2021; no report link found), Cypher Stack's 2024 review of Zano's CLSAG variant, and the FCMP++ reviews and contest (including Trail of Bits' July 2026 FCMP++ crypto review), which cover an upgrade not yet activated. No audit of the current wallet or node release as a whole was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "ZenGo X",
            "date": "2021-02-15",
            "type": "audit",
            "scope": "Bulletproofs+ range proofs - review of the paper and of the C++ implementation for Monero.",
            "url": "https://suyash67.github.io/homepage/assets/pdfs/bulletproofs_plus_audit_report_v1.1.pdf",
            "commit": "2d287f69b79929908f884224c22c58d3bec50b09",
            "repo": "https://github.com/SarangNoether/monero",
            "covers_deployed": "partly",
            "findings": "2 vulnerabilities (missing point-at-infinity check, missing zero-challenge check) and several weaknesses",
            "note": "Hosted on the co-author's site and linked from Monero's CCS proposal. Bulletproofs+ became mandatory at the August 2022 hard fork; the audited branch was merged with later changes."
          },
          {
            "auditor": "JP Aumasson and Antony Vennard",
            "date": "2020-07-29",
            "type": "audit",
            "scope": "CLSAG ring signatures - review of the paper and of the C++ implementation (clsag-device branch), coordinated by OSTIF.",
            "url": "https://github.com/monero-project/monero-site/blob/5a596d19334d647cdad65cdb9f1287729c9d140d/resources/research-lab/audits/clsag.pdf",
            "commit": "66bcde2",
            "repo": "https://github.com/SarangNoether/monero",
            "covers_deployed": "partly",
            "note": "CLSAG has been the consensus ring signature since the October 2020 hard fork; the audited code has been edited since in monero-project/monero."
          },
          {
            "auditor": "Quarkslab",
            "date": "2019-07-30",
            "type": "audit",
            "scope": "RandomX proof-of-work (tag 1.0.4 and later commits), funded by the Monero community via OSTIF.",
            "url": "https://github.com/tevador/RandomX/blob/f865ff607c96aa5aff6eb3e980848c1eb580c8c0/audits/Report-Quarkslab.pdf",
            "commit": "5d815c57c0860f39dbe0eb8bdf1e9dd3d2dabe3d",
            "repo": "https://github.com/tevador/RandomX",
            "covers_deployed": "partly",
            "note": "The node vendors a later RandomX release. The RandomX README says none of the four 2019 audits found critical vulnerabilities."
          },
          {
            "auditor": "X41 D-Sec",
            "date": "2019-07-10",
            "type": "audit",
            "scope": "RandomX proof-of-work algorithm and implementation.",
            "url": "https://github.com/tevador/RandomX/blob/f865ff607c96aa5aff6eb3e980848c1eb580c8c0/audits/Report-X41.pdf",
            "repo": "https://github.com/tevador/RandomX",
            "covers_deployed": "partly"
          },
          {
            "auditor": "Kudelski Security",
            "date": "2019-07-02",
            "type": "audit",
            "scope": "RandomX proof-of-work algorithm and implementation.",
            "url": "https://github.com/tevador/RandomX/blob/f865ff607c96aa5aff6eb3e980848c1eb580c8c0/audits/Report-Kudelski.pdf",
            "repo": "https://github.com/tevador/RandomX",
            "covers_deployed": "partly"
          },
          {
            "auditor": "Trail of Bits",
            "date": "2019-05-28",
            "type": "audit",
            "scope": "RandomX proof-of-work at release 1.0.2, funded by Arweave.",
            "url": "https://github.com/tevador/RandomX/blob/f865ff607c96aa5aff6eb3e980848c1eb580c8c0/audits/Report-TrailOfBits.pdf",
            "commit": "378d5de",
            "repo": "https://github.com/tevador/RandomX",
            "covers_deployed": "partly",
            "findings": "3 findings (single AES rounds in AesGenerator, insufficient VM testing, brittle parameters)"
          },
          {
            "auditor": "Quarkslab",
            "date": "2018-10-20",
            "type": "audit",
            "scope": "Bulletproofs implementation (bp-multi-aggregation branches) for Monero, via OSTIF.",
            "url": "https://blog.quarkslab.com/resources/2018-10-22-audit-monero-bulletproof/18-06-439-REP-monero-bulletproof-sec-assessment.pdf",
            "commit": "b7e61db030da8c97b3e82354bfee8caae57d3137",
            "repo": "https://github.com/moneromooo-monero/bitmonero",
            "covers_deployed": "partly",
            "findings": "Major issues in proof verification (overflow, multi-exponentiation errors, missing input checks) and medium deserialization issues, fixed before deployment",
            "note": "Also reviewed 7f964dfc on bp-multi-aggregation. Original Bulletproofs were replaced by Bulletproofs+ in August 2022 and remain only to validate older transactions."
          },
          {
            "auditor": "Kudelski Security",
            "date": "2018-07",
            "type": "audit",
            "scope": "Bulletproofs integration in Monero (bp-multi-aggregation branch), via OSTIF.",
            "url": "https://ostif.org/wp-content/uploads/2018/07/KudelskiBulletproofsFinal.pdf",
            "repo": "https://github.com/moneromooo-monero/bitmonero",
            "covers_deployed": "partly",
            "findings": "3 low-severity issues and 7 observations; no major or critical issues",
            "note": "Hosted by OSTIF, which coordinated the audit. Same supersession as the Quarkslab Bulletproofs report."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 2,
          "limiting": [
            "C1",
            "C2",
            "C4",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1"
          ]
        },
        "F": {
          "score": 2,
          "limiting": [
            "F3"
          ]
        },
        "P": {
          "score": 2,
          "limiting": [
            "P1",
            "P4"
          ]
        },
        "S": {
          "score": 1,
          "limiting": [
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 20,
        "short": 2,
        "unk": 1,
        "total": 23
      }
    },
    {
      "slug": "nullmask",
      "name": "Nullmask",
      "type": "incumbent",
      "website": "https://nullmask.io",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Nullmask Pool (UUPS proxy 0x8888…B026 and implementation; source not published)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Nullmask operator (unnamed company)",
          "required": true
        },
        {
          "name": "AdminUpgradeController 0x6073…cFa1 (admin is an EOA)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Nullmask operator",
          "required": true
        },
        {
          "name": "RPC proxy (wallet network endpoint; generates proofs, holds viewing keys)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Nullmask operator",
          "required": true
        },
        {
          "name": "Relayer (submits transfers, swaps and withdrawals)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "Nullmask operator",
          "required": true
        },
        {
          "name": "Guard deposit-screening service (EOA 0x3AAf…9239 approves deposits)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Nullmask operator",
          "required": true
        },
        {
          "name": "Third-party blockchain analytics provider (screening; unnamed)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "unnamed",
          "required": true
        },
        {
          "name": "Nullmask web app (app.nullmask.io)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Nullmask operator",
          "required": false
        },
        {
          "name": "Uniswap V2 (swaps inside the pool)",
          "role": "other",
          "public": true,
          "license": "GPL-3.0",
          "operator": "none (immutable)",
          "required": false,
          "repo": "https://github.com/Uniswap/v2-core"
        },
        {
          "name": "Ethereum mainnet",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Ethereum validators",
          "required": true,
          "repo": "https://github.com/ethereum/go-ethereum"
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 1,
              "url": "https://etherscan.io/address/0x88888888Eb71E1D68aD0C471C6893EdEEa00B026",
              "address": "0x88888888Eb71E1D68aD0C471C6893EdEEa00B026",
              "block_number": 26153596,
              "detail": "guard() on the Nullmask proxy returns 0x3AAfEd649423Ec28459D0Aadb7EdBAeff0FD9239 at block 26153596.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x7ceab3b1",
                "expect": "0x0000000000000000000000003aafed649423ec28459d0aadb7edbaeff0fd9239"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 1,
              "url": "https://etherscan.io/address/0x3AAfEd649423Ec28459D0Aadb7EdBAeff0FD9239",
              "address": "0x3AAfEd649423Ec28459D0Aadb7EdBAeff0FD9239",
              "block_number": 26153596,
              "eoa": true,
              "detail": "The guard address has no code (an EOA, nonce 95 at block 26153596).",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/compliance/guard-service.md",
              "detail": "Only the guard can approve or reject a pending deposit.",
              "checked_at": "2026-10-09",
              "quote": "Only the guard can call",
              "drift": true
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "The terms reserve upgrades, pauses of deposits, transfers, swaps and withdrawals, and fee changes, without notice.",
              "checked_at": "2026-10-09",
              "quote": "We can upgrade them, pause them and change fees without notice.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A single EOA decides, deposit by deposit, whether funds enter the pool, and the operator's keys can pause withdrawals with no notice and no maximum length. Scored 0: EOA-held role that can target individual addresses.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "The operator states transfers, swaps and withdrawals need its servers and relayer.",
              "checked_at": "2026-10-09",
              "quote": "These operations need our servers. The application offers no way to carry them out without them.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "By the operator's own terms, every transfer and withdrawal is proved by its servers and submitted by its relayer, and no tooling to do otherwise is provided. The contract source is unpublished, so a direct path cannot be reconstructed. Scored 0 on the provider's admission; only a pending deposit can be taken back directly.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "The Services include the network endpoint, the screening service and the relayer, all run by the operator.",
              "checked_at": "2026-10-09",
              "quote": "including the network endpoint your wallet connects to, the screening service and the relayer",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/developer-guide/monorepo-structure.md",
              "detail": "The docs describe a web/ monorepo with rpc-proxy, relayer and guard apps; the only public repo in github.com/nullmask-io is nullmask-website (a SvelteKit landing page).",
              "checked_at": "2026-10-09",
              "quote": "is a Turborepo monorepo managed with pnpm",
              "drift": true
            }
          ],
          "finding": "The RPC proxy, relayer and guard are required, closed and run by one operator. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/compliance/compliance.md",
              "detail": "Deposits wait in the contract until the guard approves them after chain-analysis screening.",
              "checked_at": "2026-10-09",
              "quote": "Every deposit to the Nullmask contract must be verified and approved by the guard service",
              "drift": true
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "Screening uses public sanctions lists, public blockchain data and an unnamed analytics provider, and withdrawal recipients are screened too.",
              "checked_at": "2026-10-09",
              "quote": "We use public sanctions lists, public blockchain data and a third-party blockchain analytics provider.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Filtering sits in the settlement path itself (guard approval of each deposit, screening of withdrawal recipients) and is disclosed in docs and terms, but the contract source is unpublished and the analytics vendor is unnamed. It cannot be bypassed. Judgment call: 1 (disclosed in documents only) rather than 0, since the filtering is disclosed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "Supported assets are whatever the application shows; the docs describe a token whitelist without listing tokens.",
              "checked_at": "2026-10-09",
              "quote": "You can use only the assets shown as supported in the application.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Supported tokens are not enumerated in docs or public code. The terms do warn that a stablecoin issuer can freeze the pool. Scored 0: not enumerated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 1,
              "url": "https://etherscan.io/address/0x4E502a53864c96f917a2062bBdf931c665A10e91",
              "address": "0x4E502a53864c96f917a2062bBdf931c665A10e91",
              "block_number": 26153596,
              "detail": "The proxy's EIP-1967 implementation slot points at 0x4E50…0e91; Sourcify has no record of the proxy, the implementation or the upgrade controller 0x6073…cFa1, Etherscan shows all three unverified, and Blockscout reports none verified.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0x88888888Eb71E1D68aD0C471C6893EdEEa00B026 0x4E502a53864c96f917a2062bBdf931c665A10e91 0x60737197A1bC727ba66166ae6699F3e3Dd18cFa1; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/1/$a | jq -r .match; done"
            }
          ],
          "finding": "The deployed contracts are unverified everywhere we looked, although the docs' threat model calls the smart contract \"open-source, auditable\". Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/developer-guide/monorepo-structure.md",
              "detail": "The documented monorepo (app, rpc-proxy, relayer, guard, circuits, contracts) is not public; github.com/nullmask-io has one public repo, a landing page.",
              "checked_at": "2026-10-09",
              "quote": "is a Turborepo monorepo managed with pnpm",
              "drift": true
            }
          ],
          "finding": "Nothing in the payment path is public. Two repos under an unrelated account (rocket0xdev1025, created 2026-10-07) contain built site copies and are not first-party. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "The operator states it provides no tools to operate without its servers.",
              "checked_at": "2026-10-09",
              "quote": "Doing so would require technical tools that we do not provide.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No public code, so no path to self-host. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/smart-contract-reference/contracts.md",
              "detail": "The hosted docs describe contract hierarchy, events, errors and the RPC API; none is versioned in a public repo.",
              "checked_at": "2026-10-09",
              "quote": "The Nullmask smart contract is deployed behind a UUPS proxy for upgradeability",
              "drift": true
            }
          ],
          "finding": "Interfaces are documented on a hosted site only; no ABI files, API schema or export in a repo. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/developer-guide/monorepo-structure.md",
              "detail": "The code needed to run the product is in an unpublished monorepo.",
              "checked_at": "2026-10-09",
              "quote": "is a Turborepo monorepo managed with pnpm",
              "drift": true
            }
          ],
          "finding": "Required components are closed, so F1 is 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "Proofs, relaying and screening run only on the operator's servers.",
              "checked_at": "2026-10-09",
              "quote": "These operations need our servers. The application offers no way to carry them out without them.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The product cannot run without the operator's closed services. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "The operator's servers keep the viewing keys and can see each user's balance and full history.",
              "checked_at": "2026-10-09",
              "quote": "We can therefore see your private balance and your history inside the Pool",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/security/security.md",
              "detail": "The threat model says a compromised proxy can observe sender, recipient and amount in remote mode.",
              "checked_at": "2026-10-09",
              "quote": "Observe transaction details (sender, recipient, amount) in remote deployment mode",
              "drift": true
            }
          ],
          "finding": "The operator holds every user's viewing keys and can link deposits to transfers and withdrawals; screening also covers connected addresses and fund sources. Disclosed in terms and docs. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "Screening uses an unnamed third-party blockchain analytics provider.",
              "checked_at": "2026-10-09",
              "quote": "We use public sanctions lists, public blockchain data and a third-party blockchain analytics provider.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The operator's proxy sees every request, and an unnamed analytics vendor receives depositor and connected addresses. Judgment call: 0 rather than 1, because the vendor's identity is not disclosed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 1,
              "url": "https://etherscan.io/address/0x88888888Eb71E1D68aD0C471C6893EdEEa00B026",
              "address": "0x88888888Eb71E1D68aD0C471C6893EdEEa00B026",
              "block_number": 26153596,
              "detail": "The pool is an ERC1967 proxy (implementation 0x4E50…0e91) holding about 0.26 ETH (balance read at block 26153477); upgradeController() is 0x6073…cFa1.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000004e502a53864c96f917a2062bbdf931c665a10e91"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "The terms state an upgrade can change who can move assets, with no notice.",
              "checked_at": "2026-10-09",
              "quote": "An upgrade can change any rule of the Pool, including the rules that decide who can move assets.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Funds sit in an upgradeable pool whose upgrade authority rests on an EOA (S2), and the operator says an upgrade can change who can move assets. Scored 0: the provider can redirect funds.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 1,
              "url": "https://etherscan.io/address/0x60737197A1bC727ba66166ae6699F3e3Dd18cFa1",
              "address": "0x60737197A1bC727ba66166ae6699F3e3Dd18cFa1",
              "block_number": 26153596,
              "detail": "admin() of the upgrade controller returns 0xFf298cd8f82CAb44874d83507715d3dC245D9CCd; the controller's bytecode exposes only execute(address,bytes), transferAdmin(address), admin() and one view, with no delay function.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x60737197A1bC727ba66166ae6699F3e3Dd18cFa1 \"admin()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0xf851a440",
                "expect": "0x000000000000000000000000ff298cd8f82cab44874d83507715d3dc245d9ccd"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 1,
              "url": "https://etherscan.io/address/0xFf298cd8f82CAb44874d83507715d3dC245D9CCd",
              "address": "0xFf298cd8f82CAb44874d83507715d3dC245D9CCd",
              "block_number": 26153596,
              "eoa": true,
              "detail": "The controller admin has no code (an EOA, nonce 81 at block 26153596).",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Upgrades are authorised through a controller whose admin is a single EOA, with no timelock visible in its bytecode. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "Shielded funds can be moved only through the operator's servers.",
              "checked_at": "2026-10-09",
              "quote": "These operations need our servers. The application offers no way to carry them out without them.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=0, C2=0, C3=0, O3=0: if the operator disappeared, shielded balances could not be moved with any public tooling; only pending (unscreened) deposits can be taken back directly. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-terms.txt",
              "detail": "The terms state the pool contracts are unaudited.",
              "checked_at": "2026-10-09",
              "quote": "At the Effective Date the Pool contracts have not been independently audited.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No audit, by the operator's own statement; no bug bounty found. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "blocklist",
        "countries": [
          "CU",
          "IR",
          "KP",
          "SY",
          "AE"
        ],
        "note": "From section 2.3 of the Terms of Use (effective 1 Oct 2026). Also restricted: the Crimea, Donetsk and Luhansk regions of Ukraine (Ukraine itself is not listed), and \"any other country or territory under comprehensive sanctions\" of the UN, US, EU or UK, which the terms do not name, so only named countries are listed. The operator may block any address, device or network. The pool contracts gate deposits through the guard, so the protocol is not usable outside the operator's service.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://app.nullmask.io/terms",
            "archive": "data/archive/nullmask-terms.txt",
            "detail": "Section 2.3 defines the Restricted Territories.",
            "checked_at": "2026-10-09",
            "quote": "the Crimea, Donetsk and Luhansk regions of Ukraine;",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Eligibility: no verified contract and no public repository needed to run the product, so type is incumbent although Nullmask presents itself as a privacy transfer protocol. It is deployed: the Ethereum mainnet pool proxy 0x88888888Eb71E1D68aD0C471C6893EdEEa00B026 (also listed for Arbitrum, Base, BSC and MegaETH at 0x8888…b4A2) has code and holds ETH, and app.nullmask.io is live. Searched 2026-10-09: docs.nullmask.io (supported networks, contract reference, compliance, threat model, developer guide), app.nullmask.io terms (client-rendered; read in a browser and archived), github.com/nullmask-io (one repo, nullmask-website, a SvelteKit landing page with no licence), GitHub search for \"nullmask\", Sourcify, Etherscan and Blockscout. Mainnet reads at block 26153596 (guard, upgrade controller, admin) and 26153477 (implementation slot, balance). Re-assess as type transfer if the contracts are verified or the monorepo is published.",
      "audits": {
        "searched": "nullmask.io, docs.nullmask.io (client-rendered; plain fetches return only the app shell) and the terms at app.nullmask.io/terms, which state the Pool contracts have not been independently audited. No public repository exists to hold an audits folder, and no report naming Nullmask was found.",
        "checked_at": "2026-10-13",
        "reports": []
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C4",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P2",
            "P3",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 10,
        "unk": 13,
        "total": 23
      }
    },
    {
      "slug": "oobit-card",
      "name": "Oobit Card",
      "type": "incumbent",
      "website": "https://www.oobit.com",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Oobit mobile app and DePay wallet connection",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Oobit",
          "required": true
        },
        {
          "name": "Oobit backend and settlement layer (DePay engine, gas abstraction)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Oobit",
          "required": true
        },
        {
          "name": "Rain card programme",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Rain",
          "required": true
        },
        {
          "name": "Third National (card issuer per Card Terms)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Third National",
          "required": true
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "KYC and fraud-prevention processors (not named)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        },
        {
          "name": "Plug & Pay partner SDK (npm @oobit/react-native-sdk; repo private)",
          "role": "sdk",
          "public": false,
          "license": "MIT",
          "operator": "Oobit",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/card-terms",
              "quote": "reserve the right to block and terminate transactions and suspend access to your Account",
              "detail": "Card Terms s4 let Oobit and the Issuer block transactions and suspend account access; the terms may also be changed \"with or without notice\".",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Oobit and the issuer can block transactions and suspend an individual account. No notice period or appeal is stated. No settlement contract was found to assess. Judgment call: anchor 0 (\"can target individual addresses with no notice\"), applied to account-level suspension as for HesabPay.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/faq",
              "quote": "directly from your wallet to Oobit’s settlement layer",
              "detail": "The FAQ says a DePay payment moves crypto from the user's wallet to Oobit's settlement layer, and Oobit then pays the merchant over Visa.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every payment settles into Oobit's own settlement layer and reaches the merchant through Visa and the issuer. Nothing describes a path that bypasses Oobit.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/depay",
              "quote": "Choose how much Oobit can use for payments",
              "detail": "DePay runs through the Oobit app, Oobit's wallet connection layer and its gas abstraction module; no self-host path is documented.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "All flows depend on Oobit-run services, Rain, the issuer and Visa. None is public. Closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/card-terms",
              "quote": "You are not a person who is blocked or sanctioned by the United States Government",
              "detail": "Card Terms require OFAC eligibility; Terms of Use exclude residents of embargoed countries; the DePay page says payments are monitored with blockchain intelligence.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Sanctions and geography screening, plus blockchain-analytics monitoring, is disclosed in the terms and on the product pages, but not in code. The settlement layer cannot be inspected. Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/faq",
              "quote": "You can pay today using assets on Ethereum (ERC-20)",
              "detail": "The FAQ lists DePay networks (Ethereum, BNB Smart Chain, Solana, Polygon) and over 20 supported assets; the Card Terms list Ethereum, Polygon, Optimism and Arbitrum as Supported Blockchains. Neither states issuer freeze powers.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens and chains are enumerated in docs only, and the two lists disagree. Freeze powers of USDT and USDC issuers are not stated. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/oobit-tech/oobit-plugins/blob/f156820b262387f1c2f703b758d4e917d0362bb3/README.md",
              "commit": "f156820b262387f1c2f703b758d4e917d0362bb3",
              "path": "README.md",
              "detail": "The only public repo in the oobit-tech org is oobit-plugins (an AI-agent plugin manifest); the npm SDK's declared repo oobit-tech/react-native-SDK returns 404.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Nothing needed to run the product is public. The partner SDK is published to npm with an MIT tag, but it is a client shell around Oobit's hosted widget and its source repo is private. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/oobit-tech/oobit-plugins/blob/f156820b262387f1c2f703b758d4e917d0362bb3/README.md",
              "commit": "f156820b262387f1c2f703b758d4e917d0362bb3",
              "path": "README.md",
              "detail": "oobit-plugins has no LICENSE file (GitHub reports none); no repo of the app, backend or settlement layer is public.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Required components are closed, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/faq",
              "quote": "directly from your wallet to Oobit’s settlement layer",
              "detail": "Payments require Oobit's settlement layer and card programme.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The product cannot run without Oobit's proprietary services, Rain, the issuer and Visa.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/privacy-notice",
              "quote": "such as cookies and personal device identifiers",
              "detail": "The Privacy Notice discloses automated collection through cookies and device identifiers and links a Cookie Policy.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Automated tracking is disclosed in the policy. The app is closed and no trace was run. Judgment call: disclosed, presumed on by default, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/privacy-notice",
              "quote": "passport number, and tax identification",
              "detail": "The Privacy Notice lists name, age, passport number, tax ID, addresses, phone, education, job title and source-of-funds data, and special categories for AML checks; the FAQ requires a government photo ID.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC plus profile data (education, job title) goes beyond settlement needs. It is disclosed in the policy, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/privacy-notice",
              "quote": "may share your Personal Data with third parties acting as Personal Data processors",
              "detail": "Processors for payment processing, identity verification, fraud prevention and cloud storage are described by category only; Rain and Third National appear only in the Card Terms.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The KYC, fraud-prevention and blockchain-intelligence vendors in the payment flow are not named anywhere I found. Judgment call: disclosure by category only is closer to \"undisclosed third parties\" than to named ones, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/terms-of-use",
              "quote": "All cryptoassets You hold in Your account are assets held by Oobit for Your benefit on a custodial basis",
              "detail": "Terms of Use s7.19 make in-app balances custodial; DePay moves funds to Oobit's settlement layer at payment time.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Funds in flight, and any in-app balance, are held by Oobit. This is disclosed. Provider-held wallet, disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The Card Terms (titled Rain Card Terms on oobit.com) name Third National as issuer of the card programme under licence from Visa and describe the card as credit funded by the issuer. The Terms of Use say in-app crypto is held by Oobit on a custodial basis for the user's benefit. I found no primary source naming Oobit's own licences or regulator.",
      "notes": "Eligibility: no verified contract and no public repository needed to run the product, so type is incumbent. Searched 2026-10-07: GitHub org oobit-tech (only oobit-plugins, an AI-agent plugin manifest with no licence); gh search repos and code \"oobit\" (unrelated or third-party repos); npm @oobit/react-native-sdk and @oobit/react-web (MIT tag, declared repo oobit-tech/react-native-SDK is 404); docs.oobit.com (Plug & Pay widget and Partner API, testnet token addresses only); oobit.com FAQ, DePay page, Card Terms, Terms of Use and Privacy Notice (no contract addresses). eth.blockscout.com search \"oobit\" found only the OBT token, copycat OOB tokens and Oobit-tagged EOAs dormant since 2023; no DePay spender contract was identified. DePay mentions a \"smart contract engine\" and one-time spending approvals (provider claim); if the spender or Rain collateral contracts can be identified, this provider should be re-evaluated as a card. Card Map was used only to find the product.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "AL",
          "AD",
          "AT",
          "BE",
          "BA",
          "BG",
          "HR",
          "CY",
          "CZ",
          "DK",
          "EE",
          "FI",
          "FR",
          "GE",
          "DE",
          "GI",
          "GR",
          "GG",
          "IS",
          "IE",
          "IT",
          "LV",
          "LI",
          "LT",
          "LU",
          "MT",
          "MD",
          "MC",
          "ME",
          "NL",
          "MK",
          "NO",
          "PL",
          "PT",
          "RO",
          "RS",
          "SK",
          "SI",
          "ES",
          "SE",
          "CH",
          "GB",
          "KZ",
          "KG",
          "MY",
          "PH",
          "SA",
          "KR",
          "TW",
          "TH",
          "AE",
          "BS",
          "CR",
          "DO",
          "SV",
          "GL",
          "GT",
          "MX",
          "PA",
          "PR",
          "AR",
          "BR",
          "CL",
          "CO",
          "EC",
          "PY",
          "PE",
          "UY",
          "KE",
          "ZA",
          "TZ",
          "AU",
          "NZ"
        ],
        "note": "Oobit's help centre lists 75 countries and territories. Listed here: the 74 where the Oobit Visa card is marked available, minus the United States. Vietnam is listed but its card is on a waitlist. The help centre marks the US card as available in \"most states\" (not named), but both Rain card terms on oobit.com require attesting that you are not a US citizen and say the card is \"intended for those outside of the United States\". No US card terms were found, so the more restrictive reading is used and the US is left out. Puerto Rico is kept as listed, though the card terms may count it as part of the United States. Hungary is absent, so EU and EEA are not used. Brazil has two programmes: a local card issued by Pomelo for new customers and the Rain-issued US-dollar card for earlier ones. Not supported, per the same article: Afghanistan, Belarus, Central African Republic, China, Cuba, Ethiopia, Hong Kong, Iran, Iraq, Lebanon, Libya, Mali, Myanmar, Nicaragua, North Korea, Russia, Somalia, South Sudan, Sudan, Syria, Venezuela, Yemen. The Terms of Use also exclude Russia, Cuba, Iran, North Korea, Sudan, Syria and other embargoed countries.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.oobit.com/en/articles/15262464-is-oobit-available-in-my-country",
            "detail": "Oobit's help article lists 75 countries and territories with whether the Oobit Visa card, transfers, sending and cashback are available in each, plus a not-supported list.",
            "quote": "Oobit is available in 75 countries and territories across six continents",
            "archive": "data/archive/oobit-card-availability.txt",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.oobit.com/legal/terms-of-use",
            "detail": "The Terms of Use bar nationals and residents of named embargoed countries.",
            "quote": "national or resident of Russia, Cuba, Iran, North Korea, Sudan, or Syria",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.oobit.com/legal/card-terms",
            "detail": "The card terms require the user to attest they are not a US citizen.",
            "quote": "You attest that you are not a United States citizen",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDT",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Tether"
          },
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle"
          },
          {
            "symbol": "USDR",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "StablR"
          },
          {
            "symbol": "EURR",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "StablR"
          },
          {
            "symbol": "BTC",
            "class": "native"
          },
          {
            "symbol": "ETH",
            "class": "native"
          },
          {
            "symbol": "SOL",
            "class": "native"
          },
          {
            "symbol": "BNB",
            "class": "native"
          },
          {
            "symbol": "TRX",
            "class": "native"
          },
          {
            "symbol": "XRP",
            "class": "native"
          },
          {
            "symbol": "TON",
            "class": "native"
          },
          {
            "symbol": "DOGE",
            "class": "native"
          },
          {
            "symbol": "LTC",
            "class": "native"
          },
          {
            "symbol": "BCH",
            "class": "native"
          },
          {
            "symbol": "XLM",
            "class": "native"
          },
          {
            "symbol": "ADA",
            "class": "native"
          },
          {
            "symbol": "XTZ",
            "class": "native"
          },
          {
            "symbol": "VET",
            "class": "native"
          },
          {
            "symbol": "XAUT",
            "class": "other"
          },
          {
            "symbol": "TRUMP",
            "class": "other"
          },
          {
            "symbol": "SHIB",
            "class": "other"
          }
        ],
        "conversion": "at_spend",
        "note": "Oobit lists 21 assets for payments; the token is sold for USD (Oobit's base currency) at the time of each card payment. Payments come either from the user's in-app balance, which the Terms of Use say Oobit holds on a custodial basis, or via DePay from an external self-custody wallet on Ethereum, BNB Smart Chain, Solana or Polygon, where the token moves to Oobit's settlement layer at payment time. No default token is stated, although Oobit markets USDT spending prominently. USDR and EURR are StablR's dollar and euro stablecoins; XAUT is Tether's gold-backed token and TRUMP and SHIB are meme tokens (class other). Chains and contract addresses per token are not published, and the Card Terms' Supported Blockchains (Ethereum, Polygon, Optimism, Arbitrum) differ from the DePay list (see C5).",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.oobit.com/faq",
            "detail": "The FAQ lists the assets Oobit supports for payments and transfers.",
            "quote": "Oobit supports USDC, USDT, BNB, USDR, EURR, BTC, DOGE, ETH, SOL, TRX, XRP, XTZ, TON, VET, XAUT, LTC, XLM, TRUMP, ADA, BCH, and SHIB for payments and transfers",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.oobit.com/faq",
            "detail": "The FAQ says crypto is converted at the time of payment, with USD as the base currency.",
            "quote": "Simply use your Oobit virtual card and the crypto is converted at the time of payment",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.oobit.com/depay",
            "detail": "With DePay the token moves from the user's own wallet to Oobit's settlement layer only when a payment is authorised.",
            "quote": "directly from your wallet to Oobit's settlement layer",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "oobit.com (DePay page, FAQ, Card Terms, Terms of Use; DePay is described as a \"smart contract engine\" but no audit is linked), docs.oobit.com, github.com/oobit-tech, the Sherlock report repo and Rain's security page (Rain says its reports are shared under NDA and names Sherlock), Hacken's portfolio, and web searches for Oobit and DePay audits. Hacken's April 2023 review of the OBT ERC-20 token is not listed: the token is not in the card payment path. No audit of the DePay spender, the Oobit settlement layer or the app was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Sherlock",
            "date": "2025-02-11",
            "type": "contest",
            "scope": "Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest",
            "url": "https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2025.02.11%20-%20Final%20-%20Rain%20Private%20Best%20Efforts%20Audit%20Contest%20Report.pdf",
            "commit": "6f578d5b9c9fa35bbe857959a50fa5aab4fa611a",
            "repo": "https://github.com/SignifyHQ/collateral-contract-evm-v2",
            "covers_deployed": "unknown",
            "findings": "0 high, 2 medium (statement payoff rounding; missing Chainlink min/max answer check)",
            "note": "Contest ran 2-8 December 2024 on b432939a; 6f578d5 is the fix commit. Oobit's card runs on Rain's programme (the Card Terms are Rain Card Terms), but Oobit holds in-app crypto custodially and no Rain collateral contract could be tied to Oobit, so it is not known whether these contracts are used in Oobit's card path. The Rain repo is private."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 12,
        "unk": 11,
        "total": 23
      }
    },
    {
      "slug": "payy-card",
      "name": "Payy Card",
      "type": "card",
      "website": "https://payy.network",
      "primary_chain": {
        "name": "Ethereum",
        "chain_id": 1,
        "basis": "The card settles inside the Payy zk-rollup (\"transactions are settled privately on Payy Network\", Payy Card docs), and that rollup's state, USDC escrow and exits are enforced by RollupV1 proxy 0x367C1eAF... on Ethereum (polybase/payy 2f95947 eth/README.md#L142-L170, Mint migration Polygon -> Ethereum at L185). The rollup is not an EVM chain with its own RPC, so its L1 contract is the unit. Excluded: the legacy Polygon rollup 0x4cbb5041... (0 USDC at Polygon block 95103541) and the Payy Network EVM L2 (testnet only in @payy/client)."
      },
      "repos": [
        {
          "url": "https://github.com/polybase/payy",
          "role": "contracts",
          "license": "none"
        },
        {
          "url": "https://github.com/polybase/payy/tree/2f95947f12981a838f6f0c9dddace825bf835502/pkg/node",
          "role": "backend",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0x367C1eAF14AA06b78ce76bd0243297de79d85270",
          "chain_id": 1,
          "role": "RollupV1 proxy (USDC escrow, state root)",
          "verified": "sourcify"
        },
        {
          "address": "0x7d8837b547F4FEa0053571CB149e845FC58e9B2D",
          "chain_id": 1,
          "role": "RollupV1 implementation",
          "verified": "sourcify"
        },
        {
          "address": "0xfE455baCAF1968F1Ae6a322b8Ffbe56840e2f590",
          "chain_id": 1,
          "role": "ProxyAdmin of the rollup proxy",
          "verified": "sourcify"
        },
        {
          "address": "0x230Dfb03F078B0d5E705F4624fCC915f3126B40f",
          "chain_id": 1,
          "role": "Owner Safe 2-of-4 (rollup and ProxyAdmin owner)",
          "verified": "sourcify"
        },
        {
          "address": "0x14DACD534ddc676601B27f41Eb541a7951524a2F",
          "chain_id": 1,
          "role": "HonkVerifier for the live aggregate proof key",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "RollupV1 and Honk verifier contracts (Ethereum)",
          "role": "contracts",
          "public": true,
          "license": "none",
          "operator": "Payy (Zeplo, Inc.), owner Safe 2-of-4",
          "required": true,
          "repo": "https://github.com/polybase/payy"
        },
        {
          "name": "Payy node, aggregator and prover (sole onlyProver, validator signatures)",
          "role": "other",
          "public": true,
          "license": "none",
          "operator": "Payy",
          "required": true,
          "repo": "https://github.com/polybase/payy"
        },
        {
          "name": "Payy Wallet mobile app (holds keys, builds proofs, funds card debits)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Payy",
          "required": true
        },
        {
          "name": "Payy backend (guild API - ramps, card, notes, KYC orchestration)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Payy",
          "required": true
        },
        {
          "name": "Rain card programme",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Rain",
          "required": true
        },
        {
          "name": "U.S.-based card issuer (issuing partner of Rain, not named)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "KYC vendor (Sumsub and Rain in the provider enum)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub / Rain",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/contracts/rollup3/RollupV1.sol#L152-L272",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "eth/contracts/rollup3/RollupV1.sol",
              "detail": "The owner can add or remove provers, add or remove ZK verifiers, add burn substitutors and overwrite the state root with setRoot (L264-L266); only a prover can call verifyRollup (L314-L322), so removing provers or verifiers halts all settlement. This file is identical to the Sourcify source of the deployed implementation.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x367C1eAF14AA06b78ce76bd0243297de79d85270",
              "address": "0x367C1eAF14AA06b78ce76bd0243297de79d85270",
              "block_number": 26139204,
              "detail": "Rollup owner() = Safe 0x230Dfb03F078B0d5E705F4624fCC915f3126B40f.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000230dfb03f078b0d5e705f4624fcc915f3126b40f"
              },
              "recheck": "cast call 0x367C1eAF14AA06b78ce76bd0243297de79d85270 \"owner()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x230Dfb03F078B0d5E705F4624fCC915f3126B40f",
              "address": "0x230Dfb03F078B0d5E705F4624fCC915f3126B40f",
              "block_number": 26139204,
              "detail": "Owner Safe (v1.3.0) getThreshold() = 2 with 4 EOA owners (0x54e22ad9..., 0x111e5feA..., 0xCa1Df6eD..., 0xAF657A8F...); getModulesPaginated(0x1,10) returns no modules and the guard slot is zero; no timelock sits in front of it and the signers are not disclosed anywhere I found.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000002"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.google.com/document/d/14W43Qk_y64clQCVtpc2DNZl12vWPW0lejO9Kr2R1eys/edit?usp=sharing",
              "archive": "data/archive/payy-card-terms.txt",
              "quote": "restrict all or part of your access to Service(s) at any time, in our own discretion, without notice or liability",
              "detail": "Terms of Service s2.2 let Payy restrict access without notice; s2.6.22 lets card use be restricted, suspended or terminated with immediate effect.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Onchain, a 2-of-4 Safe with undisclosed signers, no modules, no guard and no timelock owns the rollup. It can stop settlement (remove the prover or verifier) and can rewrite the state root outright. Payy's own EOA is the only prover, so it can also leave any transaction out of a block. Off-chain, the Terms let Payy restrict an individual's access without notice, and card use can be suspended with immediate effect. Judgment call: the onchain role alone would score 1 (multisig, no timelock, undisclosed signers), but the documented per-user restriction without notice meets anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/contracts/rollup3/RollupV1.sol#L314-L372",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "eth/contracts/rollup3/RollupV1.sol",
              "detail": "verifyRollup is onlyProver and also requires validator signatures over the new root; burns (withdrawals) execute only inside verifyRollup. mint() (L619-L648) is public, so deposits are direct, but nothing else is.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/pkg/guild-client-http/src/ramps.rs#L34-L50",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "pkg/guild-client-http/src/ramps.rs",
              "detail": "Card and ramp transactions are funded by POSTing a note to the Payy backend at /ramps/transactions/{id}/fund.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Merchants are paid by Visa and the issuer off-chain. On the rollup, a card debit is a note handed to Payy's closed backend, and only Payy's prover can put any transaction into a block on Ethereum. Neither payer nor payee can complete a card payment by calling the contracts directly.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/Cargo.toml#L218-L223",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "Cargo.toml",
              "detail": "The workspace declares rain-http, rain-interface, rain-provider and sumsub-* crates, but none of those directories (nor the guild backend server) exist in the public tree; the public repo is a Copybara-filtered export (README.md#L128-L134).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.google.com/document/d/14W43Qk_y64clQCVtpc2DNZl12vWPW0lejO9Kr2R1eys/edit?usp=sharing",
              "archive": "data/archive/payy-card-terms.txt",
              "quote": "you may be given the option to apply for a Payy Card (“Card”) issued by Rain, through issuing partners in various jurisdictions",
              "detail": "Terms s2.6 say the card is issued by Rain through issuing partners and Payy pushes USDC from the Payy Network to Rain.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "A card payment needs Payy's closed backend and app, Rain, an unnamed U.S. issuer and Visa. None of these is public or has a fallback. The rollup node and prover code is public, but the deployed contract accepts blocks only from Payy's prover, so there is no fallback there either.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/pkg/kyc/src/kyc_update_required.rs#L30-L72",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "pkg/kyc/src/kyc_update_required.rs",
              "detail": "KYC rejection reasons include Sanctions, Sanctioned, Blacklist, Blocklist, Pep and WrongUserRegion; the checks themselves run in the closed backend and vendors. A search of RollupV1.sol, pkg/node and pkg/rpc for sanctions lists, blocklists or geo-IP found none.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://payy.link/privacy",
              "quote": "we ensure no OFAC jurisdictions are utilizing Payy",
              "detail": "Privacy Policy says automated compliance measures keep OFAC jurisdictions out.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement contract has no address or country filter. Sanctions and region screening exists: it is disclosed in the privacy policy and Terms and visible as KYC rejection reasons in public code, but it runs in closed services, and with C2 at 0 there is no way around it. Judgment call: the screening logic and its list sources are not public, so I took 1 (the Gnosis Pay precedent) rather than 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/scripts/deploy.ts#L20-L29",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "eth/scripts/deploy.ts",
              "detail": "The deploy script pins the rollup token to Circle USDC 0xA0b86991... on Ethereum (and native USDC on Polygon for the legacy deployment).",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0x367C1eAF14AA06b78ce76bd0243297de79d85270 \"usdc()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
              "address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
              "block_number": 26139204,
              "detail": "Rollup usdc() returns this token; USDC blacklister() = 0x0A06BE16275B95a7d2567fBdAE118b36C7DA78F9 and pauser() = 0x4914f61d25e5C567143774B76EdbF4D5109a8566, so Circle can freeze the rollup's escrow or a withdrawal recipient.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xbd102430",
                "expect": "0x0000000000000000000000000a06be16275b95a7d2567fbdae118b36c7da78f9"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The token (USDC) and chain (Ethereum) are enumerated in code and onchain. The Terms, privacy policy and card docs do not mention Circle's freeze powers. They also do not say that the Payy rollup has a single Payy-run prover and no forced-inclusion path. Enumerated in code, assumptions not stated, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/1/0x7d8837b547F4FEa0053571CB149e845FC58e9B2D",
              "address": "0x7d8837b547F4FEa0053571CB149e845FC58e9B2D",
              "block_number": 26139204,
              "detail": "Sourcify v2 reports exact_match for the RollupV1 implementation, the proxy 0x367C1eAF..., the ProxyAdmin 0xfE455baC... (runtime exact) and the owner Safe; the Sourcify RollupV1.sol is byte-identical to eth/contracts/rollup3/RollupV1.sol at 2f95947.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://sourcify.dev/server/v2/contract/1/0x7d8837b547F4FEa0053571CB149e845FC58e9B2D | jq .match"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x14DACD534ddc676601B27f41Eb541a7951524a2F",
              "address": "0x14DACD534ddc676601B27f41Eb541a7951524a2F",
              "block_number": 26139204,
              "detail": "getZkVerifier(0x0701c58c...) - the key used by the latest verifyRollup - returns HonkVerifier 0x14DACD53..., which Sourcify lists as match (partial), not exact_match.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The proxy, the implementation, the ProxyAdmin and the owner Safe are exact matches on Sourcify. The live ZK verifier is only a partial match. The repo has a Hardhat deploy script but no recorded build that reproduces the deployed bytecode. Partial match plus no reproducible build gives 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/tree/2f95947f12981a838f6f0c9dddace825bf835502/app/packages/payy",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "app/packages/payy",
              "detail": "The Payy app package holds only assets, build scripts and generated ts-rs type bindings; no app source. The repo also lacks the guild backend, Rain and Sumsub providers declared in Cargo.toml.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/README.md#L14-L25",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "README.md",
              "detail": "Public modules are the frontends/TS packages (not the wallet app), Ethereum contracts, Noir circuits, aggregator, node, prover and RPC utilities.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The contracts, circuits, rollup node, aggregator and prover are public. The wallet app that holds keys and funds card debits is closed, and so is the card, ramps and KYC backend. Typed client bindings exist, but there is no published API schema. Judgment call: this is more than \"SDK or contracts only\", but both the frontend and the backend of the card path are closed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/README.md#L49-L110",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "README.md",
              "detail": "README gives prerequisites, a dev container and docker compose profiles for eth, node and prover.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Build docs exist for the rollup stack. Reproduction not attempted. A self-hosted node cannot settle against the deployed contract, which accepts only Payy's prover, and the card path needs closed services.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/contracts/rollup3/RollupV1.sol#L51-L75",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "eth/contracts/rollup3/RollupV1.sol",
              "detail": "Event definitions (RollupVerified, Minted, Burned, MintAdded, verifier/prover events) are in source and compiled ABIs are committed under eth/artifacts.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/pkg/guild-client-http/src/ramps.rs#L18-L50",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "pkg/guild-client-http/src/ramps.rs",
              "detail": "Backend routes appear only as a typed Rust HTTP client; no OpenAPI or equivalent schema and no data export.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The ABIs and event schemas are in the repo. Backend routes appear only implicitly, through a Rust client, and there is no API schema and no export. Judgment call: between 1 and 2, so I took the lower; a typed client is not an API schema.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/contracts/rollup3/RollupV1.sol#L1-L2",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "eth/contracts/rollup3/RollupV1.sol",
              "detail": "RollupV1.sol is SPDX UNLICENSED (as is the verified deployed source); the repo root at 2f95947 has no LICENSE file and GitHub reports no license.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The repo needed to run the rollup has no license, and the settlement contract is marked UNLICENSED. The wallet app and backend are closed. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/9e57964e06ecb782a3bd6216dc185e7b5c674ef0/LICENSE",
              "commit": "9e57964e06ecb782a3bd6216dc185e7b5c674ef0",
              "path": "LICENSE",
              "detail": "Up to commit 9e57964 (2025-01-09) the repo carried an MIT License (Copyright 2022-2024 Polybase Labs); commit c4d2c902 (2026-03-25, a Copybara sync from the internal repo) removed it.",
              "checked_at": "2026-10-07",
              "historical": true
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/c4d2c9021b8fb9988816eb6987a734b830bfce15/eth/README.md",
              "commit": "c4d2c9021b8fb9988816eb6987a734b830bfce15",
              "path": "eth/README.md",
              "detail": "The Copybara sync commit lists LICENSE as removed (gh api repos/polybase/payy/commits/c4d2c902 shows status removed).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The repo was MIT until March 2026, when an internal sync removed the LICENSE and left the code unlicensed. That is a prior relicensing event, so 0. MIT grants on code published before c4d2c902 still stand.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/pkg/ramps-interface/src/account.rs#L218-L253",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "pkg/ramps-interface/src/account.rs",
              "detail": "Card accounts are Rain services cards created through the closed backend (get_account_services_card, create_physical_card).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card cannot run without Payy's proprietary backend and app, Rain, the issuer and Visa.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://payy.link/privacy",
              "quote": "We may collect service-related, diagnostic, and performance information",
              "detail": "Privacy Policy (last updated 6 May 2024) discloses automatic metrics and performance collection and push tokens.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The policy discloses diagnostics and performance collection. The app source is closed, so the SDKs in use and their defaults cannot be checked, and no trace was run. Judgment call: disclosed and presumed on by default, so 1. It could be 0 if the app ships undisclosed SDKs, which I cannot see.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.payy.network/payy-wallet/payy-card",
              "quote": "Identity verification is required to receive a card",
              "detail": "Card docs list name, birth date, address, government ID number and ID photo.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/pkg/kyc/README.md#L1-L40",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "pkg/kyc/README.md",
              "detail": "The KYC struct carries name, DOB, address, nationalities, ID documents, phone and email; no legal basis is stated.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The regulated card requires full KYC. The fields are disclosed in the docs and visible in code, but no legal basis is given in the repo. Disclosed beyond settlement needs, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/noir/utxo/src/main.nr#L9-L54",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "noir/utxo/src/main.nr",
              "detail": "The UTXO circuit's only public inputs are four note commitments and five message fields, and messages are all zeros except for mints and burns; owners, values and counterparties of a send are private witnesses.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/polybase/payy/contents/noir/utxo/src/main.nr?ref=2f95947f12981a838f6f0c9dddace825bf835502\" --jq .content | base64 -d | sed -n 9,54p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/contracts/rollup3/RollupV1.sol#L51-L75",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "eth/contracts/rollup3/RollupV1.sol",
              "detail": "L1 events carry only the block height and root (RollupVerified), and mint or burn amounts with the bridging EVM address (MintAdded, Burned); no payee, merchant or invoice field exists.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/tx/0xda88fb9273c703a4d2647c744362f58b6db4e104d7a203a75d4b67e3d54858c8",
              "address": "0x367C1eAF14AA06b78ce76bd0243297de79d85270",
              "block_number": 26046439,
              "detail": "A sample verifyRollup from prover 0x5343B904... posts an aggregate proof, old and new roots and mint or burn messages; the Transfer logs it emits are burns to withdrawal addresses only.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.payy.network/payy-wallet/payy-card",
              "quote": "Onchain wallet balances and activity cannot be linked to card transactions",
              "detail": "The card docs say each purchase is a Payy Network transaction that debits the user's UTXO notes.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A card purchase is a shielded send inside the rollup. Ethereum sees only state roots and a proof, so nothing public links a cardholder to a purchase, a merchant or an amount. Deposits and withdrawals do expose an EVM address and an amount, which bridging needs. The design is a privacy pattern (UTXO notes, nullifiers, link-based sends). Judgment call: I did not observe how Payy funds Rain onchain. If that leg exists it carries Payy's aggregate, not a user's notes, so I scored 3. The privacy is against the public, not against Payy: the backend receives the note for each card debit, which falls under P2 and P4. The card-specific Polygon deposit addresses mentioned in the FAQ are outside the rollup and were not assessed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/pkg/ramps-interface/src/provider.rs#L38-L47",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "pkg/ramps-interface/src/provider.rs",
              "detail": "The provider enum names Alfred, Manteca, Payy, Rain, Sumsub, Cybrid and Stripe; choosing among them happens in the closed backend.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.google.com/document/d/14W43Qk_y64clQCVtpc2DNZl12vWPW0lejO9Kr2R1eys/edit?usp=sharing",
              "archive": "data/archive/payy-card-terms.txt",
              "quote": "we may share personal information you previously provided to us under our Privacy Policy to verify your identity, with Rain",
              "detail": "Terms s2.6.9 disclose sharing with Rain and its service providers; Visa is named as the network.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Each card payment is seen by Visa, the issuer, Rain and Payy's backend. Vendors are named in code and the Terms, but nothing is swappable by user config, and no trace was run. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x367C1eAF14AA06b78ce76bd0243297de79d85270",
              "address": "0x367C1eAF14AA06b78ce76bd0243297de79d85270",
              "block_number": 26139204,
              "detail": "All bridged USDC sits in the rollup proxy (710.75 USDC at this block); EIP-1967 implementation slot = 0x7d8837b5..., so the escrow is upgradeable.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000007d8837b547f4fea0053571cb149e845fc58e9b2d"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/contracts/rollup3/RollupV1.sol#L258-L266",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "eth/contracts/rollup3/RollupV1.sol",
              "detail": "setRoot(bytes32) is onlyOwner and replaces the state root with no proof; together with addProver and addZkVerifier, the owner can mint itself notes and burn the escrow.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "User funds are notes inside a rollup whose escrow is an upgradeable proxy. The Payy owner Safe can overwrite the state root or swap the verifier, which means it can redirect funds. A card debit also hands a note to Payy's backend, which then funds Rain. The provider can redirect funds, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x367C1eAF14AA06b78ce76bd0243297de79d85270",
              "address": "0x367C1eAF14AA06b78ce76bd0243297de79d85270",
              "block_number": 26139204,
              "detail": "EIP-1967 admin slot = ProxyAdmin 0xfE455baCAF1968F1Ae6a322b8Ffbe56840e2f590.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x000000000000000000000000fe455bacaf1968f1ae6a322b8ffbe56840e2f590"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0xfE455baCAF1968F1Ae6a322b8Ffbe56840e2f590",
              "address": "0xfE455baCAF1968F1Ae6a322b8Ffbe56840e2f590",
              "block_number": 26139204,
              "detail": "ProxyAdmin owner() = Safe 0x230Dfb03... (2-of-4 EOAs, no modules, guard slot zero, no timelock).",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000230dfb03f078b0d5e705f4624fcc915f3126b40f"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A 2-of-4 Safe can upgrade the rollup instantly through the ProxyAdmin. The same Safe can also swap the ZK verifier through addZkVerifier, which is an upgrade in effect. Signers are undisclosed and nothing documents a notice channel. Multisig admin, no timelock, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/contracts/rollup3/RollupV1.sol#L650-L719",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "eth/contracts/rollup3/RollupV1.sol",
              "detail": "mintWithAuthorization pulls the exact deposit value through USDC receiveWithAuthorization (EIP-3009) with validAfter/validBefore; mint() needs a prior ERC-20 approve.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/polybase/payy/contents/eth/contracts/rollup3/RollupV1.sol?ref=2f95947f12981a838f6f0c9dddace825bf835502\" --jq .content | base64 -d | sed -n 650,719p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/pkg/ramps-interface/src/transaction/rpc.rs#L58-L62",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "pkg/ramps-interface/src/transaction/rpc.rs",
              "detail": "A ramps or card transaction is funded with one note payload per transaction, not a standing allowance.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No standing allowance exists in the card path. Deposits support exact-amount, expiring EIP-3009 authorisations, and card debits are funded one note at a time. Judgment call: this design meets anchor 3, but the app that chooses between mint and mintWithAuthorization is closed and no package or trace is available, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/contracts/rollup3/RollupV1.sol#L442-L471",
              "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
              "path": "eth/contracts/rollup3/RollupV1.sol",
              "detail": "Burns are paid only from verifyBurn, which runs inside the onlyProver verifyRollup; the contract has no forced-exit or escape-hatch function.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x5343B904Bf837Befb2f5A256B0CD5fbF30503D38",
              "address": "0x5343B904Bf837Befb2f5A256B0CD5fbF30503D38",
              "block_number": 26139204,
              "eoa": true,
              "detail": "The prover that submitted the latest verifyRollup is an EOA (no code).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Chain of reasoning. S1 = 0: funds sit in an upgradeable escrow controlled by Payy. C2 = 0: only Payy's prover can process any transaction, withdrawals included. C3 = 0: the card needs closed services. O3 = 1: self-hosting is unproven, and a self-hosted node could not settle anyway. If Payy's prover stops, no withdrawal can execute. Funds depend on provider liveness, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The Terms of Service (Zeplo, Inc. d/b/a Payy, New York) say Payy is not a bank, exchange, asset custodian or card issuer, and that cards are issued by partners licensed in their jurisdictions. The card is issued by Rain through issuing partners; the card docs describe a U.S.-based issuer, Visa Platinum, classed as a secured credit card. Disputes go to binding JAMS arbitration. I found no primary source naming the issuing bank or its regulator.",
      "notes": "Scored the live Payy rollup v1 on Ethereum from polybase/payy at 2f95947; onchain reads are pinned to Ethereum block 26139204. The public repo is a Copybara export without the wallet app, guild backend, or Rain and Sumsub providers. The last verifyRollup before the pinned block was on 2026-09-24 (block 26046439), and the escrow held 710.75 USDC. The ToS is a Google Doc that renders client-side, so its text is archived. P5 and S5 are unknown (app and backend closed). S6 is unknown: the FAQ says \"the important parts of Payy's code have been audited\" (provider claim), but I found no report.",
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true,
            "chain_id": 1,
            "address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"
          }
        ],
        "conversion": "at_spend",
        "note": "The balance is held as private USDC notes on the Payy Network zk-rollup, backed by Circle USDC escrowed in the rollup contract 0x367C1eAF... on Ethereum (the address above is that escrowed token). The Terms name USDC as the only Supported Digital Asset today. When the card is used, Payy pushes USDC from the Payy Network to Rain, which converts it to fiat for the merchant. The Terms also let the user pick a USD Wallet balance as the Preferred Spending Currency instead, in which case spend comes from fiat; that option is not a token and is not listed.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.google.com/document/d/14W43Qk_y64clQCVtpc2DNZl12vWPW0lejO9Kr2R1eys/edit?usp=sharing",
            "archive": "data/archive/payy-card-terms.txt",
            "detail": "Terms s2.6 say a Supported Digital Asset (currently USDC) chosen as Preferred Spending Currency is transferred to Rain and converted to fiat when the card is used.",
            "quote": "you authorize direct transfer to Rain to convert said Preferred Spending Currency to fiat",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.google.com/document/d/14W43Qk_y64clQCVtpc2DNZl12vWPW0lejO9Kr2R1eys/edit?usp=sharing",
            "archive": "data/archive/payy-card-terms.txt",
            "detail": "Terms s2.6 name USDC as the only Supported Digital Asset that qualifies a user for the card.",
            "quote": "When you hold Supported Digital Assets [currently USDC] on Payy",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/polybase/payy/blob/2f95947f12981a838f6f0c9dddace825bf835502/eth/scripts/deploy.ts#L20-L29",
            "commit": "2f95947f12981a838f6f0c9dddace825bf835502",
            "path": "eth/scripts/deploy.ts",
            "detail": "The deploy script pins the rollup token to Circle USDC 0xA0b86991... on Ethereum.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "The Payy wallet FAQ (docs.payy.network), which says \"the important parts of Payy's code have been audited\" but links no report; the polybase/payy repo tree (no audits/ folder; one GitHub security advisory, GHSA-fhxc-63vg-9gwr, for the aggregation circuit); web searches for Payy and Polybase audits across Zellic, Veridise, Least Authority, Spearbit, Hacken and Halborn; and the docs/ audit folder of github.com/safe-fndn/safe-smart-account for the owner Safe. No audit of RollupV1, the Noir/Halo2 circuits or the node is published. The September 2026 exploit postmortem cites a Spearbit incident report; that is incident analysis, not an audit, and is not listed. Audits of the Barretenberg toolchain that generates the HonkVerifier are not logged here.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Nethermind Security",
            "date": "2026-08-17",
            "type": "audit",
            "scope": "Shared component: Safe smart account v1.3.0 (GnosisSafe, GnosisSafeL2 and handlers), the version of the rollup's 2-of-4 owner Safe",
            "url": "https://github.com/safe-fndn/safe-smart-account/blob/main/docs/Safe_Audit_Report_1_3_0_Nethermind.pdf",
            "commit": "767ef36bba88bdbc0c9fe3708a4290cabef4c376",
            "repo": "https://github.com/safe-fndn/safe-smart-account",
            "covers_deployed": "yes",
            "findings": "1 low (getModulesPaginated skips a module between pages), 1 informational",
            "note": "Owner Safe 0x230Dfb03... proxies the canonical GnosisSafeL2 v1.3.0 singleton 0x3E5c6364... (slot 0 read 2026-10-13). Retrospective review of the shipped 1.3.0 code."
          },
          {
            "auditor": "Certora",
            "date": "2026-07",
            "type": "audit",
            "scope": "Shared component: Safe smart account v1.3.0 (GnosisSafe, GnosisSafeL2, base managers, handlers), the version of the rollup's owner Safe",
            "url": "https://github.com/safe-fndn/safe-smart-account/blob/main/docs/Safe_Audit_Report_1_3_0_Certora.pdf",
            "commit": "767ef36bba88bdbc0c9fe3708a4290cabef4c376",
            "repo": "https://github.com/safe-fndn/safe-smart-account",
            "covers_deployed": "yes",
            "findings": "1 low, 2 informational",
            "note": "Review window 20-29 July 2026, tag v1.3.0-libs.0."
          },
          {
            "auditor": "G0 Group",
            "date": "2021-05",
            "type": "audit",
            "scope": "Shared component: Gnosis Safe v1.3.0 contracts (final audit), the version of the rollup's owner Safe",
            "url": "https://github.com/safe-fndn/safe-smart-account/blob/main/docs/Gnosis_Safe_Audit_Report_1_3_0_Final.pdf",
            "commit": "ad6c7355d5bdf4f7fa348fbfcb9f07431769a3c9",
            "repo": "https://github.com/safe-fndn/safe-smart-account",
            "covers_deployed": "yes",
            "findings": "No issues found"
          },
          {
            "auditor": "G0 Group",
            "date": "2021-04",
            "type": "audit",
            "scope": "Shared component: Gnosis Safe v1.3.0 contracts (initial audit), the version of the rollup's owner Safe",
            "url": "https://github.com/safe-fndn/safe-smart-account/blob/main/docs/Gnosis_Safe_Audit_Report_1_3_0_Initial.pdf",
            "commit": "4bfc0c8519f1893015d7edfd2c2780fca163c364",
            "repo": "https://github.com/safe-fndn/safe-smart-account",
            "covers_deployed": "partly",
            "findings": "No issues found",
            "note": "Superseded by the May 2021 final audit; changes up to 9b305a0f were checked."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 4,
        "short": 16,
        "unk": 3,
        "total": 23
      }
    },
    {
      "slug": "phantom-cash",
      "name": "Phantom Cash",
      "type": "incumbent",
      "website": "https://phantom.com/cash",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Phantom mobile app and Cash account (Phantom profile sign-in)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Phantom Technologies, Inc.",
          "required": true
        },
        {
          "name": "Phantom backend (prompt-free Cash swaps and transfers, card UI)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Phantom Technologies, Inc.",
          "required": true
        },
        {
          "name": "CASH stablecoin (Token-2022; freeze authority, permanent delegate)",
          "role": "ledger",
          "public": false,
          "license": "proprietary",
          "operator": "Bridge Building Inc.",
          "required": true
        },
        {
          "name": "Bridge card programme and debit-card contract (program manager; draws CASH)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Bridge Ventures LLC (Stripe)",
          "required": true
        },
        {
          "name": "Lead Bank (card issuer)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Lead Bank",
          "required": true
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Galileo card processing and disputes",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Galileo",
          "required": true
        },
        {
          "name": "Link (Stripe) identity verification",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Stripe",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.bridge.xyz/card-agreements/phantom-card",
              "quote": "We reserve the right to block, suspend or cancel your Card at any time, with or without notice",
              "detail": "Lead Bank Prepaid Visa Cardholder Agreement (Bridge Ventures as Program Manager, Phantom as Platform Provider), fraud prevention clause.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The bank and the program manager can block or cancel an individual card with or without notice. That meets anchor 0. No settlement contract was identified to assess further.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/use-your-virtual-phantom-debit-card-us-only-44800221533459",
              "quote": "Stripe (our partner) draws CASH from your Cash account, converts it to USD",
              "detail": "The debit card article says Stripe/Bridge pulls CASH from the Cash account at payment time and the merchant is paid like a standard Visa transaction.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12",
              "drift": true
            }
          ],
          "finding": "Card payments are pulled by Bridge and settled over Visa by Lead Bank. No direct payer or payee contract path is documented or published.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/understanding-your-cash-account-44799497237395",
              "quote": "Link handles identity verification (KYC) for Cash.",
              "detail": "The Partners section lists Link (KYC), Stripe (funding), Bridge (card, bank transfers), Lead Bank (issuer) and Galileo (processing, disputes).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12",
              "drift": true
            }
          ],
          "finding": "The card depends on Phantom's closed app and on Stripe, Bridge, Lead Bank and Galileo. None is public and none has a fallback. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/privacy",
              "quote": "comply with legal obligations related to financial crimes and sanctions",
              "detail": "The Privacy Policy says Phantom uses IP address and other data for sanctions compliance; the card is offered only in the US except New York after Link KYC, and some merchant categories are declined.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Sanctions and geographic gating is disclosed in policy and help pages. It runs in closed services and cannot be bypassed (C2 = 0). 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH",
              "address": "CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 454207323,
              "detail": "CASH mint (Token-2022, owner TokenzQdB...) has freezeAuthority AyCP3oW19DHZKvx8oU6mvseW2qn7XfmQ5STrXPa6prY5 and a permanentDelegate extension set to E7JdFMP5AqdndJKstZV2mHdekLwAQbNWRHMpoozyB3qw (both system-owned keypair accounts), which can freeze any CASH account and transfer or burn CASH from any holder.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH\",{\"encoding\":\"jsonParsed\"}]}'"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://help.phantom.com/articles/cash-faq-44800866087443",
              "quote": "Only you can move funds using your wallet credentials.",
              "detail": "The Cash FAQ answers \"Can anyone pull CASH out of my Cash account?\" with No, saying Phantom, Stripe, Link or any partner cannot access or withdraw funds.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.phantom.com/cash",
              "quote": "CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH",
              "detail": "Phantom's developer docs enumerate the CASH mint on Solana as the Cash token.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The token and chain are enumerated in docs (CASH on Solana). The issuer's powers are misstated: the FAQ says no partner can pull CASH out of a Cash account, but the mint carries a permanent delegate that can move or burn any holder's CASH, and a freeze authority. Solana has no sequencer, which is not stated either. Misstated, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/understanding-your-cash-account-44799497237395",
              "quote": "Link handles identity verification (KYC) for Cash.",
              "detail": "Cash runs in the closed Phantom mobile app (not the extension) and on partner services; no Cash, card or Cash-account program repository exists in github.com/phantom.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12",
              "drift": true
            }
          ],
          "finding": "Nothing needed to run Phantom Cash is public. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/understanding-your-cash-account-44799497237395",
              "quote": "Link handles identity verification (KYC) for Cash.",
              "detail": "Every required component (app, backend, CASH issuer, card programme, KYC) is closed.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12",
              "drift": true
            }
          ],
          "finding": "Required components are closed, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/use-your-virtual-phantom-debit-card-us-only-44800221533459",
              "quote": "Stripe (our partner) draws CASH from your Cash account, converts it to USD",
              "detail": "The card cannot work without Stripe/Bridge pulling CASH and Lead Bank settling over Visa.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12",
              "drift": true
            }
          ],
          "finding": "The product cannot run without proprietary hosted services. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/privacy",
              "quote": "We use third-party analytics to evaluate usage of our Functionality.",
              "detail": "The Privacy Policy discloses third-party analytics and says users may opt out, so it is on by default; the vendor is not named.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics is present, on by default and disclosed in the policy. The app is closed and no trace was run. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/privacy",
              "quote": "Social Security number, government-issued identification",
              "detail": "The Privacy Policy says KYC for opt-in features covers legal name, date of birth, SSN, government ID and contact data, processed by third parties under the Bank Secrecy Act; for Phantom Cash it also collects merchant location data and the last four digits of bank and card numbers.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC is legally required and its basis is disclosed, but only in a hosted policy, and Phantom also keeps merchant location data for card transactions. Documented cap, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/understanding-your-cash-account-44799497237395",
              "quote": "Bridge rotates the addresses it uses.",
              "detail": "The Privacy section says card payments appear onchain as transfers from the Cash account to Bridge's debit card smart contract, without merchant data, and bank flows as transfers to rotating Bridge wallets.",
              "checked_at": "2026-10-07",
              "drift": true
            }
          ],
          "finding": "Each card payment is a public transfer from a long-lived Cash address, so amounts and timing are visible; merchant data is not onchain. Judgment call: this is \"minimal linkage, documented\" (2), but no sample transaction could be tied to the debit-card contract, so it rests on documentation and is capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/understanding-your-cash-account-44799497237395",
              "quote": "Link handles identity verification (KYC) for Cash.",
              "detail": "Help pages name Link, Stripe, Bridge, Lead Bank and Galileo as partners in Cash and card flows.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12",
              "drift": true
            }
          ],
          "finding": "Third parties in the card flow are named in docs and not swappable. No trace was run. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH",
              "address": "CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 454207323,
              "detail": "CASH permanentDelegate = E7JdFMP5AqdndJKstZV2mHdekLwAQbNWRHMpoozyB3qw, a key controlled by the issuer side; Token-2022 lets a permanent delegate transfer or burn from any CASH account without the holder's signature.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH\",{\"encoding\":\"jsonParsed\"}]}'"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/understanding-your-cash-account-44799497237395",
              "quote": "transfers from your Cash account to Bridge",
              "detail": "At payment time CASH moves from the Cash account to Bridge's debit card smart contract (address not published).",
              "checked_at": "2026-10-07",
              "drift": true
            }
          ],
          "finding": "The balance is held as CASH in the user's Cash account, then moved to a Bridge contract when the card is used. Bridge is both CASH issuer and card program manager, and the CASH mint's permanent delegate lets it move any holder's CASH. Phantom's FAQ says no partner can. Judgment call: although the criteria put token-issuer powers under C5, here the issuer is also the card program manager and CASH is the only asset a Cash account holds, so \"the provider can redirect funds\" applies. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. Per phantom.com/cash and the Lead Bank Prepaid Visa Cardholder Agreement, the card is issued by Lead Bank under licence from Visa, with Bridge Ventures LLC as Program Manager and Phantom as Platform Provider. usecash.xyz says CASH is issued by Bridge Building Inc., a FinCEN-registered MSB with state money-transmission licences (NMLS #2450917), with reserves in segregated accounts; it expects to move CASH under the GENIUS Act regime.",
      "notes": "Eligibility: no verified contract and no public repository needed to run the product, so type is incumbent. Searched 2026-10-07: phantom.com/cash, terms, privacy; help.phantom.com Cash section (FAQ, Understanding your Cash account, debit card, recovery, compromise, KYC); docs.phantom.com/cash; bridge.xyz Phantom card agreement; usecash.xyz; github.com/phantom (no Cash, card or Cash-account program). Onchain: the CASH mint (read above) and a sample of 60 recent CASH transactions, which use only SPL Token-2022, ATA, swap and prediction programs; no Squads or other smart-account program appeared, and the \"self-custodial smart-contract wallet\" and \"debit-card smart contract\" the help pages mention could not be identified. One candidate program, 99vQwtBw... (ExecuteTransfer with an ed25519 voucher), turned out to be a single-vault payout program unrelated to Cash accounts and was excluded. Re-assess as type card if Phantom or Bridge publishes the Cash account or debit-card program.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "US"
        ],
        "note": "The assessed payment path is the virtual Phantom debit card (Lead Bank prepaid Visa via Bridge), which Phantom's help centre says is available only in the United States, except New York. The Cash account itself is described as available worldwide, and Stripe funding is also offered in EU member states, but without the card there is no card payment rail. The Lead Bank cardholder agreement names no countries or states.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/use-your-virtual-phantom-debit-card-us-only-44800221533459",
            "detail": "Phantom's debit card article limits the card to the US, excluding New York.",
            "quote": "The card is available in the US only (except New York)",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-12",
            "drift": true
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/cash-faq-44800866087443",
            "detail": "The Cash FAQ says the Cash account is available worldwide but some features, including the card, are US (except New York) or EU only.",
            "quote": "Cash is available worldwide. Some features are available only in the United States (except New York) and EU",
            "checked_at": "2026-10-09",
            "drift": true
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "CASH",
            "class": "platform",
            "issuer": "Bridge Building Inc. (Stripe), co-branded with Phantom",
            "default": true,
            "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
            "address": "CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH"
          }
        ],
        "conversion": "at_spend",
        "note": "CASH is a USD-pegged, fiat-reserve-backed stablecoin from Bridge and Phantom, classed here as platform because it is the provider's own-branded dollar. USDC, USDT or PYUSD sent to the Cash address on Solana are automatically swapped into CASH, so CASH is the only token the card debits. At payment Stripe/Bridge draws CASH from the Cash account and converts it to USD.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/use-your-virtual-phantom-debit-card-us-only-44800221533459",
            "detail": "The debit card article says Stripe draws CASH from the Cash account at payment and converts it to USD.",
            "quote": "Stripe (our partner) draws CASH from your Cash account, converts it to USD",
            "checked_at": "2026-10-12",
            "drift": true
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/understanding-your-cash-account-44799497237395",
            "detail": "USDC, USDT or PYUSD sent to the Cash address are automatically swapped into CASH.",
            "quote": "Phantom automatically swaps these tokens for CASH in your Cash account",
            "checked_at": "2026-10-12",
            "drift": true
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://usecash.xyz",
            "detail": "The CASH site names Bridge Building Inc. as issuer and describes 1:1 USD reserves.",
            "quote": "CASH is issued by Bridge Building Inc. (BBI) and distributed by BBI and its affiliates.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.phantom.com/cash",
            "detail": "Phantom's developer docs give the CASH mint on Solana.",
            "quote": "CASHx9KJUStyftLFWGvEVf59SGeG9sh5FfcnZMVPCASH",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "phantom.com (Cash, security and legal pages), help.phantom.com, docs.phantom.com/cash, github.com/phantom (no Cash, card or Cash-account program code), usecash.xyz and bridge.xyz, Least Authority's published reports, and Halborn's audit listing. The only published report is Least Authority's 2024 audit of the Phantom wallet code; it predates Cash. Phantom said in 2022 that Halborn and OtterSec had audited the wallet, but no such report is published. No audit was found for the CASH token program set-up, the Bridge debit-card contract or Phantom's Cash backend.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Least Authority",
            "date": "2024-06-07",
            "type": "audit",
            "scope": "Phantom wallet (private repository phantom/wallet): key derivation and storage, cryptography, deep links and WebViews, dependencies; the wallet that now hosts the Cash account.",
            "url": "https://leastauthority.com/phantom-wallet-final-audit-report",
            "commit": "18c5d927b8063911a3f09f82d31c57e49f171d85",
            "covers_deployed": "unknown",
            "findings": "No issues; 2 suggestions (BIP32 validation, stronger password key derivation), both resolved",
            "note": "Initial review at aea4d38 (February to April 2024), verification at 18c5d92. The report predates the Cash account and debit card, and the closed-source app cannot be compared with the audited revision."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 5,
        "unk": 18,
        "total": 23
      }
    },
    {
      "slug": "plasma-one",
      "name": "Plasma One",
      "type": "card",
      "website": "https://www.plasma.org/personal",
      "primary_chain": {
        "name": "Plasma",
        "chain_id": 9745,
        "basis": "The International Card Terms define Supported Blockchains as \"the Plasma blockchain network\" and name Rain as issuer, so the card's collateral runs on Rain's Plasma deployment: Coordinator 0xd5dd7939... and Collateral beacon 0xBb931B7B... (block 34429835). Judgment call: Plasma One publishes no addresses; that this Coordinator serves Plasma One rests on the terms, and the sample collateral used to show the flow is not confirmed as a Plasma One cardholder's. Excluded: the US card terms and the Bridge account services."
      },
      "repos": [],
      "contracts": [
        {
          "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
          "chain_id": 9745,
          "role": "Rain Coordinator (payments, withdrawals, pulls)",
          "verified": "explorer"
        },
        {
          "address": "0x36F5A3156FC6deD6bbcA970D26972ABB2dfD6274",
          "chain_id": 9745,
          "role": "Rain collateral factory (TransparentUpgradeableProxy)",
          "verified": "explorer"
        },
        {
          "address": "0x6f3b5Fd970Ffe143E04F636B0d7c8a62DEf58740",
          "chain_id": 9745,
          "role": "ProxyAdmin of the collateral factory",
          "verified": "none"
        },
        {
          "address": "0xBb931B7BF3691053a7C9caf47Fb0172d20608134",
          "chain_id": 9745,
          "role": "Collateral UpgradeableBeacon (unverified)",
          "verified": "none"
        },
        {
          "address": "0x05263D2448d8Bd3dfB9B0b63B6585450c823C1a9",
          "chain_id": 9745,
          "role": "Collateral implementation",
          "verified": "explorer"
        },
        {
          "address": "0xe0C209DbE0A57e664Bc63Df4247E25939AECb959",
          "chain_id": 9745,
          "role": "Sample per-user collateral (BeaconProxy, unattributed)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "Rain Coordinator and per-user Collateral contracts",
          "role": "contracts",
          "public": true,
          "license": "proprietary",
          "operator": "Signify Holdings, Inc. d/b/a Rain (owner EOA 0x21ebc2f2...)",
          "required": true
        },
        {
          "name": "Rain collateral beacon and factory admin (unverified beacon)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Rain (EOA 0x21ebc2f2...)",
          "required": true
        },
        {
          "name": "Rain executor, publisher and pull-operator keys",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Rain",
          "required": true
        },
        {
          "name": "Rain (card issuer and program manager, Visa Principal Member)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Signify Holdings, Inc. d/b/a Rain",
          "required": true
        },
        {
          "name": "Visa (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Plasma One app and backend",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Plasma (Cayman Islands) and Plasma Labs UK Ltd.",
          "required": true
        },
        {
          "name": "Privy wallet contracts and TEE key management (not identified)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Privy",
          "required": true
        },
        {
          "name": "Sumsub (identity verification)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub",
          "required": true
        },
        {
          "name": "Bridge (global account services; not in the card path)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Bridge Building Inc. / Sp. Z.o.o. / Limited",
          "required": false
        },
        {
          "name": "Plasma chain (PlasmaBFT validators)",
          "role": "other",
          "public": true,
          "license": "none",
          "operator": "Plasma validators",
          "required": true
        }
      ],
      "context": "Per its Terms of Service and Privacy Policy, Plasma is an exempted company incorporated in the Cayman Islands (CO-412800) with Plasma Labs UK Ltd. as joint data controller, and states it is not a bank, exchange, broker or virtual asset service provider. The card is issued by Rain, a Visa Principal Member, under licence from Visa; global account services are provided by Bridge entities in the US, EEA (Poland) and elsewhere.",
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 34429835,
              "detail": "Coordinator owner() = EOA 0x21ebc2f23a91fD7eB8406CDCE2FD653de280B5fc, which adds or removes executors and publishers, sets the treasury and supported assets; timelockWithdrawWithoutSignatureAllowed() = false.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x00000000000000000000000021ebc2f23a91fd7eb8406cdce2fd653de280b5fc"
              },
              "drift": true
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/plasma-one-international-card-terms",
              "quote": "Plasma and Issuer reserve the right to block and terminate transactions and suspend access to your Account",
              "detail": "Card Terms s5 let Plasma and the issuer block transactions and suspend accounts at any time.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card settlement contracts are controlled by a single Rain EOA, and the Card Terms let Plasma and Rain block any cardholder's transactions at any time. Users cannot pull collateral out without a Rain signature because unsigned timelock withdrawals are switched off. EOA-held role with per-account blocking, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/tx/0x32bbf2f43c3ea2f7a77d3ec9e1e86d1142e7419a66af113f785659187a0134b8",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 34424414,
              "detail": "Sample card funding tx 0x32bbf2f4...34b8 was sent by EOA 0x2ebE9d77c907C03910157f4c437962F156FEB3Da calling Coordinator.pullAssetFromUserWallet (onlyPullOperator) to move 1.34 USDT0 from account 0xDc4930f1... into its collateral 0xe0C209Db...; payments from collateral to the Rain treasury (makePaymentFromCollateral) require a Rain executor/publisher signature.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Merchants are paid by Rain through Visa offchain. Onchain, moving funds into collateral and paying out of it both require Rain-held keys (pull operator, executor or publisher). No payer or payee can settle directly.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/terms-of-service",
              "quote": "Plasma is not the program manager or the issuer of the Plasma One Card",
              "detail": "The Terms place the card program with third parties; the International Card Terms name Rain as issuer under licence from Visa.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 34429835,
              "detail": "Coordinator publishers(0) = 0xcBD8eaE56e5D51c82E9b901ff535906077c5ab32 and executors(0) = 0xB92949bdF09F4193599Ae7700211751ab5F74aCd, both Rain-held keys.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "A card payment needs Plasma One's closed app and backend, Rain's signers and Visa. None is public and there is no fallback. Plasma publishes no Plasma One repository.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/terms-of-service",
              "quote": "Prohibited jurisdictions include: Cuba, Iran, and North Korea",
              "detail": "Terms list prohibited and restricted jurisdictions and OFAC/EU/UK sanctions screening.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Geographic and sanctions restrictions are disclosed in the Terms and enforced in the closed backend, Rain and Sumsub, so the neutrality of the settlement layer cannot be shown from code and the screening cannot be bypassed (C2 = 0). Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 34429835,
              "detail": "Coordinator isSupportedAsset(USDT0 0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb) = true; USDT0 exposes isBlocked(address) and owner() 0x4DFF9b5b0143E642a3F63a5bcf2d1C328e600bf8.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x9be918e6000000000000000000000000b8ce59fc3717ada4c02eadf9682a9e934f625ebb",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077 \"isSupportedAsset(address)(bool)\" 0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb --block 34429835 --rpc-url https://rpc.plasma.to",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/terms-of-service",
              "quote": "stablecoin issuers may have the contractual or technical ability to freeze, block, or blacklist tokens or addresses",
              "detail": "The Terms warn of issuer freeze powers in general terms; no chain or validator assumptions are stated.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The collateral asset (USDT0) is enumerated in onchain Coordinator config read from verified source, and the Terms warn that stablecoin issuers can freeze addresses, without naming USDT0's blocklist. Plasma's validator set and inclusion assumptions are not stated. Judgment call: the generic freeze warning is not a per-token statement, so 2, not 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xBb931B7BF3691053a7C9caf47Fb0172d20608134",
              "address": "0xBb931B7BF3691053a7C9caf47Fb0172d20608134",
              "block_number": 34429835,
              "detail": "Plasmascan shows Exact Match for the Coordinator, Collateral implementation 0x05263D24... and the factory proxy; the Collateral beacon 0xBb931B7B... and the collateral proxies are unverified; Sourcify v2 has none of these addresses.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x5c60da1b",
                "expect": "0x00000000000000000000000005263d2448d8bd3dfb9b0b63b6585450c823c1a9"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Rain's Coordinator and Collateral logic are verified on Plasmascan, but the beacon that decides which Collateral logic runs is not, nothing is on Sourcify, and the user wallet contract is not identified. Some contracts verified, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0x05263D2448d8Bd3dfB9B0b63B6585450c823C1a9",
              "address": "0x05263D2448d8Bd3dfB9B0b63B6585450c823C1a9",
              "block_number": 34429835,
              "detail": "The only public code in the card path is explorer-verified Rain contract source; the PlasmaLaboratories GitHub org holds forks (reth, alloy, ethrex), a token list and node templates, and no Plasma One app, SDK, backend or API repo.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Contract source is visible through explorer verification; the app, backend, API and indexer are closed and no API schema is published. Judgment call: explorer-verified source counts as \"contracts only\", so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 34429835,
              "detail": "No Plasma One repository, README or deploy script exists; the card path depends on Rain-held keys.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "There is no self-host path: no repo or README, and the card cannot run without Rain's keys and Plasma's backend. Reproduction not attempted.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 34429835,
              "detail": "Coordinator ABI and events (AssetPulled, PaymentFromCollateral, Withdrawal) are available from explorer verification only; no repo, API schema or export format.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "ABIs and events can be read from the explorer, but nothing is versioned in a repo and there is no API schema or data export. Judgment call: 1, as for other explorer-only cases.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xBb931B7BF3691053a7C9caf47Fb0172d20608134",
              "address": "0xBb931B7BF3691053a7C9caf47Fb0172d20608134",
              "block_number": 34429835,
              "detail": "The collateral beacon is unverified, the backend and signers are closed, and there are no repos with a licence.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Required components are closed (Plasma One backend, Rain signers, the unverified beacon), and no repo carries any licence. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 34429835,
              "detail": "pullAssetFromUserWallet is onlyPullOperator and payments from collateral verify a Rain executor/publisher signature.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The card cannot run without Rain's proprietary signing service and Plasma's backend; there is no open alternative.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/privacy-policy",
              "quote": "we may use Google Analytics for this purpose",
              "detail": "The Privacy Policy discloses Google Analytics on the Service and other tracking technologies.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics is present and disclosed in the privacy policy. The app is closed, so whether it is on by default or opt-in cannot be checked in code. Judgment call: disclosed analytics with no code to show opt-in is anchor 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/privacy-policy",
              "quote": "Identity verification (KYC) conducted by SumSub",
              "detail": "The Privacy Policy describes ID numbers, ID images, biometric face matching via Sumsub, and AML data.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Collection goes beyond settlement needs (identity documents, biometrics, AML data) and is disclosed in the privacy policy only. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/tx/0x32bbf2f43c3ea2f7a77d3ec9e1e86d1142e7419a66af113f785659187a0134b8",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 34424414,
              "detail": "The pull call and its AssetPulled event carry the user wallet, its collateral, asset, amount and an opaque UUID transaction id (edd302da-4d10-497c-9258-ce471a434f88); no merchant or order data.",
              "checked_at": "2026-10-07",
              "recheck": "cast tx 0x32bbf2f43c3ea2f7a77d3ec9e1e86d1142e7419a66af113f785659187a0134b8 input --rpc-url https://rpc.plasma.to | cast calldata-decode \"pullAssetFromUserWallet(string,address,address,address,uint256)\""
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/privacy-policy",
              "quote": "will be visible to other users of the Service and the public",
              "detail": "The Privacy Policy says data interacting with the Plasma blockchain is visible to the public.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No merchant data goes onchain, but each card funding is a public pull from a long-lived wallet into its own collateral, tagged with a Rain transaction id, so amounts and timing are linkable to the wallet. Public visibility is disclosed. Minimal linkage, documented, so 2. Judgment call: the sample is a Rain collateral on Plasma not confirmed as a Plasma One account.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/terms-of-service",
              "quote": "key-management infrastructure provided by Privy",
              "detail": "The Terms name Privy for wallet keys and Bridge for account services; the card terms name Rain and Visa; the privacy policy names Sumsub and Google Analytics.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Rain, Visa, Privy, Sumsub and Google see payment or identity data; they are disclosed in documents only and cannot be swapped. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xBb931B7BF3691053a7C9caf47Fb0172d20608134",
              "address": "0xBb931B7BF3691053a7C9caf47Fb0172d20608134",
              "block_number": 34429835,
              "detail": "Collateral beacon owner() = Rain EOA 0x21ebc2f2...; Collateral.withdrawERC20Asset is onlyCoordinator; the sample account's USDT0 allowance to its collateral is 2^256-1, and the Coordinator's pull operator can pull any amount.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x00000000000000000000000021ebc2f23a91fd7eb8406cdce2fd653de280b5fc"
              },
              "recheck": "cast call 0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb \"allowance(address,address)(uint256)\" 0xDc4930f1A410554D95ecd03A12500c573595BEB5 0xe0C209DbE0A57e664Bc63Df4247E25939AECb959 --block 34429835 --rpc-url https://rpc.plasma.to",
              "drift": true
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://www.plasma.org/terms-of-service",
              "quote": "Plasma cannot access raw private key information for you",
              "detail": "Plasma says it cannot access keys or initiate actions; this covers Plasma, not Rain.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Funds in collateral are released only by Rain's Coordinator, and users cannot withdraw without a Rain signature. The observed account grants its collateral an unlimited USDT0 allowance that Rain's pull operator uses, and a single Rain EOA can swap the collateral logic through the beacon. Rain can redirect funds, so 0. Judgment call: the allowance sample is not confirmed as a Plasma One account.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0x36F5A3156FC6deD6bbcA970D26972ABB2dfD6274",
              "address": "0x36F5A3156FC6deD6bbcA970D26972ABB2dfD6274",
              "block_number": 34429835,
              "detail": "Factory EIP-1967 admin = ProxyAdmin 0x6f3b5Fd9..., whose owner() is EOA 0x21ebc2f2...; the same EOA owns the Collateral beacon and the Coordinator.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x0000000000000000000000006f3b5fd970ffe143e04f636b0d7c8a62def58740"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every collateral contract can be upgraded at once by a single Rain EOA through the beacon, with no timelock or notice; the factory is upgradeable by the same EOA. EOA admin, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb",
              "address": "0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb",
              "block_number": 34429835,
              "detail": "USDT0 allowance(0xDc4930f1..., collateral 0xe0C209Db...) = 2^256-1.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The observed card account grants an unbounded USDT0 approval to a collateral contract whose logic a Rain EOA can replace; neither the Terms nor the card terms disclose an unbounded approval. Unbounded and undisclosed, so 0. Judgment call: the sample is a Rain collateral on Plasma not confirmed as a Plasma One account, and the app code that sets the approval is not public.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 34429835,
              "detail": "timelockWithdrawWithoutSignatureAllowed() = false, so Collateral.initiateTimeLockWithdrawal reverts without a Rain signature.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xe5b90e49",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "S1: collateral is Rain-controlled. C2: no direct settlement (0). C3: closed single-vendor (0). O3: no self-host path. Funds already in collateral cannot leave without Rain's signature, so they depend on Rain's liveness; balances left in the user's wallet stay under the user's Privy-managed key, but that wallet is not public code. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "notes": "Plasma One publishes no contract addresses or repositories. The card-side contracts were found from USDT0 Transfer logs on Plasma (block range 34379335-34429334): per-user Rain Collateral BeaconProxies funded by Coordinator.pullAssetFromUserWallet. The International Card Terms name Plasma as the only Supported Blockchain and Rain as issuer, which is the basis for scoring Rain's Plasma deployment; the specific sample account is not confirmed as a Plasma One user. The accounts seen funding collateral are EIP-7702 delegations to ZeroDev Kernel v3.3 (0xd6CEDDe8...), which does not match a third-party claim (HarrisHan/plasma-one-account) that Plasma One uses Biconomy Nexus 1.2.0; neither is attributed. All reads pinned to Plasma block 34429835.",
      "availability": {
        "model": "blocklist",
        "countries": [
          "CU",
          "IR",
          "KP",
          "AF",
          "BY",
          "BA",
          "CF",
          "CN",
          "CD",
          "GN",
          "GW",
          "HT",
          "IN",
          "IQ",
          "IL",
          "LY",
          "ML",
          "MM",
          "NP",
          "NI",
          "RU",
          "SO",
          "SS",
          "SD",
          "SY",
          "TR",
          "UA",
          "VE",
          "VN",
          "YE",
          "ZW"
        ],
        "note": "From Appendix I (Prohibited Activities List) of the Terms of Service, last updated 15 June 2026. s1.1 prohibits Cuba, Iran and North Korea; the Crimea, Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine; and any other jurisdiction under OFAC, EU, UK OFSI or UN sanctions, which are not named and so are not listed here. s1.2 lists 28 \"Additional Restricted Jurisdictions\" where Plasma \"may\" restrict or terminate access. They are included as the more restrictive reading, although the wording is discretionary. All of Ukraine is listed because s1.2 names Ukraine outside the s1.1 regions. FATF grey-list countries may face case-by-case review. The card comes in two programmes, both issued by Rain: a US card for US residents (US Consumer Card Terms) and an International card for non-US citizens. Bridge provides the account services through separate US, EEA and rest-of-world entities. Vault Services are additionally unavailable to New York residents.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/terms-of-service",
            "detail": "Appendix I s1.1 Sanctioned Jurisdictions, which are prohibited for the platform and the card.",
            "quote": "Prohibited jurisdictions include: Cuba, Iran, and North Korea",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/terms-of-service",
            "detail": "Appendix I s1.2 Additional Restricted Jurisdictions, 28 countries from Afghanistan to Zimbabwe.",
            "quote": "Afghanistan, Belarus, Bosnia and Herzegovina, Central African Republic, China (Mainland), the Democratic Republic of the",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/plasma-one-international-card-terms",
            "detail": "The International Card is for non-US citizens; US residents use the separate US Consumer Card Terms.",
            "quote": "you are signing up for a card that is intended for those outside of the United States",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDT0",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "USDT0 (LayerZero OFT of Tether's USDT)",
            "default": true,
            "chain_id": 9745,
            "address": "0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb"
          }
        ],
        "conversion": "at_spend",
        "note": "Plasma One's Terms say the card makes fiat payments funded by stablecoin balances in the user's wallet, without naming the token. Onchain, the Rain Coordinator on Plasma accepts USDT0 as a collateral asset, and the observed card funding pulled USDT0 from the user's account into its Rain collateral; Rain then pays the merchant in dollars over Visa. Other collateral assets, if any, were not enumerated (the Coordinator exposes a per-token check, not a list). The in-app Swap Function (via 0x) converts other assets, including XPL cashback, into stablecoins, but it is a manual step, not an auto-swap at spend. Cashback is paid in XPL. USDT0 is an omnichain representation of Tether's USDT; Tether is the underlying reserve issuer.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
            "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
            "chain_id": 9745,
            "block_number": 34429835,
            "detail": "Rain Coordinator isSupportedAsset(USDT0 0xB8CE59FC3717ada4C02eaDF9682A9e934F625ebb) = true.",
            "checked_at": "2026-10-12",
            "check": {
              "call": "0x9be918e6000000000000000000000000b8ce59fc3717ada4c02eadf9682a9e934f625ebb",
              "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
            },
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://plasmascan.to/tx/0x32bbf2f43c3ea2f7a77d3ec9e1e86d1142e7419a66af113f785659187a0134b8",
            "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
            "chain_id": 9745,
            "block_number": 34424414,
            "detail": "Sample card funding tx 0x32bbf2f4...34b8 called Coordinator.pullAssetFromUserWallet to move 1.34 USDT0 from account 0xDc4930f1... into its Rain collateral 0xe0C209Db.... The sample is not confirmed as a Plasma One account.",
            "checked_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/terms-of-service",
            "detail": "Terms define the Plasma One Card as making fiat payments funded by stablecoin balances in the user's wallet.",
            "quote": "allow you to make fiat payments funded by stablecoin balances in your Digital Wallets accessed through Plasma One",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "Plasma's Plasma One pages and Rain's Plasma case study (both say contracts are audited before launch; no report is linked), Rain's security page (reports shared under NDA; Sherlock named), the Sherlock report repo (github.com/sherlock-protocol/sherlock-reports), the Guardian report repo, and web searches for Plasma One and Rain card-contract audits. Rain's public GitHub (SignifyHQ) holds SDKs only. No audit of Plasma One's own app or backend or of the Privy wallet stack is logged.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Sherlock",
            "date": "2025-02-11",
            "type": "contest",
            "scope": "Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest",
            "url": "https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2025.02.11%20-%20Final%20-%20Rain%20Private%20Best%20Efforts%20Audit%20Contest%20Report.pdf",
            "commit": "6f578d5b9c9fa35bbe857959a50fa5aab4fa611a",
            "repo": "https://github.com/SignifyHQ/collateral-contract-evm-v2",
            "covers_deployed": "unknown",
            "findings": "0 high, 2 medium (statement payoff rounding; missing Chainlink min/max answer check)",
            "note": "Contest ran 2-8 December 2024 on b432939a; 6f578d5 is the fix commit. The Rain repo is private, the Plasma collateral beacon is unverified, and the Plasma Coordinator's pullAssetFromUserWallet and timelocked withdrawal functions are not named in the report, so the deployment may be a later version."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 2,
        "short": 15,
        "unk": 6,
        "total": 23
      }
    },
    {
      "slug": "privacy-pools",
      "name": "Privacy Pools (0xbow)",
      "type": "transfer",
      "website": "https://privacypools.com",
      "primary_chain": {
        "name": "Ethereum",
        "chain_id": 1,
        "basis": "The core repo's deployments page (privacy-pools-core@d494b63e docs/docs/deployments.md L9-L17) lists only Ethereum mainnet, and the website's chainData.ts (privacy-pools-website@7df41112 L129-L142) lists mainnet first with 14 pools behind Entrypoint 0x6818…6b46. Onchain, the ETH pool's nonce is 6071 deposits at block 26153374. Unit: the Entrypoint proxy and the ETH, USDC and USDT pools (most deposits). Excluded: the 11 other mainnet pools (same code), the OP/BSC/Arbitrum Entrypoint 0x4419…d15E, Starknet and testnets."
      },
      "repos": [
        {
          "url": "https://github.com/0xbow-io/privacy-pools-core",
          "role": "contracts",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/0xbow-io/privacy-pools-website",
          "role": "frontend",
          "license": "CC-BY-NC-4.0"
        }
      ],
      "contracts": [
        {
          "address": "0x6818809EefCe719E480a7526D76bD3e561526b46",
          "chain_id": 1,
          "role": "Entrypoint (UUPS proxy)",
          "verified": "sourcify"
        },
        {
          "address": "0x15e355024de1CDc74ADdea7EBDf98418Ba5B1a2c",
          "chain_id": 1,
          "role": "Entrypoint implementation",
          "verified": "sourcify"
        },
        {
          "address": "0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB",
          "chain_id": 1,
          "role": "ETH pool (PrivacyPoolSimple)",
          "verified": "sourcify"
        },
        {
          "address": "0xb419c2867aB3CBc78921660cB95150d95A94ce86",
          "chain_id": 1,
          "role": "USDC pool (PrivacyPoolComplex)",
          "verified": "sourcify"
        },
        {
          "address": "0xe859C0bD25f260BaEE534Fb52e307D3b64D24572",
          "chain_id": 1,
          "role": "USDT pool (PrivacyPoolComplex)",
          "verified": "sourcify"
        },
        {
          "address": "0x022891F938Ae7fDC8Ab9Ead0FBf50aBA8C897D6d",
          "chain_id": 1,
          "role": "Withdrawal Groth16 verifier",
          "verified": "sourcify"
        },
        {
          "address": "0xa45ACa8604a73D80C551fAad6355A5c3A5565eC6",
          "chain_id": 1,
          "role": "Ragequit (commitment) Groth16 verifier",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Privacy pool contracts (ETH, USDC, USDT) and verifiers",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "none (immutable; deposits only via the Entrypoint)",
          "required": true,
          "repo": "https://github.com/0xbow-io/privacy-pools-core"
        },
        {
          "name": "Entrypoint (UUPS proxy, roles OWNER_ROLE and ASP_POSTMAN)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "0xbow (owner Safe 2-of-4; postman EOA)",
          "required": true,
          "repo": "https://github.com/0xbow-io/privacy-pools-core"
        },
        {
          "name": "0xbow Association Set Provider (deposit screening and root posting)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "0xbow",
          "required": true
        },
        {
          "name": "Circuits and proving artifacts (packages/circuits)",
          "role": "other",
          "public": true,
          "license": "Apache-2.0",
          "operator": "none (static artifacts)",
          "required": true,
          "repo": "https://github.com/0xbow-io/privacy-pools-core"
        },
        {
          "name": "Privacy Pools SDK (@0xbow/privacy-pools-core-sdk)",
          "role": "sdk",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/0xbow-io/privacy-pools-core"
        },
        {
          "name": "Ethereum mainnet and a JSON-RPC endpoint of the user's choice",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Ethereum validators; RPC chosen by the user",
          "required": true,
          "repo": "https://github.com/ethereum/go-ethereum"
        },
        {
          "name": "ASP tree data on IPFS (CID posted onchain with each root)",
          "role": "indexer",
          "public": true,
          "license": "none",
          "operator": "0xbow publishes; any IPFS gateway serves",
          "required": false
        },
        {
          "name": "0xbow ASP API (leaves, roots, events for the website)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "0xbow",
          "required": false
        },
        {
          "name": "Relayers (Fast Relay, Cloaked Relay; reference relayer in packages/relayer)",
          "role": "relayer",
          "public": true,
          "license": "Apache-2.0",
          "operator": "third-party relayer operators",
          "required": false,
          "repo": "https://github.com/0xbow-io/privacy-pools-core"
        },
        {
          "name": "privacypools.com website",
          "role": "frontend",
          "public": true,
          "license": "CC-BY-NC-4.0",
          "operator": "0xbow",
          "required": false,
          "repo": "https://github.com/0xbow-io/privacy-pools-website"
        },
        {
          "name": "Envio HyperSync proxy, Alchemy RPC and price API (website defaults)",
          "role": "indexer",
          "public": false,
          "license": "proprietary",
          "operator": "Envio; Alchemy",
          "required": false
        },
        {
          "name": "Google Analytics and Sentry (website)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Google; Sentry",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/src/contracts/PrivacyPool.sol#L43-L61",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/contracts/src/contracts/PrivacyPool.sol",
              "detail": "withdraw() requires the proof's ASP root to equal ENTRYPOINT.latestRoot() (L59); Entrypoint.updateRoot (Entrypoint.sol L93-L104) is onlyRole(ASP_POSTMAN), so the postman decides which deposit labels can be withdrawn privately. windDownPool (L256-L261, OWNER_ROLE) permanently stops deposits; ragequit (PrivacyPool.sol L132-L150) stays open to the original depositor.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x1f4Fe25Cf802a0605229e0Dc497aAf653E86E187",
              "address": "0x1f4Fe25Cf802a0605229e0Dc497aAf653E86E187",
              "eoa": true,
              "block_number": 26153374,
              "detail": "Entrypoint.hasRole(ASP_POSTMAN, 0x1f4F…E187) returns true at block 26153374; the address has no code (an EOA) and sent the latest updateRoot tx 0x6298b96d…ec83. RoleGranted logs show the postman role granted to this EOA and to the owner Safe only; the EOA's OWNER_ROLE was revoked at block 22169228.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x6818809EefCe719E480a7526D76bD3e561526b46 \"hasRole(bytes32,address)(bool)\" 0xfc84ade01695dae2ade01aa4226dc40bdceaf9d5dbd3bf8630b1dd5af195bbc5 0x1f4Fe25Cf802a0605229e0Dc497aAf653E86E187 --rpc-url https://ethereum-rpc.publicnode.com"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x6818809EefCe719E480a7526D76bD3e561526b46",
              "address": "0x6818809EefCe719E480a7526D76bD3e561526b46",
              "block_number": 26153374,
              "detail": "Entrypoint.hasRole(ASP_POSTMAN, 0x1f4F…E187) = true at block 26153374 (raw word 1).",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x91d14854fc84ade01695dae2ade01aa4226dc40bdceaf9d5dbd3bf8630b1dd5af195bbc50000000000000000000000001f4fe25cf802a0605229e0dc497aaf653e86e187",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xAd7f9A19E2598b6eFE0A25C84FB1c87F81eB7159",
              "address": "0xAd7f9A19E2598b6eFE0A25C84FB1c87F81eB7159",
              "block_number": 26153374,
              "detail": "OWNER_ROLE (windDownPool, registerPool, removePool, upgrade) is held by Safe 0xAd7f…7159 (v1.4.1), threshold 2 of 4 owners, no modules (getModulesPaginated empty), guard slot zero, no timelock; one owner is an EIP-7702-delegated account.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000002"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Two roles can stop or block settlement. The ASP postman, a single EOA, posts the association root; a deposit whose label is not in the latest root cannot be withdrawn privately, so the postman can exclude individual deposits without notice. Its only remaining exit is ragequit, which returns funds to the original depositor, not to a payee. OWNER_ROLE, held by a 2-of-4 Safe with no modules, guard or timelock, can wind down a pool (stopping deposits) and upgrade the Entrypoint. Scored 0: an EOA holds a role that can target individual deposits. The 0xbow terms describe this screening (see C4).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/src/contracts/Entrypoint.sol#L110-L176",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/contracts/src/contracts/Entrypoint.sol",
              "detail": "deposit() and relay() on the Entrypoint have no caller restriction; relay pays RelayData.recipient and feeRecipient with a fee capped by maxRelayFeeBPS, so a user can relay their own withdrawal with fee 0. PrivacyPool.withdraw (PrivacyPool.sol L110-L129) can also be called directly with processooor = msg.sender.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB",
              "address": "0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB",
              "block_number": 26153374,
              "detail": "The ETH pool's ENTRYPOINT() is 0x6818…6b46 and dead() is false at block 26153374; its Sourcify source matches PrivacyPool.sol at d494b63e apart from a trailing newline.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB \"ENTRYPOINT()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0xe8eb3cc6",
                "expect": "0x0000000000000000000000006818809eefce719e480a7526d76bd3e561526b46"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer deposits and a note holder withdraws by calling public contracts, with no 0xbow API or relayer; addresses and ABIs are in the repo and SDK. But a private withdrawal to a payee succeeds only if 0xbow's ASP has already put the deposit's label in the latest root. Without that, the only direct path is ragequit back to the depositor. Judgment call: 1 (partial). The refund path is fully direct, and the payout path is a direct call that depends on a prior provider approval, which C2 treats like a provider signature.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/layers/asp.md#L5-L21",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "docs/docs/layers/asp.md",
              "detail": "The ASP \"controls which deposits can be privately withdrawn\" and interacts with the Entrypoint via authorized postmen; no ASP service code exists in github.com/0xbow-io (8 repos listed).",
              "checked_at": "2026-10-09",
              "recheck": "gh repo list 0xbow-io --limit 50 --json name,description",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/relayer/README.md#L1-L53",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/relayer/README.md",
              "detail": "The relayer is public with self-host steps (env vars, Docker); relaying is optional because Entrypoint.relay is permissionless.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Relayers are optional and their code is public, and the ASP tree data is on IPFS under the CID posted onchain. The ASP approval itself is a required, closed, single-vendor service: only 0xbow's postman can add a deposit to the root that withdrawals must prove against. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/toc.md#L51-L80",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "docs/docs/toc.md",
              "detail": "The terms say 0xbow checks whether a wallet is high-risk or on a sanctions list, that each deposit undergoes due diligence, that 0xbow may remove any address at any time, and that non-whitelisted users may withdraw only to their deposit address.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/src/contracts/PrivacyPool.sol#L55-L60",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/contracts/src/contracts/PrivacyPool.sol",
              "detail": "The pool enforces the screening result onchain by requiring the latest ASP root in every withdrawal proof.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Filtering sits in the settlement contracts by design: the pool accepts a private withdrawal only for deposits the ASP has approved. It is disclosed in the versioned terms and ASP docs, but the screening criteria and data vendors are not named, and the private path cannot bypass it; only ragequit (to the depositor) does. Judgment call: anchor 0 is for filtering in the contracts without disclosure, and this is disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-website/blob/7df411128f7a18a61a77f7a0371bf0b857969e2a/src/config/chainData.ts#L129-L160",
              "commit": "7df411128f7a18a61a77f7a0371bf0b857969e2a",
              "path": "src/config/chainData.ts",
              "detail": "Each pool is enumerated with chain, pool address, asset address, scope and deployment block; the Entrypoint's PoolRegistered events list the same 14 mainnet pools.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-website/contents/src/config/chainData.ts?ref=7df411128f7a18a61a77f7a0371bf0b857969e2a\" --jq .content | base64 -d | sed -n 129,160p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xb419c2867aB3CBc78921660cB95150d95A94ce86",
              "address": "0xb419c2867aB3CBc78921660cB95150d95A94ce86",
              "block_number": 26153426,
              "detail": "USDC isBlacklisted() is false for the USDC pool and the Entrypoint, and USDT isBlackListed() is false for the USDT pool and the Entrypoint, at block 26153426; both issuers can blacklist.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Tokens and pools are enumerated in code and onchain. We found no statement in the repos or terms that USDC and USDT can freeze a pool or the Entrypoint, which would lock every deposit in that pool. Ethereum L1 has no sequencer. Scored 2: enumerated in code, assumptions not stated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x15e355024de1CDc74ADdea7EBDf98418Ba5B1a2c",
              "address": "0x15e355024de1CDc74ADdea7EBDf98418Ba5B1a2c",
              "block_number": 26153374,
              "detail": "Sourcify returns match (partial) for the Entrypoint proxy and implementation, the ETH, USDC and USDT pools and both verifiers; the implementation slot of the proxy reads 0x15e3…1a2c at block 26153374.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0x6818809EefCe719E480a7526D76bD3e561526b46 0x15e355024de1CDc74ADdea7EBDf98418Ba5B1a2c 0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB 0xb419c2867aB3CBc78921660cB95150d95A94ce86 0xe859C0bD25f260BaEE534Fb52e307D3b64D24572; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/1/$a | jq -r .match; done",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x00000000000000000000000015e355024de1cdc74addea7ebdf98418ba5b1a2c"
              },
              "drift": true
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/foundry.toml#L11-L17",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/contracts/foundry.toml",
              "detail": "The Foundry profile pins solc 0.8.28 with bytecode_hash none and cbor_metadata false, which is why Sourcify can only give a partial match; deploy scripts are in packages/contracts/script.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every settlement contract in scope is verified on Sourcify as a partial match, and the Sourcify sources equal the repo files at d494b63e and at the audited commits apart from a trailing newline. We did not rebuild the bytecode. Scored 2: partial match.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/tree/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages",
              "detail": "The core repo holds circuits, contracts with deploy scripts, the relayer and the SDK; privacy-pools-website holds the frontend.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-core/contents/packages?ref=d494b63e79f33bb2b0c8ece6cdacdca465c3b884\" --jq '.[].name'"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-website/blob/7df411128f7a18a61a77f7a0371bf0b857969e2a/src/utils/aspClient.ts#L137-L180",
              "commit": "7df411128f7a18a61a77f7a0371bf0b857969e2a",
              "path": "src/utils/aspClient.ts",
              "detail": "The closed ASP API's public endpoints (pool-info, events, mt-roots, mt-leaves, statistics) and their response types are defined in the website client.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Contracts, circuits, SDK, relayer, deploy scripts and frontend are public. The ASP backend (screening and root posting) and the ASP API are closed. Judgment call: the API has no published schema document, but its endpoints and response types are committed in the frontend client, which we accept as the schema for 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/README.md#L131-L193",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/contracts/README.md",
              "detail": "Build and deploy steps (env setup, keystore import, forge scripts) are documented; the relayer README covers self-hosting and the website README covers pnpm install and env config.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Build and deploy documentation exists for contracts, relayer and website. A self-hosted deployment would still need its own ASP, for which no code is published. Reproduction not attempted, so capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/src/interfaces/IPrivacyPool.sol#L39-L64",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/contracts/src/interfaces/IPrivacyPool.sol",
              "detail": "Event schemas (Deposited, Withdrawn, Ragequit, PoolDied) are in the interfaces, and ABIs for the Entrypoint and pool are in packages/sdk/src/abi.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-core/contents/packages/sdk/src/abi?ref=d494b63e79f33bb2b0c8ece6cdacdca465c3b884\" --jq '.[].name'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ABIs and event schemas are in the repo, and the ASP API's shape is in the frontend client (see O2). We found no payee export in a non-proprietary format; account state is rebuilt from the user's mnemonic and chain data. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/LICENSE",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "LICENSE",
              "detail": "privacy-pools-core (contracts, circuits, SDK, relayer) is Apache-2.0.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-website/blob/7df411128f7a18a61a77f7a0371bf0b857969e2a/LICENSE.md",
              "commit": "7df411128f7a18a61a77f7a0371bf0b857969e2a",
              "path": "LICENSE.md",
              "detail": "The website is licensed CC BY-NC 4.0 (\"You may not use the material for commercial purposes without explicit permission\"), although its package.json says MIT.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The contracts, circuits, SDK and relayer are Apache-2.0. The ASP service, which a private withdrawal requires, is closed, so F1 is 0 by rule. The website is non-commercial CC BY-NC 4.0, which is not an OSI licence; it is not required.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/4e6a7d2d3f73906d83f23219f773f57812a5cefb/LICENSE",
              "commit": "4e6a7d2d3f73906d83f23219f773f57812a5cefb",
              "path": "LICENSE",
              "detail": "The root LICENSE was MIT (Wonderland, 2024) at the initial commit and was replaced with Apache-2.0 in 6ae88dbe (2025-02-17); packages/contracts/LICENSE changed MIT to Apache-2.0 in 3efc7e7b (2025-02-18). There is no CLA or CONTRIBUTING file in the repo.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-core/commits?path=LICENSE&sha=d494b63e79f33bb2b0c8ece6cdacdca465c3b884\" --jq '.[].sha'",
              "drift": true
            }
          ],
          "finding": "No CLA and no licence-stability commitment. The core repo was relicensed from MIT to Apache-2.0 before mainnet launch, both permissive. Judgment call: the anchor names any prior relicense event as 0; this one did not restrict users, but we follow the anchor and take the lower score.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/layers/asp.md#L5-L21",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "docs/docs/layers/asp.md",
              "detail": "The docs state that withdrawals require a valid ASP root and that the ASP provides inclusion data; no ASP implementation is published.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The pools, SDK and circuits run without proprietary code, but private withdrawal needs an ASP, and only 0xbow's closed one exists for this deployment. A fork could deploy its own Entrypoint with its own postman, but would have to write the ASP. Scored 1: documented that production needs a hosted service with no open alternative.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-website/blob/7df411128f7a18a61a77f7a0371bf0b857969e2a/src/app/layout.tsx#L27",
              "commit": "7df411128f7a18a61a77f7a0371bf0b857969e2a",
              "path": "src/app/layout.tsx",
              "detail": "The root layout always mounts GoogleAnalytics with NEXT_PUBLIC_GA_ID or the hardcoded fallback G-D177C1SMBP; src/instrumentation-client.ts L5-L18 initialises Sentry with default integrations off and a sanitising beforeSend; package.json also lists @vercel/analytics.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/privacy-policy.md#L39",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "docs/docs/privacy-policy.md",
              "detail": "The privacy policy discloses automated collection of device IP address, device identifiers and usage patterns.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK has no analytics. The website loads Google Analytics on every page by default, and Sentry error reporting, sanitised and with tracing and replay off. The privacy policy discloses automated collection. Scored 1: present, on by default, disclosed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/privacy-policy.md#L19-L33",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "docs/docs/privacy-policy.md",
              "detail": "The policy lists name, email, phone, location, device data and AML/CFT due-diligence information as data 0xbow may collect, and uses device data for product analytics and marketing.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/src/contracts/Entrypoint.sol#L110-L126",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/contracts/src/contracts/Entrypoint.sol",
              "detail": "Onchain, deposit takes only asset, value and a precommitment.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The protocol needs only settlement data, and the ASP screens the public deposit address. The website and 0xbow collect more (analytics, device data, marketing), disclosed only in the privacy policy, which does not limit collection to a legal requirement. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/src/interfaces/IPrivacyPool.sol#L39-L59",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/contracts/src/interfaces/IPrivacyPool.sol",
              "detail": "Deposited emits depositor, commitment, label, value and precommitment hash; Withdrawn emits processooor, value, spent nullifier and new commitment; the proof hides which commitment the nullifier spends.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-core/contents/packages/contracts/src/interfaces/IPrivacyPool.sol?ref=d494b63e79f33bb2b0c8ece6cdacdca465c3b884\" --jq .content | base64 -d | sed -n 39,59p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The chain shows who deposited and how much, and who received and how much, but not which deposit funded which withdrawal. There is no memo or invoice field. Amounts are arbitrary, not fixed denominations, so an unusual amount withdrawn in full can be matched to its deposit; partial withdrawals and round amounts reduce that. The ASP sees nothing beyond the chain. Judgment call: amount matching depends on user choices and is noted here, not scored; on what the code reveals, 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-website/blob/7df411128f7a18a61a77f7a0371bf0b857969e2a/src/config/chainData.ts#L129-L142",
              "commit": "7df411128f7a18a61a77f7a0371bf0b857969e2a",
              "path": "src/config/chainData.ts",
              "detail": "Mainnet defaults are relayers fastrelay.xyz and api.clkd.xyz, an Alchemy RPC, an Envio HyperSync proxy for events, and the ASP URL from NEXT_PUBLIC_ASP_ENDPOINT_NON_TEST (src/config/env.ts L40-L49).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-website/contents/src/config/chainData.ts?ref=7df411128f7a18a61a77f7a0371bf0b857969e2a\" --jq .content | base64 -d | sed -n 129,142p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "In the website flow, 0xbow's ASP API, Envio, Alchemy (RPC and prices), a third-party relayer and Google Analytics see requests. All are named in code; the RPC is user-configurable, the ASP and HyperSync endpoints are env-configurable, and relayers are a choice. On the SDK path only the user's RPC and an IPFS gateway are needed. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-website/blob/7df411128f7a18a61a77f7a0371bf0b857969e2a/src/containers/Modals/CustomRpc/CustomRpc.tsx#L391-L405",
              "commit": "7df411128f7a18a61a77f7a0371bf0b857969e2a",
              "path": "src/containers/Modals/CustomRpc/CustomRpc.tsx",
              "detail": "The website has a per-chain custom RPC field; the ASP and HyperSync URLs come from env at build time; the SDK takes rpcUrl in its config (packages/sdk/src/core/data.service.ts).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-website/contents/src/containers/Modals/CustomRpc/CustomRpc.tsx?ref=7df411128f7a18a61a77f7a0371bf0b857969e2a\" --jq .content | base64 -d | sed -n 391,405p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The RPC is configurable in the UI and SDK. The indexer (ASP API) is configurable only via env, and its code is not public. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/src/contracts/PrivacyPool.sol#L110-L150",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "packages/contracts/src/contracts/PrivacyPool.sol",
              "detail": "Pool funds leave only through withdraw (to the processooor bound into the proof context) or ragequit (to the original depositor); no admin function moves pool funds. Relayed withdrawals pass through the Entrypoint, which forwards to RelayData.recipient.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xe859C0bD25f260BaEE534Fb52e307D3b64D24572",
              "address": "0xe859C0bD25f260BaEE534Fb52e307D3b64D24572",
              "block_number": 26153374,
              "detail": "The USDT pool's EIP-1967 implementation slot is zero (not a proxy) and ENTRYPOINT is an immutable; the ETH and USDC pools read the same.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Funds sit in non-upgradeable pools that no role can sweep, so 0xbow cannot redirect them. But release to anyone other than the depositor depends on the ASP postman (an EOA, no timelock), and relayed withdrawals and ERC20 deposits pass through the upgradeable Entrypoint. Judgment call: anchor 2 needs the provider role over release to sit behind a timelock, which it does not, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x6818809EefCe719E480a7526D76bD3e561526b46",
              "address": "0x6818809EefCe719E480a7526D76bD3e561526b46",
              "block_number": 26153374,
              "detail": "Entrypoint is a UUPS proxy; _authorizeUpgrade is onlyRole(OWNER_ROLE) (Entrypoint.sol L308). hasRole(OWNER_ROLE, Safe 0xAd7f…7159) = true; Upgraded events show implementations 0xdd8a…d4c1 (block 22153713) then 0x15e3…1a2c (block 22540812).",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x6818809EefCe719E480a7526D76bD3e561526b46 \"hasRole(bytes32,address)(bool)\" 0xb19546dff01e856fb3f010c267a7b1c60363cf8a4664e21cc89c26224620214e 0xAd7f9A19E2598b6eFE0A25C84FB1c87F81eB7159 --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x91d14854b19546dff01e856fb3f010c267a7b1c60363cf8a4664e21cc89c26224620214e000000000000000000000000ad7f9a19e2598b6efe0a25c84fb1c87f81eb7159",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xAd7f9A19E2598b6eFE0A25C84FB1c87F81eB7159",
              "address": "0xAd7f9A19E2598b6eFE0A25C84FB1c87F81eB7159",
              "block_number": 26153374,
              "detail": "The owner Safe has threshold 2 of 4, getModulesPaginated(0x1,10) returns no modules, and the guard slot is zero; there is no timelock.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The pools and verifiers cannot be upgraded. The Entrypoint, through which every deposit and relayed withdrawal passes and which supplies the ASP root the pools check, is upgradeable by a 2-of-4 Safe with no timelock; it was upgraded once in May 2025. A malicious upgrade could not take funds already in the pools, but could stop withdrawals except ragequit, redirect relayed withdrawals, or pull tokens users have approved to it. Signers are not disclosed. Scored 1: multisig admin, no timelock.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-website/blob/7df411128f7a18a61a77f7a0371bf0b857969e2a/src/hooks/useDeposit.ts#L489-L505",
              "commit": "7df411128f7a18a61a77f7a0371bf0b857969e2a",
              "path": "src/hooks/useDeposit.ts",
              "detail": "The website approves exactly the deposit value to the Entrypoint, zeroing a partial allowance first; the SDK's approveERC20 (packages/sdk/src/core/contracts.service.ts L378-L398) approves the amount the caller passes.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-website/contents/src/hooks/useDeposit.ts?ref=7df411128f7a18a61a77f7a0371bf0b857969e2a\" --jq .content | base64 -d | sed -n 489,505p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ERC20 deposits approve the exact amount, so the code meets anchor 3. Judgment call: the frontend is not a distributed package and we ran no trace, so we cap at 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB",
              "address": "0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB",
              "block_number": 26153374,
              "detail": "The ETH pool is not a proxy (implementation slot zero) and its ragequit (PrivacyPool.sol L132-L150) checks only the depositor and a ragequit proof, not the Entrypoint or ASP.",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=1, C2=1, C3=0, O3=1. If 0xbow disappears, the latest root stays in place: deposits already in it can still be withdrawn privately, and every depositor can ragequit directly from the immutable pool, with no 0xbow service. New deposits could no longer be approved, so private settlement stops. A payee holding a note for an unapproved deposit cannot recover it; only the depositor can. Scored 2: funds retrievable through a verified direct path; settlement stops.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-website/blob/7df411128f7a18a61a77f7a0371bf0b857969e2a/src/config/env.ts#L3-L29",
              "commit": "7df411128f7a18a61a77f7a0371bf0b857969e2a",
              "path": "src/config/env.ts",
              "detail": "NEXT_PUBLIC_ALCHEMY_KEY ships to the browser in RPC URLs; HYPERSYNC_KEY and ASP_API_JWT are server-only (getServerEnv) and used by the /api/hypersync-rpc proxy.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-website/contents/src/config/env.ts?ref=7df411128f7a18a61a77f7a0371bf0b857969e2a\" --jq .content | base64 -d | sed -n 3,29p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Account secrets come from a mnemonic generated and kept client-side. There are no webhooks or merchant API keys. The website bundles an Alchemy RPC key, which grants only RPC quota, and keeps the HyperSync and ASP keys server-side. Judgment call: 2 for the bundled RPC key.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/audit/contracts_audit_oxorio.md#L39-L49",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "audit/contracts_audit_oxorio.md",
              "detail": "Oxorio's contracts audit pins initial commit 2d4627ba and final commit 532eaa8e and links fix commits per finding (e.g. 016a949f, L213); entrypoint_upgrade_audit_oxorio.md pins 238e3594; circuits and Auditware reports sit in the same folder.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/0xbow-io/privacy-pools-core/contents/packages/contracts/src/contracts/Entrypoint.sol?ref=238e3594053becde68aa40e1e4cef6c0c46e68da\" --jq .content | base64 -d | diff - <(curl -s \"https://sourcify.dev/server/v2/contract/1/0x15e355024de1CDc74ADdea7EBDf98418Ba5B1a2c?fields=sources\" | jq -r '.sources[\"src/contracts/Entrypoint.sol\"].content')",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/SECURITY.md#L5-L18",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "path": "SECURITY.md",
              "detail": "Vulnerability reports go to security@0xbow.io, with a bounty offered \"in case it applies\"; no bounty scope or programme is published.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The deployed Entrypoint implementation equals Entrypoint.sol at the audited commit 238e3594, and the pool sources equal the files at the audited final commit 532eaa8e, apart from a trailing newline. Oxorio links fix commits for its findings. There is no live bounty programme with scope, so not 3. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "blocklist",
        "countries": [
          "CU",
          "KP",
          "IR",
          "SY"
        ],
        "note": "The 0xbow terms bar Cuba, North Korea, Iran, Syria and the Russian-occupied regions of Crimea, Donetsk and Luhansk (in UA, not listed as a whole country), and say the list may change. The contracts have no geographic check, so anyone can deposit and ragequit, but private withdrawal depends on passing 0xbow's ASP screening, which the terms say may exclude sanctioned or high-risk addresses. We did not inspect the hosted site for an IP geoblock.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/toc.md#L95-L112",
            "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
            "path": "docs/docs/toc.md",
            "detail": "Eligibility section 3.A.4 names the restricted jurisdictions (Cuba, DPRK, Iran, Syria, Crimea, Donetsk, Luhansk).",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: Ethereum Entrypoint 0x6818…6b46 with the ETH, USDC and USDT pools; 11 further mainnet pools (USDS, sUSDS, DAI, wstETH, WBTC, USDe, USD1, frxUSD, wOETH, fxUSD, BOLD) use the same contracts and are not scored separately. Reads at block 26153374 via publicnode (blacklist reads at 26153426); event history via rpc.mevblocker.io, which served full-range eth_getLogs. The deployments doc lists implementation 0xdd8a…d4c1, superseded by 0x15e3…1a2c in May 2025. The latest ASP tree (CID bafybeibshlh…fb3a) was retrievable from public IPFS gateways. No transactions, UI runs, traces or self-host attempts.",
      "audits": {
        "searched": "The audit/ folder of github.com/0xbow-io/privacy-pools-core (four reports) and its SECURITY.md, the 0xbow-io GitHub organisation, the privacy-pools-website repo, and web searches for further reports. Launch coverage names Audit Wizard, Auditware's product, which matches the Auditware report below. Oxorio's entrypoint-upgrade report is the audit of the May 2025 fix that followed the deposit-pause incident.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Oxorio",
            "date": "2025-05-20",
            "type": "audit",
            "scope": "Entrypoint upgrade adding used-precommitment tracking (the Entrypoint implementation deployed in May 2025).",
            "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/audit/entrypoint_upgrade_audit_oxorio.md",
            "commit": "238e3594053becde68aa40e1e4cef6c0c46e68da",
            "repo": "https://github.com/0xbow-io/privacy-pools-core",
            "covers_deployed": "yes",
            "findings": "No critical or major; 1 warning and 1 info, both acknowledged",
            "note": "S6 shows the deployed Entrypoint implementation 0x15e3…1a2c equals Entrypoint.sol at this commit."
          },
          {
            "auditor": "Oxorio",
            "date": "2025-03-18",
            "type": "audit",
            "scope": "Entrypoint, PrivacyPool, State and the simple and complex pool implementations.",
            "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/audit/contracts_audit_oxorio.md",
            "commit": "532eaa8ed151f06697249d400926d17adf442d8e",
            "repo": "https://github.com/0xbow-io/privacy-pools-core",
            "covers_deployed": "partly",
            "findings": "No critical; 2 major (1 fixed, 1 acknowledged); warnings and info fixed, acknowledged or marked no issue",
            "note": "Initial commit 2d4627ba, final 532eaa8e. The deployed pools match the final commit (S6); the Entrypoint it reviewed was replaced in May 2025 by the version in the upgrade audit."
          },
          {
            "auditor": "Auditware",
            "date": "2025-03",
            "type": "review",
            "scope": "Entrypoint, PrivacyPool, State, pool implementations, Constants and ProofLib.",
            "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/audit/contracts_audit_auditware.md",
            "commit": "f0b8fe5e7b91b942523e8af671c59c3a4c75f612",
            "repo": "https://github.com/0xbow-io/privacy-pools-core",
            "covers_deployed": "partly",
            "findings": "3 medium (mitigated, partially mitigated, acknowledged), 3 low; no critical",
            "note": "The report is undated; it was added to the repo on 2025-03-19 and the audited commit is from 2025-02-14. It links that commit in a defi-wonderland fork that no longer resolves; the commit exists in 0xbow-io/privacy-pools-core. The contracts changed afterwards with Oxorio's fixes."
          },
          {
            "auditor": "Oxorio",
            "date": "2025-02-21",
            "type": "audit",
            "scope": "Withdrawal, commitment and Merkle tree circuits (circom).",
            "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/audit/circuits_audit_oxorio.md",
            "commit": "8da36d5e2150ab3c567d85ca8a6b2eb6b51740cb",
            "repo": "https://github.com/0xbow-io/privacy-pools-core",
            "covers_deployed": "unknown",
            "findings": "No critical or major; warnings and info fixed, acknowledged or marked no issue",
            "note": "The circuit sources are unchanged between the audited final commit and the assessed commit d494b63e, and the verifiers were generated in March 2025 after the trusted setup; we did not check that the deployed verifier keys derive from these circuits."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2"
          ]
        },
        "P": {
          "score": 1,
          "limiting": [
            "P1",
            "P2"
          ]
        },
        "S": {
          "score": 1,
          "limiting": [
            "S1",
            "S2"
          ]
        }
      },
      "tally": {
        "holds": 10,
        "short": 11,
        "unk": 2,
        "total": 23
      }
    },
    {
      "slug": "railgun",
      "name": "Railgun",
      "type": "transfer",
      "website": "https://railgun.org",
      "primary_chain": {
        "name": "Ethereum",
        "chain_id": 1,
        "basis": "The deployments repo (Railgun-Community/deployments@68d93979 src/chains/ethereum.ts L1-L60) is the only chain with the governance stack (Delegator, Voting, Staking, ProxyAdmin) and empty L1Sender/L2Executor, so Ethereum governs the protocol; shared-models network-config.ts lists Ethereum first. Unit: RailgunSmartWallet proxy 0xFA70…a4b9 and its implementation, with the ProxyAdmin, Delegator and Voting contracts that control it. Excluded: the BSC, Polygon and Arbitrum deployments, the V3 contracts (supportsV3 false on Ethereum), RelayAdapt, and the RAIL token and treasury."
      },
      "repos": [
        {
          "url": "https://github.com/Railgun-Privacy/contract",
          "role": "contracts",
          "license": "none"
        },
        {
          "url": "https://github.com/Railgun-Privacy/circuits-v2",
          "role": "contracts",
          "license": "none"
        },
        {
          "url": "https://github.com/Railgun-Community/engine",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/Railgun-Community/wallet",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/Railgun-Community/shared-models",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/Railgun-Community/deployments",
          "role": "deploy",
          "license": "none"
        },
        {
          "url": "https://github.com/Railgun-Community/waku-broadcaster-client",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/Railgun-Community/private-proof-of-innocence",
          "role": "backend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/Railgun-Community/subsquid-integration",
          "role": "indexer",
          "license": "MIT"
        },
        {
          "url": "https://github.com/Railway-Wallet/Railway-Wallet",
          "role": "frontend",
          "license": "AGPL-3.0"
        }
      ],
      "contracts": [
        {
          "address": "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
          "chain_id": 1,
          "role": "RailgunSmartWallet proxy (PausableUpgradableProxy)",
          "verified": "sourcify"
        },
        {
          "address": "0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C",
          "chain_id": 1,
          "role": "RailgunSmartWallet implementation",
          "verified": "sourcify"
        },
        {
          "address": "0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8",
          "chain_id": 1,
          "role": "ProxyAdmin (upgrade and pause)",
          "verified": "sourcify"
        },
        {
          "address": "0xB6d513f6222Ee92Fff975E901bd792E2513fB53B",
          "chain_id": 1,
          "role": "Delegator (governance executor)",
          "verified": "sourcify"
        },
        {
          "address": "0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC",
          "chain_id": 1,
          "role": "Voting (RAIL governance)",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "RailgunSmartWallet proxy and implementation",
          "role": "contracts",
          "public": true,
          "license": "none",
          "operator": "RAIL governance (upgrade and pause via ProxyAdmin)",
          "required": true,
          "repo": "https://github.com/Railgun-Privacy/contract"
        },
        {
          "name": "Circuits and proving artifacts (IPFS, circuits-v2)",
          "role": "other",
          "public": true,
          "license": "none",
          "operator": "none (static artifacts)",
          "required": true,
          "repo": "https://github.com/Railgun-Privacy/circuits-v2"
        },
        {
          "name": "RAILGUN engine, wallet and shared-models SDK (npm @railgun-community)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/Railgun-Community/wallet"
        },
        {
          "name": "Ethereum mainnet and a JSON-RPC endpoint of the user's choice",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Ethereum validators; RPC chosen by the user",
          "required": true,
          "repo": "https://github.com/ethereum/go-ethereum"
        },
        {
          "name": "Governance (Voting, Delegator, ProxyAdmin, VKeySetters)",
          "role": "contracts",
          "public": true,
          "license": "none",
          "operator": "RAIL stakers",
          "required": false,
          "repo": "https://github.com/Railgun-Privacy/contract"
        },
        {
          "name": "Broadcasters over Waku (waku-broadcaster-client)",
          "role": "relayer",
          "public": true,
          "license": "MIT",
          "operator": "independent broadcaster operators",
          "required": false,
          "repo": "https://github.com/Railgun-Community/waku-broadcaster-client"
        },
        {
          "name": "Hosted Subsquid indexer (rail-squid.squids.live, SDK default)",
          "role": "indexer",
          "public": true,
          "license": "MIT",
          "operator": "unknown (Subsquid Cloud deployment)",
          "required": false,
          "repo": "https://github.com/Railgun-Community/subsquid-integration"
        },
        {
          "name": "IPFS gateway ipfs-lb.com (SDK default for artifacts)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "unknown",
          "required": false
        },
        {
          "name": "Private Proof of Innocence aggregator (ppoi.fdi.network, Railway default)",
          "role": "backend",
          "public": true,
          "license": "MIT",
          "operator": "unknown",
          "required": false,
          "repo": "https://github.com/Railgun-Community/private-proof-of-innocence"
        },
        {
          "name": "Railway Wallet (desktop and mobile)",
          "role": "frontend",
          "public": true,
          "license": "AGPL-3.0",
          "operator": "Right to Privacy Foundation",
          "required": false,
          "repo": "https://github.com/Railway-Wallet/Railway-Wallet"
        },
        {
          "name": "Railway remote config and price APIs (CoinGecko, CoinPaprika, DefiLlama)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Right to Privacy Foundation; price vendors",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/proxy/Proxy.sol#L140-L187",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "contracts/proxy/Proxy.sol",
              "detail": "The proxy admin can upgrade, pause and unpause; while paused every call reverts (notPaused, L49-L53), including unshield. The implementation also has an owner-only TokenBlocklist (blocks tokens from being shielded, not addresses) and fee setters.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "address": "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "block_number": 26153471,
              "detail": "Proxy admin slot = ProxyAdmin 0x4F8E…65c8, whose owner() is Delegator 0xB6d5…B53B, whose owner() is Voting 0xc480…A3CC; the paused slot 0x8dea…1450 reads 0 (not paused).",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103 --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x0000000000000000000000004f8e20f55f879bee7bc010bd6bd2138b34ac65c8"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xB6d513f6222Ee92Fff975E901bd792E2513fB53B",
              "address": "0xB6d513f6222Ee92Fff975E901bd792E2513fB53B",
              "block_number": 26153471,
              "detail": "GrantPermission logs show pause/unpause on the ProxyAdmin granted at block 12977000 to EOAs 0x0219…873D, 0x17cF…De86 and 0xCC29…164a; checkPermission returns false for all three at block 26153471. Two VKeySetter contracts hold setVerificationKey permission, but can commit keys only after governance moves them to the COMMITTING state (VkeySetter.sol stateToCommitting is onlyDelegator).",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x8ad2f2890000000000000000000000000219b4c1adcec8f4206b528832f66ab76766873d0000000000000000000000004f8e20f55f879bee7bc010bd6bd2138b34ac65c876a67a5100000000000000000000000000000000000000000000000000000000",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC",
              "address": "0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC",
              "block_number": 26153471,
              "detail": "Voting.EXECUTION_START_OFFSET = 604800 s (7 days after a vote is called; voting starts after 2 days), quorum 2M RAIL, sponsor threshold 500k RAIL (Voting.sol L16-L26); 33 proposals at this block.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x9f31490d",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000093a80"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Pause, upgrade and token blocklisting sit with RAIL token governance: ProxyAdmin is owned by the Delegator, which is owned by the Voting contract, and no other address holds pause permission today (three EOA pausers granted in 2021 were revoked). A pause takes at least 7 days from the vote being called, and a pause would also stop unshielding. Nothing in the contracts blocks individual addresses. Judgment call: anchor 2 is written for a Safe; we treat public onchain token voting with a 7-day minimum execution delay as meeting it, since user exit (unshield) is immediate. No notice channel beyond the onchain proposal is named in the repo.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/logic/RailgunSmartWallet.sol#L21-L208",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "contracts/logic/RailgunSmartWallet.sol",
              "detail": "shield() and transact() (private transfer and unshield) are external with no caller check; validity rests on the token blocklist, commitment preimage checks and the SNARK proof.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/deployments/blob/68d93979600d93b46200c2c4c6a006a4d80e38a1/src/chains/ethereum.ts#L20-L39",
              "commit": "68d93979600d93b46200c2c4c6a006a4d80e38a1",
              "path": "src/chains/ethereum.ts",
              "detail": "Proxy and implementation addresses are published with ABIs in src/abi (implementation.ts, proxy.ts).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Community/deployments/contents/src/chains/ethereum.ts?ref=68d93979600d93b46200c2c4c6a006a4d80e38a1\" --jq .content | base64 -d | sed -n 20,39p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C",
              "address": "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "block_number": 26153471,
              "detail": "The proxy's implementation slot reads 0xD662…6A0C, whose Sourcify sources equal contracts/logic at 36bcf5ed apart from line endings.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x000000000000000000000000d662c4b1f22aceb0beacdf3a493de6f478686a0c"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer can shield, send privately to a payee's 0zk address and the payee can unshield by calling the proxy directly and self-signing; no broadcaster, API or provider signature is involved. Addresses and ABIs are published in the deployments repo. We did not run a transaction.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/engine/blob/6e2614d53a106dd62abad91e7ce03ee4a3956138/src/railgun-engine.ts#L719-L760",
              "commit": "6e2614d53a106dd62abad91e7ce03ee4a3956138",
              "path": "src/railgun-engine.ts",
              "detail": "After the optional quick sync, the engine slow-syncs commitments from the contract's events over the user's RPC (getHistoricalEvents), so the hosted indexer is not required.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Community/engine/contents/src/railgun-engine.ts?ref=6e2614d53a106dd62abad91e7ce03ee4a3956138\" --jq .content | base64 -d | sed -n 719,760p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/wallet/blob/5c9d04c844879b8377d91775052e88c836b48730/src/services/railgun/core/init.ts#L142-L182",
              "commit": "5c9d04c844879b8377d91775052e88c836b48730",
              "path": "src/services/railgun/core/init.ts",
              "detail": "startRailgunEngine takes poiNodeURLs as optional and initialises POI only if they are given; broadcasters are an optional transport (waku-broadcaster-client, MIT).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Settlement needs only the contracts, the SDK, the proving artifacts and an RPC. Broadcasters, the hosted Subsquid indexer and the POI aggregator are optional, and each has public code. Judgment call: self-signing without a broadcaster exposes the gas-paying address; that is a privacy cost (P3), not a settlement dependency, so 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/wallet/blob/5c9d04c844879b8377d91775052e88c836b48730/src/utils/blocked-address.ts#L6-L20",
              "commit": "5c9d04c844879b8377d91775052e88c836b48730",
              "path": "src/utils/blocked-address.ts",
              "detail": "The wallet SDK refuses recipients on OFAC_SANCTIONS_LIST_ADDRESSES (shared-models blocked-address.ts, 175 addresses, refreshed from Railgun-Community/ofac-scraper by update-ofac-list.cjs L12-L13); it is called in tx-generator.ts L200, L416, L456 and tx-shield.ts.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Community/wallet/contents/src/utils/blocked-address.ts?ref=5c9d04c844879b8377d91775052e88c836b48730\" --jq .content | base64 -d | sed -n 6,20p",
              "package": {
                "name": "@railgun-community/wallet",
                "version": "10.9.0",
                "integrity": "sha512-y2ncKCWkG3rWSYysBzXzPsTQvKMGE2lCFVwCgKjS3JnkZAHiKRYWjWrcMw1mSrFYmNjTO1/loYO4qALGz09cbg=="
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railway-Wallet/Railway-Wallet/blob/e9398a1ccf94ff016062592fc310a8a697d94f2b/desktop/src/react-shared/src/utils/poi.tsx#L37",
              "commit": "e9398a1ccf94ff016062592fc310a8a697d94f2b",
              "path": "desktop/src/react-shared/src/utils/poi.tsx",
              "detail": "Railway explains that Private Proofs of Innocence use the OFAC list published by Chainalysis, and that blocked shields can only be unshielded to origin.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C",
              "address": "0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C",
              "block_number": 26153471,
              "detail": "The deployed implementation's sources contain no address or country check; the only list is TokenBlocklist, keyed by token address.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "The settlement contracts are neutral toward addresses and countries. Edge filtering is in public code with named list sources (an OFAC list in the SDK; Chainalysis's OFAC list for Railway's POI), and the direct contract path bypasses both (C2 = 3). npm @railgun-community/wallet 10.9.0 has gitHead 5c9d04c8, the pinned commit. All required components are public. Noted: the SDK check lower-cases the address but the list holds checksummed addresses, so at this commit it never matches; the filter is disclosed but ineffective.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/logic/RailgunSmartWallet.sol#L59-L63",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "contracts/logic/RailgunSmartWallet.sol",
              "detail": "Any ERC20, ERC721 or ERC1155 token can be shielded unless governance has put it on the TokenBlocklist; there is no allowlist.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Chains are enumerated in shared-models, but tokens are an open set, and we found no statement in the repos or docs that issuer freezes (USDC, USDT) can lock the RAILGUN contract's balance of a token. Judgment call: an open token set cannot be enumerated, and the anchor names \"not enumerated\" as 0; we take the lower anchor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C",
              "address": "0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C",
              "block_number": 26153471,
              "detail": "Sourcify returns exact_match for the proxy, ProxyAdmin, Delegator and Voting, and match (partial) for the implementation 0xD662…6A0C (solc 0.8.17).",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9 0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C 0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/1/$a | jq -r .match; done"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/hardhat.config.ts#L18-L26",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "hardhat.config.ts",
              "detail": "The Hardhat config pins solc 0.8.17 with optimizer runs 200; deploy tasks are in tasks/ and scripts/.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "All in-scope contracts are verified on Sourcify; the implementation, which holds the logic, is a partial match. No rebuild attempted. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/subsquid-integration/tree/49922b3aa644a7fcafcc55e7264c020065302f0a/abi",
              "commit": "49922b3aa644a7fcafcc55e7264c020065302f0a",
              "path": "abi",
              "detail": "Public repos cover contracts and deploy tasks, circuits, engine and wallet SDK, the Subsquid indexer, the POI node, the broadcaster client and the Railway frontend.",
              "checked_at": "2026-10-09",
              "recheck": "gh repo list Railgun-Community --limit 100 --json name,isArchived,pushedAt; gh repo list Railgun-Privacy --json name"
            }
          ],
          "finding": "Every layer has public source, and the repos are active. We could not tie the hosted Subsquid deployment, the ppoi.fdi.network aggregator, or broadcaster builds to public commits, and the broadcaster server is public only as an example (ppoi-safe-broadcaster-example). Judgment call: 2 rather than 3 for that reason.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/README.md#L1-L9",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "README.md",
              "detail": "The contracts README gives only install and Hardhat help steps; the SDK and Railway READMEs cover installation.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Minimal build documentation exists. Reproduction not attempted, so capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/logic/RailgunLogic.sol#L56-L82",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "contracts/logic/RailgunLogic.sol",
              "detail": "Event schemas (Action, Transact, Shield, Unshield, Nullified) are defined in the contract; ABIs are in the deployments repo (src/abi).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Community/deployments/contents/src/abi?ref=68d93979600d93b46200c2c4c6a006a4d80e38a1\" --jq '.[].name'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ABIs and event schemas are in the repos, and no API is required. We found no payee export in a non-proprietary format in the SDK; Railway and the docs point to viewing keys and a Koinly tax export, which we did not inspect. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/package.json#L5",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "package.json",
              "detail": "The contracts repo has no LICENSE file; package.json says \"UNLICENSED\" and 38 of 39 Solidity files carry SPDX UNLICENSED. A License.md added in 2021 (d2c63577) read \"No License is provided for any party under any circumstances\" and was removed in 77af7cf5 (2022).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/circuits-v2/blob/0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb/License.md",
              "commit": "0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb",
              "path": "License.md",
              "detail": "The circuits repo's License.md says \"No License is provided for any party under any circumstances.\"",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK repos are MIT and Railway is AGPL-3.0, but the settlement contracts and circuits, both required, carry no licence and explicitly grant none. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/engine/blob/6e2614d53a106dd62abad91e7ce03ee4a3956138/LICENSE",
              "commit": "6e2614d53a106dd62abad91e7ce03ee4a3956138",
              "path": "LICENSE",
              "detail": "Engine and wallet LICENSE files are MIT with no change since 2022-09-29; no CLA or CONTRIBUTING file exists in contract, engine, wallet or shared-models.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Community/engine/commits?path=LICENSE&sha=6e2614d53a106dd62abad91e7ce03ee4a3956138\" --jq '.[].sha'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No CLA, no relicensing event in the SDKs, and no licence-stability commitment. The contracts and circuits have never been licensed, which F1 records. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/wallet/blob/5c9d04c844879b8377d91775052e88c836b48730/src/services/artifacts/artifact-util.ts#L7",
              "commit": "5c9d04c844879b8377d91775052e88c836b48730",
              "path": "src/services/artifacts/artifact-util.ts",
              "detail": "Proving artifacts are fetched by IPFS hash through the gateway ipfs-lb.com unless the integrator supplies an artifact store; the engine needs only an RPC.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Community/wallet/contents/src/services/artifacts/artifact-util.ts?ref=5c9d04c844879b8377d91775052e88c836b48730\" --jq .content | base64 -d | sed -n 1,10p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No proprietary plugin or hosted-only service is needed: the artifacts are content-addressed on IPFS and the indexer, POI node and broadcasters are optional. Judgment call: the code supports 3, but with no O3 reproduction we take 2. The contracts and circuits being unlicensed is scored under F1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railway-Wallet/Railway-Wallet/blob/e9398a1ccf94ff016062592fc310a8a697d94f2b/desktop/src/views/screens/pages/app-protect-view/AppProtectView.tsx#L58-L80",
              "commit": "e9398a1ccf94ff016062592fc310a8a697d94f2b",
              "path": "desktop/src/views/screens/pages/app-protect-view/AppProtectView.tsx",
              "detail": "Railway desktop loads @fingerprintjs/fingerprintjs (package.json L36, resolved 3.4.2) and uses the browser fingerprint visitorId as the AES key for the locally stored password hash.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/wallet/blob/5c9d04c844879b8377d91775052e88c836b48730/package.json",
              "commit": "5c9d04c844879b8377d91775052e88c836b48730",
              "path": "package.json",
              "detail": "The wallet, engine and shared-models manifests list no analytics, telemetry or error-reporting packages; Railway's mobile manifest has none either.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK ships no analytics or telemetry. Railway desktop includes a fingerprinting library; in the code we read it is used locally to derive an encryption key, and we saw no network send. Judgment call: the anchor names fingerprinting libraries as 0 regardless of use, so we take 0; on the SDK alone this cell would score higher.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/logic/Globals.sol#L21-L90",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "contracts/logic/Globals.sol",
              "detail": "A shield request carries a commitment preimage (npk, token, value) and an encrypted ciphertext; transactions carry proofs, nullifiers, commitments and encrypted ciphertexts. There is no account, identity or contact field.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Privacy/contract/contents/contracts/logic/Globals.sol?ref=36bcf5ed7cf94bfafb6e1a303e1832c769c16780\" --jq .content | base64 -d | sed -n 21,90p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The flow collects only what settlement needs; there is no sign-up, KYC or form. A broadcaster, if used, sees the transaction it relays and its fee; a POI node sees blinded commitments. Railway states it collects no logs, a claim we did not verify.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/logic/RailgunLogic.sol#L56-L82",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "contracts/logic/RailgunLogic.sol",
              "detail": "Shield emits commitment preimages (token, amount, note public key) and ciphertext; Transact emits only commitment hashes and ciphertext; Unshield emits recipient, token, amount and fee; Action emits the caller (gas payer or broadcaster).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Privacy/contract/contents/contracts/logic/RailgunLogic.sol?ref=36bcf5ed7cf94bfafb6e1a303e1832c769c16780\" --jq .content | base64 -d | sed -n 56,82p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Shielding is public (who, which token, how much) and unshielding is public (to whom, which token, how much), but a private transfer between 0zk addresses reveals no sender, recipient, token or amount onchain; ciphertexts are encrypted to the parties. Linkage can come from the shield/unshield amounts and timing, and from self-signing with a known gas address (the Action event names the caller). Judgment call: behavioural linkage is noted, not scored; on what the code reveals, 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/wallet/blob/5c9d04c844879b8377d91775052e88c836b48730/src/services/railgun/quick-sync/V2/graphql/index.ts#L3180-L3184",
              "commit": "5c9d04c844879b8377d91775052e88c836b48730",
              "path": "src/services/railgun/quick-sync/V2/graphql/index.ts",
              "detail": "The wallet SDK hardcodes the Subsquid endpoint rail-squid.squids.live for quick sync, and artifact-util.ts L7 hardcodes the ipfs-lb.com gateway; Railway adds price APIs (CoinGecko, CoinPaprika, DefiLlama), its remote config at railway.xyz and the POI aggregator ppoi.fdi.network.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Community/wallet/contents/src/services/railgun/quick-sync/V2/graphql/index.ts?ref=5c9d04c844879b8377d91775052e88c836b48730\" --jq .content | base64 -d | sed -n 3180,3184p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Beyond the RPC, the SDK's default path touches a hosted Subsquid indexer and an IPFS gateway, and Railway adds price, config and POI services. All are named in code. The indexer and gateway can be replaced only in code (engine init functions, artifact store); the RPC and POI node URLs are configurable. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railway-Wallet/Railway-Wallet/blob/e9398a1ccf94ff016062592fc310a8a697d94f2b/desktop/src/views/screens/modals/settings/AddCustomRPCModal/AddCustomRPCModal.tsx#L95-L110",
              "commit": "e9398a1ccf94ff016062592fc310a8a697d94f2b",
              "path": "desktop/src/views/screens/modals/settings/AddCustomRPCModal/AddCustomRPCModal.tsx",
              "detail": "Railway has a custom RPC modal; the indexer endpoint is fixed in the wallet SDK's generated GraphQL client, replaceable only by passing a different quickSync function to the engine; the indexer code is public (subsquid-integration, MIT).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railway-Wallet/Railway-Wallet/contents/desktop/src/views/screens/modals/settings/AddCustomRPCModal/AddCustomRPCModal.tsx?ref=e9398a1ccf94ff016062592fc310a8a697d94f2b\" --jq .content | base64 -d | sed -n 95,110p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "RPC is configurable in the UI and SDK; the indexer is configurable only in code, though its code is public and the engine can fall back to RPC scanning. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/logic/RailgunSmartWallet.sol#L97-L208",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "contracts/logic/RailgunSmartWallet.sol",
              "detail": "Tokens leave the contract only through unshield in a transaction carrying a valid proof over the note owner's keys; no admin function moves user balances. Fees go to the treasury at shield and unshield (25 bps each at block 26153471).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8",
              "address": "0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8",
              "block_number": 26153471,
              "detail": "ProxyAdmin owner() = Delegator 0xB6d5…B53B (governance), so the upgrade that could change custody needs a RAIL vote with a 7-day minimum before execution.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8 \"owner()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000b6d513f6222ee92fff975e901bd792e2513fb53b"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Funds sit in one upgradeable contract, controlled by the note owner's keys; nobody can move them under the current code. An upgrade could, but only after a public RAIL vote and at least 7 days, while users can unshield at any time. Judgment call: we read this as \"escrow with a provider role bounded by a timelock and a documented exit\" (2), not \"upgradeable escrow\" without a delay (1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xB6d513f6222Ee92Fff975E901bd792E2513fB53B",
              "address": "0xB6d513f6222Ee92Fff975E901bd792E2513fB53B",
              "block_number": 26153471,
              "detail": "Delegator owner() = Voting 0xc480…A3CC; executeProposal runs through the Delegator after EXECUTION_START_OFFSET (7 days) from callVote.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xB6d513f6222Ee92Fff975E901bd792E2513fB53B \"owner()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000c480f68a3dcc3edd82134fab45c14a0fcf1da3cc"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/governance/Voting.sol#L16-L26",
              "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
              "path": "contracts/governance/Voting.sol",
              "detail": "Sponsor window 30 days, voting starts 2 days after callVote, execution window 7 to 14 days after; quorum 2M RAIL.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The RailgunSmartWallet is upgradeable by RAIL governance only: ProxyAdmin → Delegator → Voting, with at least 7 days between a vote being called and execution, longer than the immediate user exit. There is no Safe; the voters are onchain. The repo names no user notice channel beyond the onchain proposal, and governance can also set verification keys via the VKeySetters. Judgment call: 2 (delay longer than exit, no notice channel named).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railway-Wallet/Railway-Wallet/blob/e9398a1ccf94ff016062592fc310a8a697d94f2b/desktop/src/views/screens/drawer/shield/ShieldTokens/ShieldInitial/ShieldERC20sInitial.tsx#L89-L93",
              "commit": "e9398a1ccf94ff016062592fc310a8a697d94f2b",
              "path": "desktop/src/views/screens/drawer/shield/ShieldTokens/ShieldInitial/ShieldERC20sInitial.tsx",
              "detail": "Railway's shield flow sets the approval amount to maxBigIntForTransaction() (2^256-1, util.tsx L254-L256) for the RAILGUN proxy; no \"unlimited\" label was found in the approval screens.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Railway asks for an unlimited allowance to the upgradeable RAILGUN proxy when shielding, and we found no disclosure of that in the UI code. The SDK has no approval helper; integrators choose. Scored 0 on the reference wallet.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "address": "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "block_number": 26153471,
              "detail": "The proxy is unpaused (paused slot 0) and transact/unshield is callable by anyone with a valid proof (C2).",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9 0x8dea8703c3cf94703383ce38a9c894669dccd4ca8e65ddb43267aa0248711450 --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "slot": "0x8dea8703c3cf94703383ce38a9c894669dccd4ca8e65ddb43267aa0248711450",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=2, C2=3, C3=3, O3=1. Funds are held by keys the user controls, behind an upgrade path that needs a 7-day governance process (S1). A user can unshield and keep sending privately by calling the contract directly with the public SDK and an RPC (C2, C3). A public frontend exists (Railway), but no build was reproduced (O3=1). Judgment call: 2, not 3, for that reason.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Railgun-Community/wallet/blob/5c9d04c844879b8377d91775052e88c836b48730/src/services/railgun/core/init.ts#L142-L182",
              "commit": "5c9d04c844879b8377d91775052e88c836b48730",
              "path": "src/services/railgun/core/init.ts",
              "detail": "The SDK takes no API keys; wallet keys are derived from a locally stored mnemonic. A search of Railway desktop and mobile src for API_KEY, apiKey and REACT_APP_*KEY found none, and there are no webhooks.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/Railgun-Community/wallet/contents/src/services/railgun/core/init.ts?ref=5c9d04c844879b8377d91775052e88c836b48730\" --jq .content | base64 -d | sed -n 142,182p",
              "package": {
                "name": "@railgun-community/wallet",
                "version": "10.9.0",
                "integrity": "sha512-y2ncKCWkG3rWSYysBzXzPsTQvKMGE2lCFVwCgKjS3JnkZAHiKRYWjWrcMw1mSrFYmNjTO1/loYO4qALGz09cbg=="
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No secrets ship in the SDK or the Railway source, and the protocol has no merchant keys or webhooks. User secrets stay client-side. The npm package 10.9.0 was published from the pinned commit (gitHead 5c9d04c8). Scored 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/abdk-consulting/audits/blob/57af593b14bb3701cf659937b1b7b6483009a0cc/railgun/ABDK_Railgun_CircomSolidity_v_2_0.pdf",
              "commit": "57af593b14bb3701cf659937b1b7b6483009a0cc",
              "path": "railgun/ABDK_Railgun_CircomSolidity_v_2_0.pdf",
              "detail": "ABDK's Circom and Solidity review covers contract commit 6281cb (Commitments, RailgunLogic, Snark, TokenWhitelist, Types, Verifier) and circuits commit 2c3c31, an early version; findings are listed as Opened in this report.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "An audit report exists for an early version of the contracts and circuits; it does not cover the deployed implementation (deployed at block 25641630, with Action events and TokenBlocklist). We found no audit report, SECURITY file or bounty programme in the Railgun repos or docs. Judgment call: 1 for an audit of a prior version, as for Tornado Cash; no audit of the deployed code was found.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "The settlement contracts have no address or country checks, and neither the SDK nor Railway has a country gate in code; Railway's terms of use name no restricted countries. Edge filtering is by address list (SDK OFAC list, Railway's POI using Chainalysis's OFAC list), not by country.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/Railgun-Privacy/contract/tree/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/logic",
            "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
            "path": "contracts/logic",
            "detail": "A search of contracts/, engine/src, wallet/src and Railway desktop/mobile src for country, geolocation, ipinfo and geoblock found no country gate.",
            "recheck": "gh api -X GET search/code -f q='country repo:Railgun-Community/wallet' --jq .total_count",
            "checked_at": "2026-10-09"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: Ethereum RailgunSmartWallet proxy 0xFA70…a4b9 (implementation 0xD662…6A0C) and its governance chain. Reads at block 26153471 via publicnode; Delegator permission logs via rpc.mevblocker.io (RevokePermission logs could not be fetched; current permissions were read with checkPermission). Railgun has no first-party frontend; Railway Wallet (Right to Privacy Foundation) is assessed as the reference client. npm @railgun-community/wallet latest is 11.2.0, published from outside the default branch; we pinned 10.9.0, whose gitHead is the default-branch commit we read. No transactions, UI runs, traces or self-host attempts.",
      "audits": {
        "searched": "The Railgun-Privacy and Railgun-Community repos (no audits folder or SECURITY file), docs.railgun.org (no audits page in its sitemap), railgun.org, the ABDK portfolio at github.com/abdk-consulting/audits (railgun folder), Zokyo's github.com/zokyo-sec/audit-reports (RAILGUN folder; a RAIL token audit there is not in the payment path), the Trail of Bits publications list (it lists a RAILGUN review from Feb 2022 with no report published), and Hacken's audit listing. No audit of the implementation deployed at block 25641630 was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Zokyo",
            "date": "2023-02-03",
            "type": "audit",
            "scope": "Cross-chain governance relay contracts Sender.sol and Executor.sol, which carry Ethereum governance actions to Railgun's L2 deployments.",
            "url": "https://github.com/zokyo-sec/audit-reports/blob/39b9e51ac1b68a42ac03b222167760f7035bf16e/RAILGUN/Railgun_Zokyo_audit_report_Feb3_2023.pdf",
            "commit": "a49a82d1589426ece9f6b463c51635002f542e65",
            "repo": "https://github.com/Railgun-Privacy/contract",
            "covers_deployed": "unknown",
            "findings": "No critical; medium issues marked resolved, plus low and informational",
            "note": "Governance plumbing for other chains rather than the Ethereum settlement contracts; the arbitrum and opStack Sender and Executor files changed after this commit."
          },
          {
            "auditor": "Zokyo",
            "date": "2022-12-21",
            "type": "audit",
            "scope": "Commitments, RailgunLogic and RailgunSmartWallet (the v3 settlement contracts).",
            "url": "https://github.com/zokyo-sec/audit-reports/blob/39b9e51ac1b68a42ac03b222167760f7035bf16e/RAILGUN/Railgun_Zokyo_audit_report_Dec21_2022.pdf",
            "commit": "4385ec73bf7d0da283123e8a3ac3900216cfc3f0",
            "repo": "https://github.com/Railgun-Privacy/contract",
            "covers_deployed": "partly",
            "findings": "No critical; medium issues marked resolved; some informational items marked invalid or unresolved",
            "note": "The deployed implementation descends from these contracts, but contracts/logic changed in the 131 commits between this commit and the assessed commit 36bcf5ed (Action events, TokenBlocklist)."
          },
          {
            "auditor": "Zokyo",
            "date": "2022-09-14",
            "type": "audit",
            "scope": "Governance Voting.sol.",
            "url": "https://github.com/zokyo-sec/audit-reports/blob/39b9e51ac1b68a42ac03b222167760f7035bf16e/RAILGUN/RAILGUN_Zokyo_audit_report_Sep14_2022.pdf",
            "repo": "https://github.com/Railgun-Privacy/contract",
            "covers_deployed": "unknown",
            "findings": "No critical; low and informational issues, resolved or acknowledged",
            "note": "The report names last commit d73c1da6, which does not exist in Railgun-Privacy/contract; Voting.sol changed after the audit and we did not compare it with the deployed Voting contract."
          },
          {
            "auditor": "Zokyo",
            "date": "2022-04-20",
            "type": "audit",
            "scope": "Globals, Snark, Commitments, Verifier, Poseidon, TokenBlacklist and RailgunLogic (v2 settlement contracts).",
            "url": "https://github.com/zokyo-sec/audit-reports/blob/39b9e51ac1b68a42ac03b222167760f7035bf16e/RAILGUN/RAILGUN_Zokyo_audit_report_April20_2022.pdf",
            "commit": "62401e1a64b9af968d85b8f5347f1a72cc56862c",
            "repo": "https://github.com/Railgun-Privacy/contract",
            "covers_deployed": "no",
            "note": "Covers a version replaced by the v3 RailgunSmartWallet."
          },
          {
            "auditor": "Zokyo",
            "date": "2021-11-23",
            "type": "audit",
            "scope": "Commitments, Globals and RailgunLogic (v1 settlement logic).",
            "url": "https://github.com/zokyo-sec/audit-reports/blob/39b9e51ac1b68a42ac03b222167760f7035bf16e/RAILGUN/RAILGUN_Zokyo_audit_report_Nov23_2021.pdf",
            "commit": "97af307fa1d737d4526323acc3d0ef372c703417",
            "repo": "https://github.com/Railgun-Privacy/contract",
            "covers_deployed": "no",
            "findings": "2 issues, both resolved; no critical",
            "note": "Starting commit 0418a0f1, last commit 97af307f. Superseded by later versions."
          },
          {
            "auditor": "Zokyo",
            "date": "2021-11-03",
            "type": "audit",
            "scope": "Full v1 contract suite (Delegator, Voting, ProxyAdmin, Proxy, Commitments, RailgunLogic, Verifier, Snark, TokenWhitelist, Staking, Treasury, Distributor, VestLock and others).",
            "url": "https://github.com/zokyo-sec/audit-reports/blob/39b9e51ac1b68a42ac03b222167760f7035bf16e/RAILGUN/RAILGUN_Zokyo_audit_report_Nov3_2021.pdf",
            "commit": "d2c63577ddd8310c87dced0d549cf9505b372111",
            "repo": "https://github.com/Railgun-Privacy/contract",
            "covers_deployed": "no",
            "findings": "No critical; 1 low and 3 informational, left unresolved because the contracts were already deployed",
            "note": "Reviewed after the v1 deployment; the settlement logic has since been replaced, though some governance contracts (Delegator, ProxyAdmin) may descend from this suite."
          },
          {
            "auditor": "Hacken",
            "date": "2021-11",
            "type": "audit",
            "scope": "Railgun smart contracts for Right to Privacy (contract list not read; see note).",
            "url": "https://hacken.io/audits/right-to-privacy/sca-right-to-privacy-railgun-nov2021/",
            "covers_deployed": "no",
            "findings": "2 medium and 2 low, all resolved, per Hacken's listing",
            "blocked_to_bots": true,
            "note": "Published on Hacken's audits site, which returns HTTP 403 to scripted requests, so we could not read the scope or commit. Dated November 2021, it predates the deployed implementation."
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2021-06-18",
            "type": "audit",
            "scope": "Early contracts (Commitments, RailgunLogic, Snark, TokenWhitelist, Types, Verifier) and circuits.",
            "url": "https://github.com/abdk-consulting/audits/blob/57af593b14bb3701cf659937b1b7b6483009a0cc/railgun/ABDK_Railgun_CircomSolidity_v_2_0.pdf",
            "commit": "6281cb0dac6a6e0da743e3ba56c437803657872d",
            "repo": "https://github.com/Railgun-Privacy/contract",
            "covers_deployed": "no",
            "findings": "2 critical, 5 major, 3 moderate, 54 minor; all listed as Opened in this report",
            "note": "Circuits were reviewed at Railgun-Privacy/circuits commit 2c3c3144, predating circuits-v2."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C5"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S3"
          ]
        }
      },
      "tally": {
        "holds": 17,
        "short": 6,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "request-network",
      "name": "Request Network",
      "type": "checkout",
      "website": "https://request.network",
      "primary_chain": {
        "name": "Base",
        "chain_id": 8453,
        "basis": "The vendor's docs repo (RequestNetwork/mintlify-docs@1845bc53) uses \"USDC-base\" as its example payment currency more than any other mainnet ID (15 occurrences vs 8 for USDC-mainnet), and Base is one of the 7 EVM chains in its supported-chains table (resources/supported-chains-and-currencies.mdx L19). Excluded: Ethereum, Arbitrum, Optimism, Polygon, BSC, Tron, about 20 SDK-only legacy chains, NEAR, and Gnosis Chain, which hosts request storage (described in notes, not scored onchain)."
      },
      "repos": [
        {
          "url": "https://github.com/RequestNetwork/requestNetwork/tree/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts",
          "role": "contracts",
          "license": "MIT"
        },
        {
          "url": "https://github.com/RequestNetwork/requestNetwork/tree/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/payment-processor",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/RequestNetwork/requestNetwork/tree/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/request-client.js",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/RequestNetwork/requestNetwork/tree/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/request-node",
          "role": "backend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/RequestNetwork/payments-subgraph/tree/c176246e16061c10ca794f0ebba318ec7b70fc52",
          "role": "indexer",
          "license": "MIT"
        },
        {
          "url": "https://github.com/RequestNetwork/storage-subgraph/tree/0e970cf400bce0230d1cf736908bed4f4fc62dfa",
          "role": "indexer",
          "license": "MIT"
        },
        {
          "url": "https://github.com/RequestNetwork/request-helm-charts/tree/5d8332661fbeba9bcb0217a331238ef7b00dd095",
          "role": "deploy",
          "license": "MIT"
        },
        {
          "url": "https://github.com/RequestNetwork/docker-images/tree/325637188a3cb782ed28c9ae246ae907116fcd23",
          "role": "deploy",
          "license": "none"
        },
        {
          "url": "https://github.com/RequestNetwork/web-components/tree/0ebac5e18e37fec35ba210c3361749d4d4048d98",
          "role": "frontend",
          "license": "none"
        },
        {
          "url": "https://github.com/RequestNetwork/invoicing-template/tree/6f4872a68e08a3e18a42b72fb7baa9c2ba8de253",
          "role": "frontend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/RequestNetwork/easy-invoice/tree/42ad4d0ece43552322add9d089c9e8e8cdcca812",
          "role": "frontend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/RequestNetwork/mintlify-docs/tree/1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
          "role": "docs",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
          "chain_id": 8453,
          "role": "ERC20FeeProxy 0.2.0 (ERC-20 payment with reference)",
          "verified": "sourcify"
        },
        {
          "address": "0xd9C3889eB8DA6ce449bfFE3cd194d08A436e96f2",
          "chain_id": 8453,
          "role": "EthereumFeeProxy 0.2.0 (native payment with reference)",
          "verified": "sourcify"
        },
        {
          "address": "0x8296D56321cf207925a7804E5A8E3F579838e6Ad",
          "chain_id": 8453,
          "role": "Erc20ConversionProxy (fiat-denominated ERC-20 payment)",
          "verified": "sourcify"
        },
        {
          "address": "0x3dF89c727eaDF67eeD7b4d09EC4F2b41f8Dec2ca",
          "chain_id": 8453,
          "role": "ChainlinkConversionPath (price-feed registry)",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Payment proxy contracts on Base (ERC20FeeProxy, EthereumFeeProxy)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "none (immutable, no admin)",
          "required": true,
          "repo": "https://github.com/RequestNetwork/requestNetwork"
        },
        {
          "name": "Conversion contracts on Base (Erc20ConversionProxy, ChainlinkConversionPath)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "Request Network admin Safe (3-of-7)",
          "required": false,
          "repo": "https://github.com/RequestNetwork/requestNetwork"
        },
        {
          "name": "Request SDK (request-client.js, payment-processor, payment-detection)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "integrator",
          "required": true,
          "repo": "https://github.com/RequestNetwork/requestNetwork"
        },
        {
          "name": "Request Node (request persistence gateway)",
          "role": "backend",
          "public": true,
          "license": "MIT",
          "operator": "Request Network hosted gateways, or self-hosted",
          "required": true,
          "repo": "https://github.com/RequestNetwork/requestNetwork"
        },
        {
          "name": "IPFS private swarm (request content storage)",
          "role": "other",
          "public": true,
          "license": "MIT",
          "operator": "Request Network and any node holding the published swarm key",
          "required": true,
          "repo": "https://github.com/RequestNetwork/docker-images"
        },
        {
          "name": "Storage contracts on Gnosis Chain (RequestHashStorage, RequestOpenHashSubmitter)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "Request Network admin Safe on Gnosis (3-of-7)",
          "required": true,
          "repo": "https://github.com/RequestNetwork/requestNetwork"
        },
        {
          "name": "Base sequencer and JSON-RPC (default https://mainnet.base.org, swappable)",
          "role": "ledger",
          "public": true,
          "license": "MIT",
          "operator": "Base (Coinbase)",
          "required": true
        },
        {
          "name": "Payments and storage subgraphs (The Graph Studio / Satsuma by default)",
          "role": "indexer",
          "public": true,
          "license": "MIT",
          "operator": "Request Network deployments on The Graph Studio and Alchemy Subgraphs",
          "required": false,
          "repo": "https://github.com/RequestNetwork/payments-subgraph"
        },
        {
          "name": "Chainlink price feeds (conversion payments only)",
          "role": "oracle",
          "public": true,
          "license": "MIT",
          "operator": "Chainlink node operators",
          "required": false
        },
        {
          "name": "Request Network API (api.request.network, auth.request.network)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Request Network",
          "required": false
        },
        {
          "name": "Secure Payment page and Dashboard (pay.request.network)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Request Network",
          "required": false
        },
        {
          "name": "KYT screening (Hypernative, Merkle Science) for compliance-gated payments",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Hypernative / Merkle Science",
          "required": false
        },
        {
          "name": "Pimlico bundler (smart-account Secure Payment path)",
          "role": "bundler",
          "public": false,
          "license": "proprietary",
          "operator": "Pimlico",
          "required": false
        },
        {
          "name": "Request Finance app (third-party invoicing product on the protocol)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Request Finance",
          "required": false
        },
        {
          "name": "Invoicing template, Easy Invoice, and web components (reference frontends)",
          "role": "frontend",
          "public": true,
          "license": "MIT",
          "operator": "integrator (Request Network hosts demos)",
          "required": false,
          "repo": "https://github.com/RequestNetwork/invoicing-template"
        },
        {
          "name": "Lit Protocol (optional request encryption)",
          "role": "other",
          "public": true,
          "license": "MIT",
          "operator": "Lit Protocol network",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/contracts/ERC20FeeProxy.sol#L34-L58",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/src/contracts/ERC20FeeProxy.sol",
              "detail": "ERC20FeeProxy has no owner, role, pause, or blacklist; transferFromWithReferenceAndFee is external with no modifier. EthereumFeeProxy (L55-L74 of its file) is the same.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/contracts/Erc20ConversionProxy.sol#L76-L137",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/src/contracts/Erc20ConversionProxy.sol",
              "detail": "Erc20ConversionProxy delegatecalls into paymentProxy (L77) and the owner can replace paymentProxy and chainlinkConversionPath at any time (updateConversionProxyAddress L135, updateConversionPathAddress L127), with no delay.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x8296D56321cf207925a7804E5A8E3F579838e6Ad",
              "address": "0x8296D56321cf207925a7804E5A8E3F579838e6Ad",
              "block_number": 52285354,
              "detail": "owner() of Erc20ConversionProxy is 0xf735afF55745e00D85F30AFB01E1c042D0755628, a Safe 1.4.1; paymentProxy() currently points at ERC20FeeProxy 0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814.",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0x8296D56321cf207925a7804E5A8E3F579838e6Ad \"owner()(address)\" --rpc-url https://mainnet.base.org --block 52285354",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x000000000000000000000000f735aff55745e00d85f30afb01e1c042d0755628"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xf735afF55745e00D85F30AFB01E1c042D0755628",
              "address": "0xf735afF55745e00D85F30AFB01E1c042D0755628",
              "block_number": 52285354,
              "detail": "Admin Safe threshold is 3 of 7 owners; getModulesPaginated(0x1,10) returns no modules and the guard slot is zero; no timelock sits between the Safe and the contracts.",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0xf735afF55745e00D85F30AFB01E1c042D0755628 \"getThreshold()(uint256)\" --rpc-url https://mainnet.base.org --block 52285354",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000003"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x3dF89c727eaDF67eeD7b4d09EC4F2b41f8Dec2ca",
              "address": "0x3dF89c727eaDF67eeD7b4d09EC4F2b41f8Dec2ca",
              "block_number": 52285354,
              "detail": "isWhitelistAdmin(admin Safe) is true on ChainlinkConversionPath and false for the deployer 0x4E64C2d06d19D13061e62E291b2C4e9fe5679b93, which held it at construction; full role enumeration was not possible because public Base RPCs cap eth_getLogs at 500 blocks.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xbb5f747b000000000000000000000000f735aff55745e00d85f30afb01e1c042d0755628",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The core payment contracts, ERC20FeeProxy and EthereumFeeProxy, have no pause, freeze, blacklist, or admin of any kind. The conversion path, used for invoices denominated in fiat, does have one. The owner of Erc20ConversionProxy can swap the code it delegatecalls into, and an admin of ChainlinkConversionPath can change or remove price feeds. Either change halts conversion payments, and new code could be written to block chosen addresses. Both roles are held by a 3-of-7 Safe with no modules and no guard. There is no timelock, and the signers are not disclosed. The Safe is named as admin in the repo (Admin artifact, smart-contracts README L282). Judgment call: we score 1 and not 0. The anchor-1 case covers a multisig with no timelock and undisclosed signers. We read anchor 0's \"target individual addresses\" as a native blacklist function, and none exists. Payers on non-conversion requests can avoid this role entirely by calling ERC20FeeProxy, which on its own would score 3. Outside Base, the same Safe signer set (3-of-7) can remove the open hash submitter from the Gnosis RequestHashStorage whitelist, which would stop new requests being stored (see notes).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/contracts/ERC20FeeProxy.sol#L34-L58",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/src/contracts/ERC20FeeProxy.sol",
              "detail": "transferFromWithReferenceAndFee(token, to, amount, paymentReference, feeAmount, feeAddress) is external, unpermissioned, and moves tokens from msg.sender straight to the payee.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/lib/artifacts/ERC20FeeProxy/index.ts#L162-L165",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/src/lib/artifacts/ERC20FeeProxy/index.ts",
              "detail": "The Base address of ERC20FeeProxy 0.2.0 and its ABI (0.1.0.json) are committed and published in @requestnetwork/smart-contracts.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/resources/lifecycle-of-a-request.mdx#L26-L32",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "resources/lifecycle-of-a-request.mdx",
              "detail": "Docs state the payer derives the paymentReference and calls the payment contract with token, to, amount and paymentReference; faq.mdx L40-L42 says the reference can be computed and paid before the request exists.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
              "address": "0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
              "block_number": 52285354,
              "detail": "Deployed ERC20FeeProxy is a Sourcify exact_match to this source; tx 0x2580e807b575a321c20e3134eea8e18a0edba56ae97ca25b315215e0a7113d4e (block 52282170) shows a non-Request contract calling it and emitting TransferWithReferenceAndFee.",
              "checked_at": "2026-10-07",
              "recheck": "cast receipt 0x2580e807b575a321c20e3134eea8e18a0edba56ae97ca25b315215e0a7113d4e --rpc-url https://mainnet.base.org --json | jq '.logs[] | select(.address==\"0x1892196e80c4c17ea5100da765ab48c1fe2fb814\")'"
            }
          ],
          "finding": "A payer can settle without Request Network. They compute the paymentReference from the request and call ERC20FeeProxy or EthereumFeeProxy directly. The ABI and Base address are in the repo and the npm package, and the docs describe the call. No provider signature, relayer, or API is involved, and the contract moves funds straight from payer to payee. We did not run a test payment of our own. A live transaction on Base shows a third-party contract calling the proxy directly.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/request-client.js/src/http-data-access-config.ts#L39-L45",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/request-client.js/src/http-data-access-config.ts",
              "detail": "The SDK's default Request Node is http://localhost:3000, overridden by nodeConnectionConfig; no hosted gateway or fallback is configured in the SDK.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/request-node/README.md#L145-L194",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/request-node/README.md",
              "detail": "The Request Node README documents npm and source installation, joining the IPFS private network with the request-ipfs image, and optional TheGraph mode; request-helm-charts provides a Kubernetes deployment.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/invoicing-template/blob/6f4872a68e08a3e18a42b72fb7baa9c2ba8de253/utils/context.tsx#L39-L46",
              "commit": "6f4872a68e08a3e18a42b72fb7baa9c2ba8de253",
              "path": "utils/context.tsx",
              "detail": "The reference frontend defaults to Request's hosted gateway https://gnosis.gateway.request.network/ unless NEXT_PUBLIC_REQUEST_NODE is set.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/RequestNetwork/invoicing-template/contents/utils/context.tsx?ref=6f4872a68e08a3e18a42b72fb7baa9c2ba8de253\" --jq .content | base64 -d | sed -n 39,46p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "On the open path, the only required intermediary is a Request Node, which stores the request and needs IPFS and a Gnosis RPC. Its code, a README setup guide, Docker images, and a Helm chart are all public. The SDK configures no fallback node; the reference template falls back to Request's hosted Gnosis gateway. No relayer, paymaster, or bundler is needed. Request Network's current docs describe only its hosted API, which is closed and single-vendor and would score 0. Judgment call: we score the open protocol path, because a payment completes without the API. We score 2 and not 3, because the SDK itself sets no fallback. Storing a request on Gnosis also needs the open hash submitter to stay whitelisted by Request's Safe (see C1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/payment-processor/src/payment/erc20-fee-proxy.ts#L1-L40",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/payment-processor/src/payment/erc20-fee-proxy.ts",
              "detail": "A search of every packages/*/src directory (SDK, request-node, payment-detection), web-components, and invoicing-template for sanction, OFAC, chainalysis, TRM, blocklist, denylist, geoblock, and IP-geolocation calls finds only test mocks (BadERC20.sol); the settlement contracts contain no address or country checks.",
              "checked_at": "2026-10-07",
              "package": {
                "name": "@requestnetwork/payment-processor",
                "version": "0.63.0",
                "integrity": "sha512-3BAy/leIYSuF6vM9wQPaXLA7UGoYbyvhvmvtxQ+EvfIL+5dKqBX/xTuklqPNzYVPpkotpXhvvZt8WpZ3JS0JxQ=="
              },
              "recheck": "git clone https://github.com/RequestNetwork/requestNetwork && cd requestNetwork && git checkout 749b13070bcb88be4a10b8d59fcf3705339d43e0 && grep -rniE \"sanction|ofac|chainalysis|blocklist|denylist|geoblock\" packages/*/src",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/tools/secure-payments.mdx#L107-L111",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "tools/secure-payments.mdx",
              "detail": "The only filtering found is KYT wallet screening on the hosted Secure Payment page, merchant-enabled, disclosed in the versioned docs repo, and naming its list sources (Hypernative standard policy by default, Merkle Science optional).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
              "address": "0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
              "block_number": 52285354,
              "detail": "The deployed ERC20FeeProxy bytecode is a Sourcify exact_match to source with no filtering logic, so a payer screened out by the hosted page can still call it directly (C2).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The settlement contracts do no address or geographic filtering, and neither do the public SDK, Request Node, and reference frontends. The one filter we found is opt-in KYT screening on Request's hosted Secure Payment page. It is disclosed in the versioned docs repo, its list providers are named, and a payer can bypass it with the direct contract call scored in C2. All required components on the open path are public. Request's hosted API and gateways are closed or of unknown build. We cannot rule out screening inside them, but neither is required to pay. No network trace was run.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/request-token-list/blob/5af600b0b1a52129bb37246ac52f46c0aa0bae51/tokens/token-list.json#L8151-L8160",
              "commit": "5af600b0b1a52129bb37246ac52f46c0aa0bae51",
              "path": "tokens/token-list.json",
              "detail": "Supported tokens are enumerated per chain in the token list (USDC-base 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913) and in packages/currency/src/chains/evm/data/base.ts.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/use-cases/why-request-network.mdx#L18-L26",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "use-cases/why-request-network.mdx",
              "detail": "Docs list \"Exposure to fund freezing or seizure\" as a processor risk and say that because Request never takes custody \"none of these risks apply\"; no docs page mentions issuer freeze powers or sequencer assumptions.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens and chains are listed in code and on the supported-chains docs page. The docs then tell payees that freezing and seizure risks do not apply, although the main settlement assets, USDC and USDT, can be frozen by their issuers. Base, the primary chain, also runs on a single centralized sequencer, and the docs do not mention it. A search of the docs for freeze, blacklist, and sequencer found only the passage above. Judgment call: we score 0 and not 2. The enumeration in code would justify 2, but anchor 0 includes \"misstated\", and the docs misstate the freeze risk.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x8296D56321cf207925a7804E5A8E3F579838e6Ad",
              "address": "0x8296D56321cf207925a7804E5A8E3F579838e6Ad",
              "block_number": 52285354,
              "detail": "Sourcify returns exact_match (creation and runtime) for Erc20ConversionProxy, and also for ERC20FeeProxy 0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814, EthereumFeeProxy 0xd9C3889eB8DA6ce449bfFE3cd194d08A436e96f2, and ChainlinkConversionPath 0x3dF89c727eaDF67eeD7b4d09EC4F2b41f8Dec2ca; Basescan shows all four \"Source Code Verified (Exact Match)\".",
              "checked_at": "2026-10-07",
              "recheck": "for a in 0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814 0xd9C3889eB8DA6ce449bfFE3cd194d08A436e96f2 0x8296D56321cf207925a7804E5A8E3F579838e6Ad 0x3dF89c727eaDF67eeD7b4d09EC4F2b41f8Dec2ca; do curl -s https://sourcify.dev/server/v2/contract/8453/$a | jq -r .match; done"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/hardhat.config.ts#L70-L80",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/hardhat.config.ts",
              "detail": "The repo's Hardhat config pins solc 0.8.9 with the optimizer enabled (runs 200), but Sourcify metadata for all four deployments shows optimizer disabled; the optimizer was switched on in commit 77006576 (2025-11-26), after the 2024 Base deployment.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "All four settlement contracts are full matches on Sourcify and exact matches on Basescan. Their sources match the repo files at this commit, apart from a trailing newline. The repo's build config does not reproduce the deployed bytecode, because it now enables the optimizer and the deployments were compiled without it. Rebuilding would need the older config from git history, and we did not try. Judgment call: we score 2 and not 3, because anchor 3 needs a repo build script that reproduces the deployed bytecode.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/tree/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages",
              "detail": "The monorepo contains the contracts with deploy scripts (scripts-create2), the SDK packages, and the request-node backend; separate public repos hold the payments and storage subgraphs, the Helm chart, the Docker images, and three reference frontends.",
              "checked_at": "2026-10-07",
              "recheck": "gh repo list RequestNetwork --limit 100 --no-archived"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/faq.mdx#L75-L79",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "faq.mdx",
              "detail": "The FAQ says the recommended way to create a request is the Request Network API; no repo in the org contains the API, the Secure Payment page, or the Dashboard, and the API schema is published only as a hosted OpenAPI page (api.request.network/open-api).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every part of the open protocol stack is public: contracts, deploy scripts, SDK, Request Node, both indexers, deployment tooling, and reference frontends. The product Request's docs now steer integrators to is the hosted API, and its backend, Secure Payment page, and Dashboard are closed. Their API schema is published only on a hosted site. Judgment call: we score 2 and not 3. The open path alone would reach 3, but the backend behind the vendor's recommended integration is closed, which matches anchor 2's \"everything except the backend\".",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/request-node/README.md#L145-L240",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/request-node/README.md",
              "detail": "The README covers installation, IPFS private-network setup, TheGraph mode, launch options, and the MNEMONIC wallet needed to pay Gnosis storage fees; contract addresses ship in @requestnetwork/smart-contracts.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The documentation needed to self-host exists: Request Node setup, the IPFS swarm image, the storage subgraph, a Helm chart, and the template's env table. We did not attempt a reproduction, so under the brief the score is capped at 1. A self-hosted node also needs xDAI to pay the per-hash storage fee, which read 0.0999 xDAI on Gnosis at block 48631765.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/tree/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/lib/artifacts/ERC20FeeProxy",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/src/lib/artifacts/ERC20FeeProxy",
              "detail": "ABI JSON and per-chain addresses are committed for every payment contract; event schemas are in source (ERC20FeeProxy.sol L10-L17) and in payments-subgraph/schema.graphql.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/request-node/README.md#L24-L140",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/request-node/README.md",
              "detail": "The Request Node HTTP API (persistTransaction, getTransactionsByChannelId, getChannelsByTopic) is specified in the repo with parameters, example bodies, and success and error responses.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/RequestNetwork/requestNetwork/contents/packages/request-node/README.md?ref=749b13070bcb88be4a10b8d59fcf3705339d43e0\" --jq .content | base64 -d | sed -n 24,140p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/data-format/src/format/rnf_invoice/rnf_invoice-0.0.3.json#L1-L10",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/data-format/src/format/rnf_invoice/rnf_invoice-0.0.3.json",
              "detail": "Invoice content uses a published JSON Schema (rnf_invoice), and request data comes back from any node as JSON; neither the SDK nor the frontends provide an export function (CSV, ledger, or similar) for payees.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The repo contains the ABIs, the event schemas, and a written spec of the Request Node API. Request data is stored as JSON under a public JSON Schema, so it is portable. The repo has no payee export feature. The hosted API's OpenAPI schema is not versioned in any repo. Judgment call: we treat the node API spec in the README as \"or equivalent\" to OpenAPI, which supports 2. We score 2 and not 3, because no export function exists.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/LICENSE",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "LICENSE",
              "detail": "The monorepo (contracts, SDK, request-node) is MIT; every packages/*/package.json declares MIT; payments-subgraph, storage-subgraph, request-helm-charts, invoicing-template, and easy-invoice each carry an MIT LICENSE file (GitHub API license.spdx_id MIT).",
              "checked_at": "2026-10-07",
              "recheck": "for r in requestNetwork payments-subgraph storage-subgraph request-helm-charts invoicing-template easy-invoice docker-images web-components; do echo $r $(gh api repos/RequestNetwork/$r --jq '.license.spdx_id // \"none\"'); done",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/web-components/tree/0ebac5e18e37fec35ba210c3361749d4d4048d98/packages",
              "commit": "0ebac5e18e37fec35ba210c3361749d4d4048d98",
              "path": "packages",
              "detail": "web-components has no LICENSE file (its package.json files declare MIT, as do the published npm packages); docker-images, which holds the IPFS swarm image, has no LICENSE file at 325637188a3cb782ed28c9ae246ae907116fcd23.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Every repo needed for the open path carries an OSI-approved licence (MIT): the contracts, the SDK, the Request Node, both subgraphs, and the Helm chart. Two non-critical repos have no LICENSE file. The first is web-components, the optional invoice widgets; their npm packages declare MIT. The second is docker-images; the IPFS swarm image can be rebuilt from Kubo and the swarm key. The closed components (API, Secure Payment page, Request Finance) are not required. Judgment call: anchor 2 allows one unlicensed non-critical repo and we found two. We still score 2, because neither repo is needed to run a payment.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/CONTRIBUTING.md#L1-L60",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "CONTRIBUTING.md",
              "detail": "CONTRIBUTING.md has no CLA requirement, and .github contains no CLA bot config; git log -- LICENSE shows a single commit, 1da692fc (2018-01-12, MIT), so the licence has never changed.",
              "checked_at": "2026-10-07",
              "recheck": "git clone https://github.com/RequestNetwork/requestNetwork && cd requestNetwork && git log --format='%h %ad %s' --date=short -- LICENSE && grep -niE \"cla|license\" CONTRIBUTING.md",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no CLA, and the MIT licence has not changed since 2018. The repo makes no written commitment to keep the licence stable.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/request-node/src/config.ts#L19-L37",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/request-node/src/config.ts",
              "detail": "Request Node defaults point to local services (Ethereum RPC localhost:8545, IPFS localhost:5001, Graph node localhost:8000); there is no hosted-only dependency or API key.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/RequestNetwork/requestNetwork/contents/packages/request-node/src/config.ts?ref=749b13070bcb88be4a10b8d59fcf3705339d43e0\" --jq .content | base64 -d | sed -n 19,37p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/utils/src/providers.ts#L18-L23",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/utils/src/providers.ts",
              "detail": "The SDK's default provider for Ethereum-family networks uses a built-in Infura project ID (RN_INFURA_KEY overrides it); Base defaults to the public https://mainnet.base.org (L55).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "In code, the open path needs no proprietary plugin or hosted-only service. The node, IPFS, and indexer all run locally, and the SDK accepts any RPC. The proprietary pieces (Request API, Secure Payment page, KYT vendors, Pimlico, Request Finance) are optional. Judgment call: anchor 3 also fits the code, but we score 2. We made no O3 reproduction, so we have not shown a production deployment running free of hosted services.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/invoicing-template/blob/6f4872a68e08a3e18a42b72fb7baa9c2ba8de253/pages/_app.tsx#L5-L36",
              "commit": "6f4872a68e08a3e18a42b72fb7baa9c2ba8de253",
              "path": "pages/_app.tsx",
              "detail": "The template renders GoogleTagManager on every page with gtmId from NEXT_PUBLIC_GTM_ID; @next/third-parties 15.1.0 (lockfile) builds the script tag as googletagmanager.com/gtm.js?id=${gtmId} with no check for a missing ID. easy-invoice src/app/layout.tsx L45 does the same.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/invoicing-template/blob/6f4872a68e08a3e18a42b72fb7baa9c2ba8de253/README.md#L84",
              "commit": "6f4872a68e08a3e18a42b72fb7baa9c2ba8de253",
              "path": "README.md",
              "detail": "The README lists NEXT_PUBLIC_GTM_ID (\"Google Tag Manager ID\") as not required.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/payment-processor/package.json#L1-L60",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/payment-processor/package.json",
              "detail": "No SDK package.json under packages/ names Sentry, PostHog, Segment, Mixpanel, Amplitude, Datadog, GTM, or a fingerprinting library.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/privacy-policy/",
              "detail": "The privacy policy says browsing data (cookies, IP, geolocation, OS, browser, interactions) is collected for analytics on Request's sites and apps.",
              "quote": "Cookies, IP address, geographical position, operating system",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK ships no analytics or telemetry. Both reference frontends ship Google Tag Manager. With an ID configured, GTM runs full tag-manager analytics, which is opt-in and visible in code. Without an ID, the script tag still loads from googletagmanager.com on every page, so Google sees each visitor's IP and page. The README presents the GTM ID as optional, and nothing tells end users. Request's own hosted apps disclose analytics in the privacy policy. Judgment call: between 2 (opt-in) and 1 we take 1, because the template calls Google by default. No trace was run, so this cell cannot reach 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/types/src/client-types.ts#L31-L39",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/types/src/client-types.ts",
              "detail": "In the SDK, a request needs requestInfo (payee, payer, currency, amount) and a signer; contentData is optional.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/data-format/src/format/rnf_invoice/rnf_invoice-0.0.3.json#L1-L10",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/data-format/src/format/rnf_invoice/rnf_invoice-0.0.3.json",
              "detail": "The invoice format used by the reference frontends requires invoiceNumber, creationDate, and invoiceItems (name, quantity, unitPrice, tax per item at L113), and has optional buyerInfo and sellerInfo with email, name, address, and tax ID.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/privacy-policy/",
              "detail": "For use of Request's hosted Services, the policy lists names, email, IP, clicks, OS, region, public keys, and bank details, used for analytics and marketing optimisation among other purposes.",
              "quote": "Names, email address, IP address, clicks, actions, OS type",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The bare SDK asks only for settlement fields and makes invoice content optional, which on its own would score 2. The reference invoicing flow requires line items, and invites buyer and seller identity, beyond what settlement needs. Request's hosted services collect names, email, IP, usage data, and bank details. That collection is disclosed only in the privacy policy, and it serves analytics and marketing as well as legal duties. Judgment call: we score 1 and not 2, because the default flows go beyond settlement needs and the only disclosure is the policy.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/contracts/ERC20FeeProxy.sol#L10-L17",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/src/contracts/ERC20FeeProxy.sol",
              "detail": "TransferWithReferenceAndFee emits token, payee, amount, indexed paymentReference, fee, and fee address; the paymentReference is last8Bytes(keccak(requestId + salt + payeeAddress)) (payment-detection/src/payment-reference-calculator.ts L11-L18).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/web-components/blob/0ebac5e18e37fec35ba210c3361749d4d4048d98/packages/create-invoice-form/src/lib/create-invoice-form.svelte#L319-L345",
              "commit": "0ebac5e18e37fec35ba210c3361749d4d4048d98",
              "path": "packages/create-invoice-form/src/lib/create-invoice-form.svelte",
              "detail": "The invoice form calls plain createRequest (unencrypted) unless the user ticks \"Encrypt invoice\", which defaults to false (utils/resetForm.ts L56).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/storage-subgraph/blob/0e970cf400bce0230d1cf736908bed4f4fc62dfa/schema.graphql#L1-L22",
              "commit": "0e970cf400bce0230d1cf736908bed4f4fc62dfa",
              "path": "schema.graphql",
              "detail": "The public storage subgraph indexes each stored transaction's plaintext data next to its channelId (requestId); the IPFS \"private\" swarm key is committed in docker-images/request-ipfs/swarm.key, so anyone can join it.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/resources/lifecycle-of-a-request.mdx#L10-L15",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "resources/lifecycle-of-a-request.mdx",
              "detail": "Docs disclose that requests are stored in IPFS, with the CID onchain on Gnosis, and can optionally be encrypted.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Each payment event publishes the payee, amount, token, and a payment reference, and the token Transfer log names the payer. Request contents are unencrypted by default: payee, payer, amount, and in the invoicing flow line items and any buyer or seller contact details. They are stored in an IPFS swarm whose key is public. Their CIDs are anchored on Gnosis and indexed in plaintext by a public subgraph. Anyone can recompute the paymentReference from the stored requestId, salt, and address, and so join a Base payment to its invoice contents. Encryption (ECIES or Lit) exists, but it is opt-in. Judgment call: we score 0 and not 1. Order contents and optional emails are public by default via an onchain pointer, which matches anchor 0, even though the docs say storage is IPFS with optional encryption.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/payment-detection/src/thegraph/client.ts#L153-L187",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/payment-detection/src/thegraph/client.ts",
              "detail": "Payment detection queries Request's subgraph on The Graph Studio by default (L9-L10), or The Graph gateway when an API key is given; options.url overrides both (L157).",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/RequestNetwork/requestNetwork/contents/packages/payment-detection/src/thegraph/client.ts?ref=749b13070bcb88be4a10b8d59fcf3705339d43e0\" --jq .content | base64 -d | sed -n 1,30p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/utils/src/providers.ts#L18-L23",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/utils/src/providers.ts",
              "detail": "Default RPC goes through Infura with a built-in project ID for Ethereum-family networks, and through mainnet.base.org for Base; setProviderFactory (L123) and RN_WEB3_RPC_URL_* replace it.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/invoicing-template/blob/6f4872a68e08a3e18a42b72fb7baa9c2ba8de253/utils/context.tsx#L50-L63",
              "commit": "6f4872a68e08a3e18a42b72fb7baa9c2ba8de253",
              "path": "utils/context.tsx",
              "detail": "The template sends Base payment lookups to an Alchemy Subgraphs (Satsuma) endpoint unless NEXT_PUBLIC_PAYMENTS_SUBGRAPH_URL_BASE is set; requests go to Request's Gnosis gateway; WalletConnect (Reown) and Lit Protocol are also wired in.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties see payer and payee data during a payment. They are the indexer host (The Graph Studio in the SDK, Alchemy Subgraphs in the template), the RPC provider (Base's public RPC, or Infura on other chains), Request's hosted Request Node, and WalletConnect. Each is named in code, and all except WalletConnect can be swapped through SDK options or env vars. The template's always-on GTM tag is counted under P1. The hosted API path adds Pimlico, Li.Fi, and KYT vendors, but it is optional. No trace was run.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/payment-detection/src/thegraph/client.ts#L153-L187",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/payment-detection/src/thegraph/client.ts",
              "detail": "Indexer URL can be set per chain through the SDK's paymentOptions.getSubgraphClient or options.url (L157).",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/RequestNetwork/requestNetwork/contents/packages/payment-detection/src/thegraph/client.ts?ref=749b13070bcb88be4a10b8d59fcf3705339d43e0\" --jq .content | base64 -d | sed -n 153,160p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/utils/src/providers.ts#L120-L135",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/utils/src/providers.ts",
              "detail": "RPC can be set through setProviderFactory or RN_WEB3_RPC_URL_<NETWORK>, and the Request Node URL through nodeConnectionConfig.baseURL.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/payments-subgraph/blob/c176246e16061c10ca794f0ebba318ec7b70fc52/subgraph.base.yaml#L27-L46",
              "commit": "c176246e16061c10ca794f0ebba318ec7b70fc52",
              "path": "subgraph.base.yaml",
              "detail": "Public (MIT) subgraph manifest indexes ERC20FeeProxy 0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814 on Base from block 10827274; storage-subgraph and request-node are also public.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "RPC, indexer, and Request Node URLs can all be set through SDK options, and the code for the indexer and the node is public. An integrator can keep payment detection and request storage inside their own infrastructure. The reference template exposes these settings only as env vars, and no UI offers them.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/contracts/ERC20FeeProxy.sol#L34-L58",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/src/contracts/ERC20FeeProxy.sol",
              "detail": "ERC20FeeProxy calls token.transferFrom(payer, payee) and transferFrom(payer, feeAddress) in the same call; the contract never holds a balance. EthereumFeeProxy forwards msg.value and refunds the rest in the same call.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/contracts/Erc20ConversionProxy.sol#L76-L89",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/src/contracts/Erc20ConversionProxy.sol",
              "detail": "Conversion payments delegatecall paymentProxy in the context of the contract the payer approved; the owner can point paymentProxy at arbitrary code (L135).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x8296D56321cf207925a7804E5A8E3F579838e6Ad",
              "address": "0x8296D56321cf207925a7804E5A8E3F579838e6Ad",
              "block_number": 52285354,
              "detail": "paymentProxy() returns ERC20FeeProxy 0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814 today; owner() is the 3-of-7 admin Safe.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x3cd3efef",
                "expect": "0x0000000000000000000000001892196e80c4c17ea5100da765ab48c1fe2fb814"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "For plain ERC-20 and native payments, funds move in one call straight from payer to payee, which on its own would score 3. Conversion payments run through Erc20ConversionProxy. Its owner, Request's Safe, can switch the delegatecall target with no delay. New code could redirect future conversion payments, or pull tokens from any wallet holding an open allowance to the proxy (see S3). The power is visible in verified source, and the Safe is named in the repo. Judgment call: we score 1 and not 0. We treat this as the \"upgradeable, disclosed\" case, because funds are never held between calls and the redirect needs a 3-of-7 Safe action.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
              "address": "0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
              "block_number": 52285354,
              "detail": "The EIP-1967 implementation slot of ERC20FeeProxy reads zero, and so does EthereumFeeProxy's; neither has an admin function, so both are immutable.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xf735afF55745e00D85F30AFB01E1c042D0755628",
              "address": "0xf735afF55745e00D85F30AFB01E1c042D0755628",
              "block_number": 52285354,
              "detail": "The guard slot of the admin Safe (owner of Erc20ConversionProxy) is zero and no modules are enabled; threshold 3 of 7, with no timelock in front.",
              "checked_at": "2026-10-07",
              "recheck": "cast storage 0xf735afF55745e00D85F30AFB01E1c042D0755628 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8 --rpc-url https://mainnet.base.org --block 52285354",
              "check": {
                "slot": "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/lib/artifacts/Admin/index.ts#L50-L53",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts/src/lib/artifacts/Admin/index.ts",
              "detail": "The repo lists 0xf735afF55745e00D85F30AFB01E1c042D0755628 as the \"RN Safe\" administering contracts on Base; no signer list, timelock, or notice channel appears in the repo or docs.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The two fee proxies cannot be upgraded. Erc20ConversionProxy is not a proxy contract, but its owner can repoint the delegatecall target, which in effect replaces its code. That owner is a 3-of-7 Safe with no modules or guard, no timelock, undisclosed signers, and no notice channel. Judgment call: we treat the delegatecall-target setter as upgrade authority, so the cell scores 1 (\"multisig admin, no timelock\"). The core FeeProxy path alone would score 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/payment-processor/src/payment/erc20.ts#L136-L232",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/payment-processor/src/payment/erc20.ts",
              "detail": "approveErc20IfNeeded, approveErc20, prepareApproveErc20, and encodeApproveAnyErc20 all default amount to MAX_ALLOWANCE (2^256-1, utils.ts L16); prepareApproveErc20ForProxyConversion passes no amount, so it is unbounded too.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/web-components/blob/0ebac5e18e37fec35ba210c3361749d4d4048d98/packages/single-invoice/src/lib/single-invoice.svelte#L763-L782",
              "commit": "0ebac5e18e37fec35ba210c3361749d4d4048d98",
              "path": "packages/single-invoice/src/lib/single-invoice.svelte",
              "detail": "The reference payment widget calls approveErc20(requestData, signer) and approveErc20ForProxyConversion without an amount, granting unlimited allowance to ERC20FeeProxy or Erc20ConversionProxy.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "By default the SDK and the reference widget ask the payer for an unlimited allowance. The only disclosure is a JSDoc line (\"with no limit\") aimed at developers, and nothing tells the payer. An integrator can pass an exact amount. Unlimited approval to the immutable ERC20FeeProxy is limited by that contract's fixed code. Unlimited approval to Erc20ConversionProxy is exposed to whatever code its owner Safe later points it at (see S1, S2). We did not assess the hosted API's approval calldata.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
              "address": "0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
              "block_number": 52285354,
              "detail": "ERC20FeeProxy is immutable (implementation slot zero, no admin) and an exact match to source that pays the payee directly.",
              "checked_at": "2026-10-07",
              "recheck": "cast storage 0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://mainnet.base.org --block 52285354"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/request-client.js/src/http-data-access-config.ts#L39-L45",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/request-client.js/src/http-data-access-config.ts",
              "detail": "The SDK can point at any Request Node, and the node, subgraphs, and invoicing-template frontend are public MIT code.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "This cell is derived from S1=1, C2=3, C3=2, and O3=1. Payees never leave funds with Request: payments land in their own wallets (S1), so nothing needs withdrawing if Request disappears. Settlement can continue by calling the immutable ERC20FeeProxy directly (C2). Request storage and detection can move to a self-hosted node and subgraph (C3), and a public frontend build exists. We did not reproduce a self-hosted deployment (O3=1), so the claim that settling continues through a public frontend is shown in code but not in a run. Judgment call: we score 2 and not 3 for that reason. S1's conversion-proxy risk only arises while the Safe is active.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/utils/src/providers.ts#L18-L23",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/utils/src/providers.ts",
              "detail": "The SDK ships a built-in Infura project ID (84842078…5213), which ends up in browser bundles; it authorises only RPC usage on Request's Infura quota, not merchant actions, and RN_INFURA_KEY replaces it.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/easy-invoice/blob/42ad4d0ece43552322add9d089c9e8e8cdcca812/src/app/api/webhook/route.ts#L195-L210",
              "commit": "42ad4d0ece43552322add9d089c9e8e8cdcca812",
              "path": "src/app/api/webhook/route.ts",
              "detail": "The reference app verifies the x-request-network-signature HMAC-SHA256 with a server-side WEBHOOK_SECRET, but compares with !== (not constant-time) over re-serialised JSON instead of the raw body.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/RequestNetwork/easy-invoice/contents/src/app/api/webhook/route.ts?ref=42ad4d0ece43552322add9d089c9e8e8cdcca812\" --jq .content | base64 -d | sed -n 195,210p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/tools/dashboard.mdx#L72-L74",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "tools/dashboard.mdx",
              "detail": "Browser-side Client IDs are scoped by allowed domains and can be revoked; webhooks are HMAC-signed (api-reference/webhooks.mdx L8).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No merchant secret reaches the browser. The open SDK path has no API key or webhook. The hosted API uses domain-scoped, revocable Client IDs on the client and signed webhooks, and the reference app verifies the signatures. There are two minor issues. The SDK bundles a shared Infura project ID. The reference verification uses a non-constant-time comparison on re-serialised JSON. Judgment call: we score 2 and not 3 because of these two issues.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/requestNetwork/tree/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts",
              "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
              "path": "packages/smart-contracts",
              "detail": "No audit report, SECURITY.md, or bug-bounty scope exists in the monorepo or the org .github repo; a GitHub code search of the RequestNetwork org for \"audit\" finds no report; https://request.network/.well-known/security.txt returns 404. CI runs Slither and Echidna (.github/workflows/security-*.yml).",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/api-features/secure-payment-pages.mdx",
              "detail": "The Secure Payment page tells payers the contract \"is audited and valid\" (L18), with no report linked.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "We found no audit report, audited commit, or bug bounty for the deployed payment contracts. Payers are told the contracts are audited, but no report is linked anywhere we could find. The repo does run static analysis (Slither) and fuzzing (Echidna) in CI, which this criterion does not credit.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "Scored unit is the open protocol path. The fee proxies have no admin and no address or country check, and the SDK has no geoblock, so anyone can pay from anywhere. The hosted API, Secure Payment page and Dashboard are optional; their API terms (request.network/api-terms-and-conditions) and privacy policy name no countries, and the API's optional KYT screening (Hypernative) screens wallet addresses, including exposure to \"Sanctioned Jurisdiction Exchanges\", not users' countries. Product variant: the easy-invoice template's crypto-to-fiat flow offers a 40-country list in its compliance form (easy-invoice@42ad4d0e src/lib/constants/compliance.ts), which is an optional off-ramp, not the payment path. Judgment call: the closed API could gate by country without saying so; it is not required to pay.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/contracts/ERC20FeeProxy.sol#L34-L58",
            "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
            "path": "packages/smart-contracts/src/contracts/ERC20FeeProxy.sol",
            "detail": "transferFromWithReferenceAndFee is callable by anyone and checks only that the token transfers succeed; there is no caller, address or country restriction.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/payment-processor/src/payment/erc20-fee-proxy.ts#L1-L40",
            "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
            "path": "packages/payment-processor/src/payment/erc20-fee-proxy.ts",
            "detail": "A search of every packages/*/src directory for sanction, OFAC, chainalysis, blocklist, denylist and geoblock finds only test mocks; the SDK has no country gate.",
            "checked_at": "2026-10-09",
            "recheck": "git clone https://github.com/RequestNetwork/requestNetwork && cd requestNetwork && git checkout 749b13070bcb88be4a10b8d59fcf3705339d43e0 && grep -rniE \"sanction|ofac|chainalysis|blocklist|denylist|geoblock\" packages/*/src",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit of assessment: the open Request Network protocol on Base. That means the SDK (request-client.js and payment-processor 0.63.0), a Request Node, and four settlement contracts: ERC20FeeProxy, EthereumFeeProxy, Erc20ConversionProxy, and ChainlinkConversionPath. Request's current docs describe only the hosted Request Network API. That API is closed; it is listed in components as not required, because a payment completes without it. Out of scope: batch, swap, recurring (pausable, AccessControl), escrow and commerce-escrow, SingleRequestProxy, EthConversionProxy (WhitelistAdminRole, the same pattern as Erc20ConversionProxy), cross-chain Li.Fi routes, Tron, and NEAR. Storage runs on Gnosis Chain. Requests are anchored through RequestOpenHashSubmitter 0x268C146Afb4790902Ee26A6D2d3aff968623Ec80, which writes to RequestHashStorage 0x2256938E8225a998C498bf86B43c1768EE14b90B. At Gnosis block 48631765, RequestHashStorage still whitelists the open submitter, and the storage fee is 0.0999 xDAI for 1000 bytes. The Gnosis admin Safe 0x8a4D2659f6d24312804BFA2f1F174A5498948037 is 3-of-7 with the same owners as the Base Safe, no modules, and no guard. Those reads are not recorded as evidence, because evidence must be on the primary chain. Base reads are pinned to block 52285354, and repo reads to requestNetwork@749b13070bcb88be4a10b8d59fcf3705339d43e0. No traces were run, and no self-host was attempted.",
      "audits": {
        "searched": "The requestNetwork monorepo and the RequestNetwork org (GitHub code, commit, issue and PR searches for \"audit\"), the org .github repo, request.network/.well-known/security.txt (404), the mintlify docs repo, the requestNetwork-v1-archive repo, and auditor portfolios (Verichains public-audit-reports, Hacken, Nethermind, Trail of Bits, Spearbit). The Secure Payment page says the contract \"is audited and valid\" with no report linked. PR #1739 (2026-06) fixes a Medium finding from a Creed DAO audit of BatchConversionPayments and EthereumFeeProxy, and PRs #874/#878 (2022) fix escrow audit findings; neither report is published. Hacken's \"Request Network | ERC20 | Apr2022\" review covers the REQ token (Ethereum 0x8f8221af...a938a), not payment code, so it is not listed. 2018 commits name further v1 reviews (Kleros, an individual reviewer) with no published report.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "VeriChains Lab",
            "date": "2018-03-22",
            "type": "audit",
            "scope": "Request Network v1 smart contracts: Administrable, RequestCore, RequestEthereumCollect, RequestEthereum and three SafeMath libraries (packages/requestNetworkSmartContracts, branch audit-mainnet-0.0.3-verichains).",
            "url": "https://github.com/verichains/public-audit-reports/blob/3ff2d281a466ba67b65be54725d01e029efb5687/Verichains%20Public%20Audit%20Report%20-%20Request%20Network%20-%20v1.0.pdf",
            "commit": "4f10411553cafda2a8910872adb180066c849e0a",
            "repo": "https://github.com/RequestNetwork/requestNetwork",
            "covers_deployed": "no",
            "findings": "No major vulnerabilities reported; recommendations only.",
            "note": "Covers the 2018 v1 RequestCore contracts, which the current fee-proxy design replaced. The ERC20FeeProxy, EthereumFeeProxy, Erc20ConversionProxy and ChainlinkConversionPath deployed on Base are not in scope."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C5"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 2,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S3",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 13,
        "short": 10,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "rizon-card",
      "name": "Rizon Card",
      "type": "incumbent",
      "website": "https://www.getrizon.com",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Rizon app (iOS, Android)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Rizon Global, Inc. (agent Rizon Technologies, UAB)",
          "required": true
        },
        {
          "name": "Rizon backend",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Rizon Global, Inc.",
          "required": true
        },
        {
          "name": "Privy embedded wallet (user signer)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Privy",
          "required": true
        },
        {
          "name": "Rain collateral smart contract per user (addresses not published)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Signify Holdings (Rain)",
          "required": true
        },
        {
          "name": "Rain card platform (program management, collateral, liquidation)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Signify Holdings, Inc. / Nimbus LLC (Rain)",
          "required": true
        },
        {
          "name": "Third National (card issuer)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Third National",
          "required": true
        },
        {
          "name": "Visa",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Identity verification partner (not named)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/11822548-rizon-global-inc-spend-card-terms",
              "detail": "The Rizon Global card terms let Rizon and the issuer block transactions and suspend account access for activity that does not fit consumer patterns.",
              "quote": "reserve the right to block and terminate transactions and suspend access to your Account",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Rizon and the issuer can block individual cardholders' transactions and suspend accounts at their discretion. No contract-level role could be read, because no Rizon contract address is published (see notes).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/terms-of-service",
              "detail": "The Terms say each user is assigned a smart contract managed in part by Rain to enable the card off-ramp; card spending converts collateral to fiat through Rain and its licensed partners.",
              "quote": "which is managed in part by Rain to enable Card Off-Ramp service",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Card payments settle through Rain, the issuer Third National and Visa. Users cannot settle a card payment themselves.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/privacy-policy",
              "detail": "Card issuance, smart contract wallets and digital asset transfers are provided solely by Rain, and wallet functionality by Privy.",
              "quote": "are provided solely by Signify Holdings Inc. and its subsidiary Nimbus LLC (Rain)",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card payment depends on Rain's closed platform, Privy and the issuer. No code is public and there is no fallback. Closed, single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/terms-of-service",
              "detail": "The Terms exclude users in jurisdictions sanctioned under EU, OFAC or UN law and require KYC through Rain.",
              "quote": "Users in jurisdictions subject to sanctions or restrictions under EU, OFAC, or UN laws are not allowed to access the App",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Sanctions and geographic screening is disclosed in the Terms, with the list sources named. Whether the settlement contracts filter cannot be checked, because no contract is identified. Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/11822548-rizon-global-inc-spend-card-terms",
              "detail": "The card terms define Supported Blockchains as Polygon, Optimism and Arbitrum plus any the issuer adds, and let the issuer choose which digital assets count as collateral; no tokens or freeze powers are listed.",
              "quote": "means the Polygon Blockchain, Optimism Blockchain, Arbitrium Blockchain",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/13441229-which-blockchains-are-supported",
              "detail": "Rizon's help centre lists a different set (Arbitrum, Solana, Base, Polygon, Optimism, Avalanche, BSC).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The card terms name chains but not tokens, and Rizon's own help centre gives a different chain list. Neither states the issuers' freeze powers or the sequencer assumptions. Judgment call: tokens are not enumerated and the chain lists conflict, so 0, not 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/privacy-policy",
              "detail": "Wallet functionality is powered by Privy and the card, smart contract wallets and transfers by Rain; both are closed third-party services.",
              "quote": "All wallet functionality is powered by Privy",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The required components (Rain, Privy, the issuer, the Rizon app) are closed, so nothing needed to run the product can be forked.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/privacy-policy",
              "detail": "The privacy policy describes identity verification data from partners, sanctions and PEP database checks and AML retention of up to eight years under Lithuanian law.",
              "quote": "we collaborate with identity verification partners who provide us with access to specific personal data",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC and screening data are collected beyond settlement needs and disclosed in the privacy policy only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/privacy-policy",
              "detail": "Names Rain (Signify Holdings, Nimbus LLC) and Privy as providers in the payment path; the identity verification partner is not named.",
              "quote": "are provided solely by Signify Holdings Inc. and its subsidiary Nimbus LLC (Rain)",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Rain, Privy, the issuer and an unnamed KYC partner all see user and payment data. They are disclosed in docs and cannot be swapped, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The app is operated by Rizon Global, Inc. (Delaware), with Rizon Technologies, UAB (Lithuania) as commercial agent; the Terms present Rizon as a non-custodial software interface that provides no regulated financial services (https://www.getrizon.com/terms-of-service). The card is issued by Third National under licence from Visa, with Rain (Signify Holdings, Inc. and Nimbus LLC) running the card and collateral services; the card terms say neither Rizon nor the issuer holds custody of the collateral, but a fall in collateral value can trigger liquidation (https://intercom.help/rizon/en/articles/11822548-rizon-global-inc-spend-card-terms). Personal data is processed under GDPR and Lithuanian law, with AML records kept up to eight years (https://www.getrizon.com/privacy-policy). I found no primary source naming Third National's regulator.",
      "notes": "Incumbent: no verified contract or public repository needed to run the product was found. Searched: GitHub (repo search \"rizon\" returns only unrelated projects such as the RIZON Cosmos chain and the Rizon IRC network; orgs rizonapp, rizon-app, rizonmoney, rizonfi and others do not exist); getrizon.com pages, Terms, privacy policy and card terms; the Intercom help centre (legal, deposit, card and wallet collections); dashboard.getrizon.com (business login shell, no contract or chain config). The Terms say each user gets a Rain-managed collateral smart contract, but no Rizon or Rain document gives an address, factory or team id for this program. The card terms' Supported Blockchains (Polygon, Optimism, Arbitrum) are Rain boilerplate and conflict with the help centre's list, and Rain's shared collateral contracts serve many programs, so no onchain contract can be attributed to Rizon (same reasoning as the Avalanche Card file). Card Map and review sites were not used as evidence.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "AG",
          "AR",
          "AU",
          "BS",
          "BB",
          "BD",
          "BZ",
          "BR",
          "KY",
          "CO",
          "CR",
          "DM",
          "DO",
          "EC",
          "EG",
          "SV",
          "GH",
          "GD",
          "GT",
          "GY",
          "HN",
          "JP",
          "MY",
          "MX",
          "MA",
          "NZ",
          "PK",
          "PA",
          "PY",
          "PE",
          "PH",
          "KN",
          "LC",
          "VC",
          "SN",
          "SG",
          "SR",
          "TH",
          "TC",
          "UG",
          "AE",
          "US",
          "UY",
          "ZM"
        ],
        "note": "Rizon's help centre lists 44 supported nationalities and says eligibility depends on citizenship (passport), not only residence, so a resident of a listed country with another nationality may fail KYC. The codes here are those nationalities. US citizens get the Rizon US Spend Card; the Rizon Global, Inc. card terms require attesting that you are not a US citizen. The Terms of Service also list jurisdictions where accounts may not be opened under Rain's compliance rules (Afghanistan, Albania, Belarus, Bosnia, Central African Republic, Congo, Croatia, Cuba, Cyprus, Eritrea, Haiti, Iran, Iraq, Kosovo, Lebanon, Liberia, Libya, North Macedonia, Moldova, Montenegro, North Korea, Russia, Serbia, Somalia, Syria, Ukraine, Venezuela, Vietnam, Yemen, Zimbabwe, plus Crimea, Donetsk and Luhansk) and exclude EU-, OFAC- and UN-sanctioned jurisdictions; none of those are on the nationality list. The Terms also say Rizon does not actively market its services in the EU or regions outside the US and Latin America.",
        "evidence": [
          {
            "tier": "claimed",
            "by": "provider",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/13517852-is-rizon-available-for-me",
            "detail": "Rizon's help article gives the full list of supported nationalities and says eligibility follows citizenship.",
            "quote": "Below is the full list of nationalities that Rizon currently support",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.getrizon.com/terms-of-service",
            "detail": "The Terms of Service name the jurisdictions where accounts may not be opened or operated, subject to update by Rain.",
            "quote": "Afghanistan, Albania, Belarus, Bosnia, Central African Republic, Congo, Croatia, Cuba, Cyprus",
            "archive": "data/archive/rizon-card-terms-jurisdictions.txt",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/11822548-rizon-global-inc-spend-card-terms",
            "detail": "The Rizon Global, Inc. card terms require users to attest they are not US citizens.",
            "quote": "You attest that you are not a United States citizen",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle"
          },
          {
            "symbol": "USDT",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Tether"
          }
        ],
        "conversion": "at_spend",
        "note": "Rizon accepts only USDC and USDT deposits (on Arbitrum, Solana, Base, Polygon, Optimism, Avalanche and BSC) into the user's self-custodial wallet. The card is a Rain card: Rizon's Terms say spending converts stablecoins into fiat through Rain and its licensed partners, and the help centre says the dollar balance with the lowest conversion fee is used at the moment of payment, so no single default token is stated. The chain and contract of the Rain collateral holding the spendable balance are not published, and the card terms' Supported Blockchains (Polygon, Optimism, Arbitrum) differ from the deposit list (see C5), so no chain or address is recorded.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/13534577-how-to-top-up-with-stablecoins",
            "detail": "Rizon's help centre says the wallet accepts only USDC and USDT, and lists the supported networks.",
            "quote": "Rizon currently supports USDC and USDT only",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/13441290-can-i-use-the-rizon-card-with-different-currencies",
            "detail": "The help centre says the card uses the user's dollar balance at the moment of payment.",
            "quote": "We automatically use your dollar balance with the lowest available conversion fee to a local currency at the moment of payment",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.getrizon.com/terms-of-service",
            "archive": "data/archive/rizon-card-ops-terms-of-service.txt",
            "detail": "The Terms describe the Rain card as converting stablecoins into fiat for spending.",
            "quote": "enabling Users to spend stablecoins by converting them into Fiat through Rain's and their licensed partners infrastructure",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "getrizon.com (Terms, privacy policy) and the Rizon help centre (no audit linked), GitHub (no Rizon org), the Sherlock report repo and Rain's security page (Rain says its reports are shared under NDA and names Sherlock; its public GitHub, SignifyHQ, holds SDKs only), Privy's security docs and the privy-io/shamir-secret-sharing README, and web searches for Rizon, Rain and Privy audits. Privy's docs also name Doyensec; no Doyensec report is published. No audit of the Rizon app or backend was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Sherlock",
            "date": "2025-02-11",
            "type": "contest",
            "scope": "Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest",
            "url": "https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2025.02.11%20-%20Final%20-%20Rain%20Private%20Best%20Efforts%20Audit%20Contest%20Report.pdf",
            "commit": "6f578d5b9c9fa35bbe857959a50fa5aab4fa611a",
            "repo": "https://github.com/SignifyHQ/collateral-contract-evm-v2",
            "covers_deployed": "unknown",
            "findings": "0 high, 2 medium (statement payoff rounding; missing Chainlink min/max answer check)",
            "note": "Contest ran 2-8 December 2024 on b432939a; 6f578d5 is the fix commit. Rizon's Terms say each user gets a Rain-managed collateral contract, but no address is published and the Rain repo is private, so the deployed version could not be compared with the audited one."
          },
          {
            "auditor": "Zellic",
            "date": "2023-08-15",
            "type": "audit",
            "scope": "Shared component: Privy shamir-secret-sharing TypeScript library (index.ts, csprng.ts), used in Privy's embedded-wallet key sharding",
            "url": "https://github.com/Zellic/publications/blob/master/Privy_Shamir_Secret_Sharing_-_Zellic_Audit_Report.pdf",
            "commit": "cd8422d",
            "repo": "https://github.com/privy-io/shamir-secret-sharing",
            "covers_deployed": "unknown",
            "findings": "1 low (missing input bounds in arithmetic functions); fixed in c9f0ab86",
            "note": "Covers only the open-source secret-sharing library, not Privy's closed key-management service, TEE or SDKs. Which library version Privy runs for Rizon wallets is not known."
          },
          {
            "auditor": "Cure53",
            "date": "2023-04-24",
            "type": "audit",
            "scope": "Shared component: Privy shamir-secret-sharing TypeScript library (src/index.ts), cryptography review and source code audit",
            "url": "https://cure53.de/audit-report_privy-sss-library.pdf",
            "commit": "3383ad927211615f3d70b5ceb5489f8a149be191",
            "repo": "https://github.com/privy-io/shamir-secret-sharing",
            "covers_deployed": "unknown",
            "findings": "1 high (polynomial degree might be less than t-1), 2 informational; all three marked fixed and verified by Cure53",
            "note": "Two-day review in February 2023 (CW06); report dated 24 April 2023. Covers only the open-source library, not Privy's closed key-management service. Superseded in part by the Zellic review."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 8,
        "unk": 15,
        "total": 23
      }
    },
    {
      "slug": "safepal-card",
      "name": "SafePal Card",
      "type": "card",
      "website": "https://www.safepal.com/en/bank",
      "primary_chain": {
        "name": "Arbitrum One",
        "chain_id": 42161,
        "basis": "SafePal's card page says the card and IBAN are offered with Fiat24 and that transactions are made on Arbitrum. Onchain, Fiat24Account.walletProviderMap(8026) = \"SafePal\", and SafePal-referred accounts (e.g. #75546) are debited by Fiat24CardAuthorization 0xe2e3B88B... on Arbitrum. Reads pinned to block 512546136. Excluded: Fiat24's Mantle deployment (SafePal names only Arbitrum) and the SafePal wallet app (closed)."
      },
      "repos": [],
      "contracts": [
        {
          "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
          "chain_id": 42161,
          "role": "Fiat24CardAuthorization proxy (card debits)",
          "verified": "sourcify"
        },
        {
          "address": "0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16",
          "chain_id": 42161,
          "role": "Fiat24CardAuthorizationMarqeta implementation",
          "verified": "sourcify"
        },
        {
          "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
          "chain_id": 42161,
          "role": "EUR24 cash token proxy",
          "verified": "sourcify"
        },
        {
          "address": "0xbE00f3db78688d9704BCb4e0a827aea3a9Cc0D62",
          "chain_id": 42161,
          "role": "USD24 cash token proxy",
          "verified": "sourcify"
        },
        {
          "address": "0xd41F1f0cf89fD239ca4c1F8E8ADA46345c86b0a4",
          "chain_id": 42161,
          "role": "CHF24 cash token proxy",
          "verified": "sourcify"
        },
        {
          "address": "0x7288Ac74d211735374A23707D1518DCbbc0144fd",
          "chain_id": 42161,
          "role": "CNH24 cash token proxy",
          "verified": "none"
        },
        {
          "address": "0x133CAEecA096cA54889db71956c7f75862Ead7A0",
          "chain_id": 42161,
          "role": "Fiat24Account NFT proxy (account status, limits)",
          "verified": "sourcify"
        },
        {
          "address": "0x4582f67698843Dfb6A9F195C0dDee05B0A8C973F",
          "chain_id": 42161,
          "role": "Fiat24 crypto top-up and FX proxy",
          "verified": "sourcify"
        },
        {
          "address": "0x50873C8501143e55349f9938795f69A2BB64b6ca",
          "chain_id": 42161,
          "role": "ProxyAdmin for all Fiat24 proxies (owner is an EOA)",
          "verified": "sourcify"
        },
        {
          "address": "0x40C57923924B5c5c5455c48D93317139ADDaC8fb",
          "chain_id": 42161,
          "role": "SanctionsList oracle read by the cash tokens",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Fiat24CardAuthorization contract (debits the cardholder's cash tokens)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "SR Saphirstein AG (Fiat24); admin EOA 0x1272...9D59",
          "required": true
        },
        {
          "name": "Fiat24 cash tokens EUR24, USD24, CHF24, CNH24 and Fiat24Account NFT",
          "role": "ledger",
          "public": true,
          "license": "MIT",
          "operator": "SR Saphirstein AG (Fiat24)",
          "required": true
        },
        {
          "name": "Fiat24 card authorizer key (sole AUTHORIZER_ROLE holder, an EOA)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "SR Saphirstein AG (Fiat24)",
          "required": true
        },
        {
          "name": "Fiat24 backend and API (api.fiat24.com; KYC, status, payouts)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "SR Saphirstein AG (Fiat24)",
          "required": true
        },
        {
          "name": "Marqeta card processing (named in the authorizer contract)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Marqeta",
          "required": true
        },
        {
          "name": "Fiat24 (SR Saphirstein AG) as card issuer and account provider",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "SR Saphirstein AG",
          "required": true
        },
        {
          "name": "Mastercard (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Mastercard",
          "required": true
        },
        {
          "name": "Fiat24 KYC and onboarding (vendor not named)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "SR Saphirstein AG (Fiat24)",
          "required": true
        },
        {
          "name": "SafePal wallet app (Bank tab, card screens, top-up)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "SafePal",
          "required": false
        },
        {
          "name": "Cardholder's Arbitrum address holding the account NFT and cash tokens",
          "role": "wallet",
          "public": true,
          "license": "none",
          "operator": "Cardholder",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "block_number": 512546136,
              "detail": "EUR24 hasRole(OPERATOR_ROLE, 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59) = true; that address is an EOA (no code, nonce 1350) and also holds DEFAULT_ADMIN_ROLE, which can pause() the token. In the Sourcify-verified Fiat24Token source, transfers require the Fiat24Account status to be Live, and an operator can sendToSundry() any holder's balance.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d1485497667070c54ef182b0f5858b034beac1b6f3089aa2d3188bb1e8929f4fa9b9290000000000000000000000001272c99befa7a70f935edca81bf9a6e85c6d9d59",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA \"hasRole(bytes32,address)(bool)\" $(cast keccak OPERATOR_ROLE) 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59 --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "Fiat24CardAuthorization hasRole(DEFAULT_ADMIN_ROLE, 0x1272...9D59) = true and the same EOA holds OPERATOR_ROLE, which can pause() every card authorization; paused() = false at this block.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d1485400000000000000000000000000000000000000000000000000000000000000000000000000000000000000001272c99befa7a70f935edca81bf9a6e85c6d9d59",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59",
              "address": "0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59",
              "block_number": 512546136,
              "eoa": true,
              "detail": "The admin and operator address 0x1272...9D59 has no code (an EOA, not a Safe) and nonce 1350.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/payment-card-terms-and-conditions",
              "detail": "Fiat24's card terms let it block the card on suspicion, on breach, or on other grounds in the agreement or legislation.",
              "quote": "Fiat24 has the right to block the use of the Card until the circumstances have been verified",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "The account terms let Fiat24 suspend or close an account without notice on breach.",
              "quote": "We may at any time suspend or close your Fiat24 Account and/or end the agreement with you without notice",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A single EOA holds the admin and operator roles on the card authorizer and the cash tokens. It can pause card authorizations or all transfers of a currency, and Fiat24 operators can set an individual account to Soft- or Hard-Blocked, which the token contract enforces on every transfer. The terms allow card blocks and account suspension without notice. EOA-held role that can target individual accounts with no notice, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "authorize(), increment(), advice() and reverse() in the verified Fiat24CardAuthorizationMarqeta implementation each revert unless msg.sender has AUTHORIZER_ROLE; hasRole(AUTHORIZER_ROLE, 0xec659e857089E301C87965ED4839B74Ea835755a) = true, and that address is an EOA with nonce 7130096.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x91d1485414dd327f3834be9d0f7cf44f6cf11c96ded83bd68d1a1b3926d35739e7bb88d0000000000000000000000000ec659e857089e301c87965ed4839b74ea835755a",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14 \"hasRole(bytes32,address)(bool)\" $(cast keccak AUTHORIZER_ROLE) 0xec659e857089E301C87965ED4839B74Ea835755a --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/tx/0x568b9d28f19fb3363d2a278bd5ef0463998df007cb89b862ec103a2248dde21f",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "A sample card payment (tx 0x568b9d28...e21f, within the 100,000 blocks before the pinned block) is authorize() sent by the authorizer EOA, carrying a Marqeta card id (\"MQ-730612-CARD-...\") and moving USD24 from account",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Card settlement is a pull executed only by Fiat24's authorizer key after the card network authorizes the payment. Neither the cardholder nor the merchant can settle a card payment by calling the contract. Plain token transfers between Fiat24 accounts are a separate P2P feature, not card settlement.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xec659e857089E301C87965ED4839B74Ea835755a",
              "address": "0xec659e857089E301C87965ED4839B74Ea835755a",
              "block_number": 512546136,
              "eoa": true,
              "detail": "The only observed caller of authorize() is this EOA (nonce 7130096), Fiat24's card authorizer; no code for the service that drives it is public.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-2-api-reference",
              "detail": "Fiat24's API reference (hosted, not in a repo) uses a custom wallet-signature header for its closed API at api.fiat24.com.",
              "quote": "Fiat24 does NOT use any standard protocol for authentication and authorisation",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card payment needs Fiat24's closed authorization service and key, Marqeta processing and Mastercard. None is public, and there is no fallback operator. Closed and single-vendor, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "block_number": 512546136,
              "detail": "EUR24 sanctionCheck() = true and sanctionContract() = 0x40C57923924B5c5c5455c48D93317139ADDaC8fb (Sourcify-verified SanctionsList); the verified tokenTransferAllowed() reverts any transfer to or from a listed address and requires Live account status for the sender.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xb5c9ee0f",
                "expect": "0x00000000000000000000000040c57923924b5c5c5455c48d93317139addac8fb"
              },
              "recheck": "cast call 0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA \"sanctionContract()(address)\" --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "The terms disclose sanctions compliance as a duty of Fiat24, but not that the token contracts screen addresses onchain against an oracle.",
              "quote": "the Swiss sanctions regulations, as well as other sanctions regulations deemed appropriate by us",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Address filtering sits inside the settlement layer itself: the cash tokens check an onchain sanctions oracle and the account's KYC status on every transfer, including the card pull. Judgment call: the check is visible in Sourcify-verified source, but no Fiat24 or SafePal document discloses contract-level screening or its list source, so this takes the lower anchor, 0, rather than 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "validXXX24Tokens() returns true for USD24 0xbE00f3db..., CHF24 0xd41F1f0c..., EUR24 0x2c5d06f5... and CNH24 0x7288Ac74...; these are the card's settlement currencies.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x1b7238770000000000000000000000002c5d06f591d0d8cd43ac232c2b654475a142c7da",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
              },
              "recheck": "cast call 0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14 \"validXXX24Tokens(address)(bool)\" 0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://safepalsupport.zendesk.com/hc/en-us/articles/22646856800027-FAQs-about-the-SafePal-Fiat-Gateway-and-Mastercard",
              "detail": "SafePal's FAQ tells users that cash tokens sent to an unregistered wallet are frozen; it does not mention operator freezes, sanctions screening or Arbitrum sequencer assumptions.",
              "quote": "these assets will be frozen",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The four cash tokens are enumerated in the contract and in Fiat24's developer docs. Users are told about one freeze case (sending tokens to an unregistered address) but not about the issuer's operator powers, the sanctions oracle or Arbitrum's sequencer. Judgment call: a partial freeze statement does not meet \"stated to payees\", so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/42161/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "Sourcify: card authorizer proxy exact_match, implementation 0x96AA3D05... match (partial); EUR24 and USD24 proxies and implementations (0x7aFe16b7..., 0x98BEC5F5...) match (partial); Fiat24Account proxy exact_match, implementation 0x78726B1e... match; ProxyAdmin 0x50873C85... match. Implementation slots read at the pinned block.",
              "checked_at": "2026-10-07",
              "recheck": "for a in 0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14 0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16 0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA 0x7aFe16b7d1A2F4C106E49FD0C2BE852a3a536E96; do curl -s https://sourcify.dev/server/v2/contract/42161/$a | jq -c '{address,match}'; done",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x00000000000000000000000096aa3d05755c54d2745d0dc98ea55e163da5bb16"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement contracts are verified on Sourcify, mostly as partial (metadata) matches; CHF24 is a partial match and the CNH24 proxy is not on Sourcify. No public repository or build script reproduces the bytecode. Partial match without a build script, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/SafePalWallet/safepal-app/tree/319a2f85a69b5f6582183e30de1d704cce267fde/lib",
              "commit": "319a2f85a69b5f6582183e30de1d704cce267fde",
              "path": "lib",
              "detail": "SafePal's only public app repo (a 2024 \"core version\" Flutter app) has no Fiat24, bank or card code; GitHub users fiat24, Fiat24, fiat24-ag and fiat24ag return 404.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "The contract source is public only as Sourcify-verified files.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Only the contracts are public (through Sourcify). The SafePal card screens, Fiat24's backend, the authorizer and the API are closed, and no SDK is published. Contracts only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
              "detail": "Fiat24's developer guide documents contract addresses and functions (approve, authorize flow, payouts, top-up) on a hosted docs site, with the API reference on a separate hosted page.",
              "quote": "needs to approve a certain limit amount for future card spendings",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Interfaces are documented on a hosted docs site, not versioned in a repo. No payee export format is specified. Documented only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "Fiat24 grants users only a limited, non-transferable licence to its web app and API; the backend, authorizer and card processing have no published source.",
              "quote": "non-transferable, non-sub-licensable, worldwide, non-exclusive license to use the Fiat24 Web-App",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Required components (authorizer, backend, card processing, issuer) are closed, so F1 is 0. The verified contracts carry MIT SPDX headers, but they are not in any public repo.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x96AA3D05755C54D2745d0Dc98Ea55E163DA5Bb16",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "Card debits only run through authorize() called by Fiat24's AUTHORIZER_ROLE key; the contracts alone cannot process a card payment.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The card cannot run without Fiat24's hosted authorizer, backend and card processor, none of which has an open alternative. Core cannot run without proprietary components, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Fiat24's privacy policy discloses Google Analytics and Google Tag Manager on its site and web app.",
              "quote": "We use Google Analytics, a web analysis service of Google Ireland Limited",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics is disclosed for Fiat24's web surfaces. The SafePal app, where SafePal users manage the card, is closed and was not traced, and SafePal's own privacy policy names no analytics vendor. Documented cap, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Fiat24 collects identity documents, contact data and transaction data for onboarding.",
              "quote": "Passport and/or photo ID for identity verification purposes",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://safepalsupport.zendesk.com/hc/en-us/articles/22646856800027-FAQs-about-the-SafePal-Fiat-Gateway-and-Mastercard",
              "detail": "SafePal says KYC (and location permission) is required for the card and run by Fiat24.",
              "quote": "The KYC and onboarding process are conducted by Fiat24 for compliance",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Full KYC is required and disclosed in Fiat24's policy and SafePal's FAQ; the legal basis (Swiss AML) is stated in the terms but not limited in code or a repo document. Disclosed in policy, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/tx/0x568b9d28f19fb3363d2a278bd5ef0463998df007cb89b862ec103a2248dde21f",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "The Authorized event indexes the account number (#730612) and holder address, and logs the card id, currency and amount; the calldata also carries the transaction currency and amount. Fiat24 account numbers map to Swiss IBANs.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "The terms tell users that balances and transactions are public on a blockchain and that they waive Swiss bank secrecy.",
              "quote": "you waive the Swiss bank secrecy to this extent",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card spend is public and linked to the cardholder's account number, address, card id and amount, though not to the merchant. The linkage is disclosed in the terms. Account tags in events, disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "The policy discloses sharing with service providers (payment processing, customer service and others) and for KYC and AML compliance, by category; Marqeta appears only in the contract name, and the sanctions oracle is not mentioned.",
              "quote": "We may share information to comply with laws, including KYC, AML, and tax law requirements.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties in the card flow (Fiat24, Marqeta, Mastercard, the KYC vendor) are disclosed by category in Fiat24's policy, and none can be swapped. No trace was run. Docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x7aFe16b7d1A2F4C106E49FD0C2BE852a3a536E96",
              "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "block_number": 512546136,
              "detail": "In the verified Fiat24Token source, sendToSundry(from, amount) lets any OPERATOR_ROLE holder move a holder's balance to the sundry account",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0x133CAEecA096cA54889db71956c7f75862Ead7A0 \"ownerOf(uint256)(address)\" 9103 --rpc-url https://arb1.arbitrum.io/rpc --block 512546136"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
              "detail": "Fiat24 describes the tokens as bank-issued claims on cash deposits.",
              "quote": "These tokens are issued by SR Saphirstein AG, a Swiss licensed deposit-taking institution.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card balance is a Fiat24 deposit represented by tokens in the user's address, not an asset the user controls: the issuer's operator EOA can move any balance, and card pulls land in Fiat24-held EOAs. \"Self-custody\" here means only that the wallet key signs; the provider can redirect funds, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0x50873C8501143e55349f9938795f69A2BB64b6ca",
              "address": "0x50873C8501143e55349f9938795f69A2BB64b6ca",
              "block_number": 512546136,
              "detail": "The EIP-1967 admin slot of the card authorizer, EUR24, USD24 and Fiat24Account proxies all hold ProxyAdmin 0x50873C85...; its owner() is EOA 0x1272c99bEFa7a70f935Edca81BF9a6E85C6D9D59. No timelock or Safe sits in between.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000001272c99befa7a70f935edca81bf9a6e85c6d9d59"
              },
              "recheck": "cast call 0x50873C8501143e55349f9938795f69A2BB64b6ca \"owner()(address)\" --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 512546136,
              "detail": "Card authorizer EIP-1967 admin slot = ProxyAdmin 0x50873C85....",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x00000000000000000000000050873c8501143e55349f9938795f69a2bb64b6ca"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every settlement contract is upgradeable at once by a single EOA, with no timelock. EOA admin, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xbE00f3db78688d9704BCb4e0a827aea3a9Cc0D62",
              "address": "0xbE00f3db78688d9704BCb4e0a827aea3a9Cc0D62",
              "block_number": 512546136,
              "detail": "USD24 allowance(0x259bB9f8b01C7C818dFfe2d998b93c2Ef6b0fC1B, card authorizer) = 2^256-1 for SafePal-referred account",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xdd62ed3e000000000000000000000000259bb9f8b01c7c818dffe2d998b93c2ef6b0fc1b000000000000000000000000e2e3b88b9893e18d0867c08f9ca93f8ab5935b14",
                "expect": "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
              },
              "recheck": "cast call 0x133CAEecA096cA54889db71956c7f75862Ead7A0 \"walletProvider(uint256)(uint256)\" 75546 --rpc-url https://arb1.arbitrum.io/rpc --block 512546136",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
              "detail": "Fiat24's guide shows a bounded approval and says it must be repeated once used; this does not match what SafePal users hold.",
              "quote": "Once the approved amount is used, the approval needs to be repeated.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Most SafePal cardholders have an unlimited allowance to the authorizer, which only Fiat24's key can spend through. Neither SafePal nor Fiat24 discloses that. Judgment call: the app's default is inferred from onchain allowances, not from SafePal code (closed); 10 of 12 sampled accounts are unbounded, so \"unbounded, undisclosed\", 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/42161/0x7aFe16b7d1A2F4C106E49FD0C2BE852a3a536E96",
              "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA",
              "block_number": 512546136,
              "detail": "Cash-token transfers require a Live sender status set by Fiat24 operators, and cash payouts to a bank account need Fiat24's CASH_OPERATOR_ROLE to complete (cashPayoutOK).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Derived. S1 = 0 (operator can move balances), C2 = 0 (only Fiat24's key settles), C3 = 0 (closed single-vendor backend), O3 unknown. The balance is a deposit claim on Fiat24; turning it back into money needs Fiat24's payout operator, and even token transfers depend on Fiat24-set account status. Funds depend on provider liveness, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. Per Fiat24's terms (https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients), Fiat24 is SR Saphirstein AG, Zurich (CHE-256.014.995), holding a FINMA fintech licence under Article 1b of the Swiss Banking Act; the terms state that the Swiss deposit protection scheme does not apply to Fiat24 client deposits and that no interest is paid. The card is a Mastercard debit card issued by Fiat24 (payment card terms). SafePal's page says Fiat24 \"solely handles the compliance and licensing aspect\" of the IBAN account and card.",
      "notes": "SafePal Card is the Fiat24 Mastercard and Swiss IBAN account offered inside the SafePal app. The \"self-custody\" framing is a claim: the card spends Fiat24 cash tokens (EUR24, USD24, CHF24, CNH24) that sit in the user's Arbitrum address but are issued, gated and movable by Fiat24, and card debits are pulled by Fiat24's authorizer key. The SafePal link is onchain: Fiat24Account.walletProviderMap(8026) returns \"SafePal\", and SafePal-referred accounts appear among card payers. All reads are pinned to Arbitrum block 512546136; Arbiscan returns 403 to scripted requests, so explorer links point to Blockscout and Sourcify. Neither SafePal nor Fiat24 publishes a repo for the card. No browser trace was run.",
      "availability": {
        "model": "allowlist",
        "countries": [
          "AT",
          "AU",
          "AX",
          "BE",
          "CA",
          "CH",
          "CY",
          "CZ",
          "DE",
          "DK",
          "EE",
          "ES",
          "FI",
          "FO",
          "FR",
          "GB",
          "GR",
          "HK",
          "HU",
          "IE",
          "IS",
          "IT",
          "JP",
          "KR",
          "LI",
          "LT",
          "LU",
          "LV",
          "MY",
          "NL",
          "NO",
          "NZ",
          "PL",
          "PT",
          "RE",
          "RO",
          "SE",
          "SG",
          "SI",
          "SJ",
          "SK",
          "TW"
        ],
        "note": "The 42 listed places are those SafePal's regions page marks \"with Mastercard support\" (its getMasterCountries list); they match Fiat24's own card-eligible domicile list (info.fiat24.com/api/fiat24/getCountries) exactly. SafePal's wider IBAN-only list adds 19 domiciles with a $1,000/month limit and no card (AD, AM, AR, BD, CL, CO, CR, DM, DO, GE, HR, ID, MK, MX, PE, SM, TH, TR, UY); Fiat24's own list omits HR. Eligibility also needs citizenship of a supported region per SafePal, and Fiat24 excludes US persons and nationals of Iran, North Korea and Russia. SafePal's FAQ mentions a Mainland China limit, but neither current list includes CN, so CN is not listed. Fiat24 also blocks card payments at merchants in 38 countries (its \"restricted payments\" list), which limits where the card works, not who can hold it.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://ep.isafepal.com/bank/v1/account/getMasterCountries",
            "archive": "data/archive/safepal-card-fiat-gateway-regions.txt",
            "quote": "{\"Id\":\"SJM\",\"Name\":\"Svalbard and Jan Mayen\"},{\"Id\":\"SVK\",\"Name\":\"Slovakia\"}",
            "detail": "SafePal's own API behind its \"Supported regions for SafePal Fiat gateway\" page (safepal.com/en/bank/regions), list of regions with Mastercard support. Raw response committed because the page is client-rendered.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.safepal.com/en/bank",
            "quote": "If you are a citizen in any of the supported regions and reside in supported areas, you will be able to open an account",
            "detail": "SafePal card page FAQ, linking to the supported-regions page.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USD24",
            "class": "platform",
            "chain_id": 42161,
            "address": "0xbE00f3db78688d9704BCb4e0a827aea3a9Cc0D62"
          },
          {
            "symbol": "EUR24",
            "class": "platform",
            "chain_id": 42161,
            "address": "0x2c5d06f591D0d8cd43Ac232c2B654475a142c7DA"
          },
          {
            "symbol": "CHF24",
            "class": "platform",
            "chain_id": 42161,
            "address": "0xd41F1f0cf89fD239ca4c1F8E8ADA46345c86b0a4"
          },
          {
            "symbol": "CNH24",
            "class": "platform",
            "chain_id": 42161,
            "address": "0x7288Ac74d211735374A23707D1518DCbbc0144fd"
          }
        ],
        "conversion": "at_top_up",
        "note": "SafePal Card is Fiat24's Mastercard, which spends Fiat24 cash tokens on Arbitrum: USD24, EUR24, CHF24 and CNH24 (RMB). They are tokenised deposits issued by SR Saphirstein AG (Fiat24), the card issuer, backed one-to-one by cash deposits; transfers are gated by Fiat24's KYC status and sanctions checks, so they are classed as platform tokens rather than freely circulating stablecoins. Crypto becomes fiat at top-up: the wallet swaps the user's asset into Arbitrum USDC and Fiat24's top-up contract converts it into a cash token. At spend, Fiat24's card-authorisation contract debits the balance in the transaction currency if Direct Pay is on for it; otherwise it converts from the user-selected default card currency. No default is fixed by Fiat24.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://arbitrum.blockscout.com/address/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
            "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
            "chain_id": 42161,
            "block_number": 512546136,
            "detail": "Fiat24CardAuthorization validXXX24Tokens() returns true for USD24, CHF24, EUR24 and CNH24 (EUR24 check shown).",
            "checked_at": "2026-10-12",
            "check": {
              "call": "0x1b7238770000000000000000000000002c5d06f591d0d8cd43ac232c2b654475a142c7da",
              "expect": "0x0000000000000000000000000000000000000000000000000000000000000001"
            },
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
            "detail": "Fiat24's developer guide names the four cash tokens, their issuer and their deposit backing, and lists all four as supported for the debit card on Arbitrum.",
            "quote": "which are ERC-20 tokens backed one-to-one by cash deposits. These tokens are issued by SR Saphirstein AG, a Swiss licensed deposit-taking institution.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
            "detail": "Crypto top-up converts the wallet's crypto into Fiat24 cash tokens.",
            "quote": "it converts the cryptocurrency from the wallet into our fiat holdings, which are in the form of ERC20 tokens",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
            "detail": "Spending rules; the matching currency balance is charged first (Direct Pay), otherwise the user's chosen default card currency is converted and debited.",
            "quote": "If your card transactions are in these currencies, the corresponding balance will be charged first, avoiding unnecessary foreign exchange fees",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://safepalsupport.zendesk.com/hc/en-us/articles/22646856800027-FAQs-about-the-SafePal-Fiat-Gateway-and-Mastercard",
            "detail": "SafePal's FAQ explains that the 24-tokens in the wallet represent fiat held in the Fiat24 IBAN account that the Mastercard spends.",
            "quote": "Having EUR24, USD24, and CHF24 in your wallet signifies that you possess the equivalent amount of legal currency in your Fiat24 IBAN account",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "SafePal's card page and support FAQ (no audit mentioned), Fiat24's developer and legal docs (no audit or security page), GitHub (no public Fiat24 contracts repository; the Arbitrum sources are on Sourcify only), and auditor portfolios. The only published reports found are BlockSec's three audits of Mantle's fork of the Fiat24 contracts (private repository mantle-xyz/fiat24contracts, client Mantle), listed below as the closest shared code. None is stated to cover the Arbitrum deployment: the Arbitrum Fiat24CardAuthorizationMarqeta implementation 0x96AA3D05... was deployed at block 276754432 (November 2024) and lacks the double-booking functions the 2026 reports review. No report was found for Fiat24Account, the cash tokens' Arbitrum code or the ProxyAdmin set-up.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "BlockSec",
            "date": "2026-07-16",
            "type": "audit",
            "scope": "Shared Fiat24 contracts, Mantle's fork: fee manager, Arbitrum and Tempo deposit paths via LayerZero, DelegationVault, batch double-booking in Fiat24CardAuthorizationMarqeta, BufferPool, CryptoRelay and Fiat24Token changes since ad90880.",
            "url": "https://github.com/blocksecteam/audit-reports/blob/7e41a27c8dd358d027d880144d541efd75aa7da5/solidity/blocksec_mantle_fiat24_contracts_signed_20260716.pdf",
            "commit": "66f0ff159016f7df0b1979e7d9209457f2d793f5",
            "covers_deployed": "no",
            "findings": "7 low (6 fixed, 1 confirmed), 4 recommendations, 1 note",
            "note": "Reviews changes made in Mantle's private fork; the Arbitrum contracts this file scores do not contain them."
          },
          {
            "auditor": "BlockSec",
            "date": "2026-06-08",
            "type": "audit",
            "scope": "Shared Fiat24 contracts, Mantle's fork: new DelegationVault, double-booking in Fiat24CardAuthorizationMarqeta and Fiat24CryptoDeposit_Avax (changes since b670bb8).",
            "url": "https://github.com/blocksecteam/audit-reports/blob/7e41a27c8dd358d027d880144d541efd75aa7da5/solidity/blocksec_mantle_fiat24_contracts_signed_20260608.pdf",
            "commit": "ad908801e2dc30fb805551dc117268312f6fdbc7",
            "covers_deployed": "no",
            "findings": "1 medium and 1 low, both fixed; 5 recommendations, 3 notes",
            "note": "Reviews changes made in Mantle's private fork; the Arbitrum card authorizer has no double-booking functions."
          },
          {
            "auditor": "BlockSec",
            "date": "2025-08-06",
            "type": "audit",
            "scope": "Shared Fiat24 contracts, Mantle's fork: Fiat24CryptoDeposit (and variants), Fiat24CardAuthorizationMarqeta (card authorize/increment/reverse), Fiat24CryptoRelay, FiatTokenBeacon and FiatTokenFactory.",
            "url": "https://github.com/blocksecteam/audit-reports/blob/7e41a27c8dd358d027d880144d541efd75aa7da5/solidity/blocksec_mantle_fiat24_v1.0-signed.pdf",
            "commit": "8fa9f76352a27f901c293552ed1c03b06c9bb3f4",
            "covers_deployed": "unknown",
            "findings": "1 high (fixed), 2 medium, 6 low, 6 recommendations, 7 notes; most medium and low confirmed rather than fixed",
            "note": "Same contract names and card functions (authorize, increment) as the Arbitrum implementation 0x96AA3D05..., but the audited private repository cannot be compared with the Arbitrum source, so whether the deployed card authorizer matches is unknown."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C4"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 2,
        "short": 16,
        "unk": 5,
        "total": 23
      }
    },
    {
      "slug": "solayer-card",
      "name": "Solayer Card (Emerald Card / Solayer Pay)",
      "type": "incumbent",
      "website": "https://solayer.org",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Solayer app (Card tab, wallet connection, deposits)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Solayer Labs, Inc.",
          "required": true
        },
        {
          "name": "Solayer Pay backend with hot and cold wallets",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Solayer Labs, Inc.",
          "required": true
        },
        {
          "name": "Third National (card issuer per Card Terms)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Third National",
          "required": true
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Sumsub identity verification",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub",
          "required": true
        },
        {
          "name": "Solayer docs repo (card terms, guides; not needed to run)",
          "role": "other",
          "public": true,
          "license": "none",
          "operator": "Solayer Labs",
          "required": false,
          "repo": "https://github.com/solayer-labs/solayer_docs"
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
              "quote": "with or without cause and with or without giving you notice",
              "detail": "International Card Terms s9 let Solayer or the Issuer suspend, revoke or cancel the account or card, or deny any transaction, at any time in their sole discretion.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Solayer and the issuer can suspend an individual account or card, or deny any transaction, without cause or notice. Anchor 0. No settlement contract was found to assess.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
              "quote": "Issuer is the creditor responsible for funding your payments for goods and services",
              "detail": "Card Terms s2 make the issuer (Third National, s1) fund each purchase; Solayer then recovers it from the user's balance or collateral.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The issuer pays the merchant over Visa and Solayer recovers the amount. There is no direct payer or payee contract path.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/solayer-pay/security",
              "quote": "Hot wallets are what make your Solayer Pay feel instant.",
              "detail": "The Security page says card swipes and merchant payments go through Solayer's hot-wallet layer, backed by Solayer-run cold storage.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every payment depends on Solayer's closed wallet layer and backend, the issuer and Visa. None is public; no fallback. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/solayer-pay/eligibility",
              "quote": "Countries subject to economic or trade sanctions that prevent financial services from being offered.",
              "detail": "The Eligibility page lists 17 restricted US states and 96 restricted countries and territories (residents or citizens), with sanctions, regulation and security as the reasons; the Card Terms require that the user is not OFAC-sanctioned.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Geographic and sanctions filtering is disclosed in docs (also versioned in the public solayer_docs repo) and enforced in closed services. It cannot be bypassed (C2 = 0). 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
              "quote": "means the Solana Blockchain and other blockchain networks",
              "detail": "Card Terms define Supported Blockchains as Solana plus networks the Issuer may add; the Overview says the card spends USDC and is \"built on Solayer Chain\". Neither names USDC's issuer freeze powers or Solayer Chain's operator assumptions.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The token (USDC) and chains are named in docs only, and the docs disagree on the chain: the Card Terms say Solana, the product pages say Solayer Chain. Freeze powers are not stated. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/solayer-labs/solayer_docs/tree/b9c496574409c9e8ef9250296db189661208dba5/solayer-pay",
              "commit": "b9c496574409c9e8ef9250296db189661208dba5",
              "path": "solayer-pay",
              "detail": "The only Solayer Pay material on GitHub is documentation in solayer_docs; none of the 15 solayer-labs repos (agave fork, solayer-rpc, solayer-cli, token-metadata and others) contains card, deposit or wallet code.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Nothing needed to run the card is public. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/solayer-pay/security",
              "quote": "Hot wallets are what make your Solayer Pay feel instant.",
              "detail": "The payment path runs on Solayer's closed wallet and backend; the public solayer_docs repo has no LICENSE file and is not needed to run the product.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Required components are closed, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/solayer-pay/security",
              "quote": "Hot wallets are what make your Solayer Pay feel instant.",
              "detail": "Card payments need Solayer's hot-wallet layer and the issuer.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The product cannot run without proprietary hosted services. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/solayer-pay/tutorials/kyc",
              "quote": "redirected to our verification partner",
              "detail": "The KYC guide (Sumsub) collects country, state, city, address, postal code, occupation, annual salary, email, an identity document (front and back) and a liveness check.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC plus occupation and salary goes beyond settlement needs. It is disclosed in the guide, with no stated legal basis. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
              "quote": "The issuer for this card program is Third National.",
              "detail": "The Card Terms name the issuer and the KYC guide names Sumsub; the FAQ says personal information is handled per the card provider's privacy policy.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The issuer, Visa and Sumsub are named in docs and are not swappable. No Solayer privacy policy was found (solayer.org/privacy returns 404). Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/solayer-pay/security",
              "quote": "the majority of your assets live in",
              "detail": "The Security page says card funds sit in Solayer-run hot wallets (operational balance) and multi-signature cold storage; the US Card Terms instead say collateral is held in the user's custody in smart contracts, with no address given.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Solayer's own Security page describes provider-held hot and cold wallets. The Card Terms template's user-custody smart-contract claim names no contract and contradicts that page. Judgment call: taking the lower reading, provider-held and disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/us-card-terms",
              "quote": "To withdraw your Collateral, you must provide Solayer at least (3) business days prior notice.",
              "detail": "US Card Terms make withdrawal a request to Solayer with three business days' notice; the Security page puts balances in Solayer-run wallets.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived: funds are provider-held (S1 = 1), there is no direct settlement path (C2 = 0), every service is closed and single-vendor (C3 = 0), and nothing can be self-hosted. Withdrawal is a request to Solayer. Funds depend on Solayer being live. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The Card Terms name Third National as issuer under licence from Visa, and the US terms describe a credit card with no set line of credit secured by collateral. The account-opening notice is Third National's GLBA privacy notice. I found no primary source naming Solayer's own licences or regulator.",
      "notes": "Eligibility: no verified contract and no public repository needed to run the card, so type is incumbent. Chain: the Card Terms define Supported Blockchains as Solana; product pages say the card is \"built on Solayer Chain\" (InfiniSVM). Neither names a deposit address or program, so I could not decide between them from evidence and recorded both. Searched 2026-10-07: docs.solayer.org llms.txt and every solayer-pay page (overview, card, portfolio, security, eligibility, fees, register, KYC, top-up, FAQ) and legal pages; github.com/solayer-labs (15 repos; card material only in solayer_docs); solayer.org/terms (website terms); solayer.org/privacy (404). The Card Terms are Rain's template (Third National, collateral, Supported Blockchains); Rain's Solana collateral program id is not published (SignifyHQ examples repo has IDLs only). Re-assess as type card if a deposit or collateral program is published.",
      "availability": {
        "model": "blocklist",
        "countries": [
          "AF",
          "AL",
          "AD",
          "AU",
          "AT",
          "BY",
          "BE",
          "BA",
          "BG",
          "BF",
          "BI",
          "KH",
          "CA",
          "CF",
          "CN",
          "HR",
          "CU",
          "CY",
          "CZ",
          "CD",
          "DK",
          "ER",
          "EE",
          "FI",
          "FR",
          "GE",
          "DE",
          "GR",
          "GN",
          "GW",
          "HT",
          "HU",
          "IS",
          "IN",
          "ID",
          "IR",
          "IQ",
          "IE",
          "IL",
          "IT",
          "JM",
          "JO",
          "XK",
          "LA",
          "LV",
          "LB",
          "LR",
          "LY",
          "LT",
          "LU",
          "MY",
          "ML",
          "MT",
          "MD",
          "MC",
          "ME",
          "MA",
          "MZ",
          "MM",
          "NL",
          "NZ",
          "NI",
          "NG",
          "KP",
          "NO",
          "PS",
          "PL",
          "PT",
          "QA",
          "RO",
          "RU",
          "SM",
          "RS",
          "SK",
          "SO",
          "ZA",
          "KR",
          "ES",
          "SD",
          "SE",
          "CH",
          "SY",
          "TH",
          "TR",
          "UG",
          "UA",
          "AE",
          "GB",
          "VU",
          "VE",
          "EH",
          "YE",
          "PW",
          "NP",
          "VN"
        ],
        "note": "Solayer's Eligibility page lists 96 restricted countries and territories, applying to residents or citizens regardless of where they live. Darfur is listed separately and is covered by Sudan (SD); \"Eritea\" is read as Eritrea (ER). Every EU member except Slovenia is listed, so the codes are given individually rather than as EU. Residents of 17 US states are also not eligible: Arizona, Delaware, Georgia, Idaho, Louisiana, Maryland, Montana, Nevada, New Mexico, North Dakota, Ohio, Oregon, Rhode Island, South Dakota, Vermont, Washington, Wisconsin. Two card programmes: the international card terms require attesting that you are not a US citizen; US residents get the separate US card agreement.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/solayer-pay/eligibility",
            "detail": "The Eligibility page lists the restricted US states and 96 restricted countries and territories for the Solayer Card.",
            "quote": "are not eligible to sign up for the Solayer Card, regardless of their current place of residence",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
            "detail": "The international card terms are for non-US citizens; US users are covered by the separate US card terms.",
            "quote": "You attest that you are not a United States citizen",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true
          }
        ],
        "conversion": "at_spend",
        "note": "The card spends USDC with no conversion at top-up. The Card Terms make the deposited digital asset collateral that is liquidated by smart contract to repay each purchase. Users can opt into sUSD, Solayer's yield-bearing stablecoin, for savings, but the docs describe spending from USDC. The chain is unsettled: the Card Terms name Solana as the Supported Blockchain, while the product pages say Solayer Pay runs on Solayer Chain, so no chain or mint address is given.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/solayer-pay/overview",
            "detail": "The Overview says the card spends directly from USDC with no pre-conversion and runs on Solayer Chain.",
            "quote": "Spend directly from USDC",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/resources/legal/us-card-terms",
            "detail": "The US Card Terms say collateral stays in smart contracts on the Supported Blockchains and is liquidated to repay card charges.",
            "quote": "the Collateral will be foreclosed and liquidated by the smart contract in order to repay the outstanding balance on your Card",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "Solayer's Audits page (docs.solayer.org/resources/security/audits) and the Solayer Pay Security page, the solayer-labs GitHub org (solayer-improvement-proposal audits/ folder, token-metadata), Rain's security page (audits under NDA, Sherlock named) and the Sherlock report repo. The listed OtterSec and Halborn reports (2024) cover the restaking, endoAVS, pool, sUSD and token-metadata programs, none of which is in the card's USDC spending path, so they are not logged. No audit of Solayer Pay, its hot and cold wallets or a card collateral program is published. Rain's Sherlock contest of its EVM collateral contracts is not logged: the docs put card funds in Solayer-run wallets on Solana or Solayer Chain, not in Rain's EVM contracts.",
        "checked_at": "2026-10-13",
        "reports": []
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P1",
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 12,
        "unk": 11,
        "total": 23
      }
    },
    {
      "slug": "tongo",
      "name": "Tongo (confidential ERC-20 on Starknet)",
      "type": "transfer",
      "website": "https://tongo.cash",
      "primary_chain": {
        "name": "Starknet",
        "caip2": "starknet:SN_MAIN",
        "basis": "Tongo runs only on Starknet. The docs instances page lists the mainnet v2 Vaults and Tongo ledgers (USDC, STRK, ETH, USDT, WBTC) and the legacy v1 instances. Unit: the v2 canonical ledgers and their Vaults, class hashes 0x072c…471e (Tongo) and 0x044d…121f (Vault), which match onchain at Starknet block 16117583. Excluded: v1 instances, the Sepolia deployments, tongo-evm (a separate repo with no mainnet deployment listed), and the optional Relayer. Starknet addresses do not fit the schema's address format, so `contracts` is empty and onchain reads are recorded in findings and the research log."
      },
      "repos": [
        {
          "url": "https://github.com/fatlabsxyz/tongo",
          "role": "contracts",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/fatlabsxyz/she",
          "role": "sdk",
          "license": "Apache-2.0"
        }
      ],
      "contracts": [],
      "components": [
        {
          "name": "Tongo ledger contracts (v2 canonical instances)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Owner 0x3bb4…a4e7 (external-transfer approvals only; no auditor)",
          "required": true,
          "repo": "https://github.com/fatlabsxyz/tongo"
        },
        {
          "name": "Vault contracts (hold the ERC-20 reserve, deploy ledgers)",
          "role": "contracts",
          "public": true,
          "license": "Apache-2.0",
          "operator": "none (no owner)",
          "required": true,
          "repo": "https://github.com/fatlabsxyz/tongo"
        },
        {
          "name": "SHE proof library (Cairo verifier and TypeScript provers)",
          "role": "sdk",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/fatlabsxyz/she"
        },
        {
          "name": "@fatsolutions/tongo-sdk (client-side proving and transaction building)",
          "role": "sdk",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/fatlabsxyz/tongo"
        },
        {
          "name": "Starknet mainnet and a JSON-RPC endpoint of the user's choice",
          "role": "ledger",
          "public": true,
          "license": "Apache-2.0",
          "operator": "StarkWare-operated sequencer; RPC chosen by the user",
          "required": true,
          "repo": "https://github.com/starkware-libs/sequencer"
        },
        {
          "name": "Tongo Relayer contract (optional gasless path)",
          "role": "relayer",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Relayer owner (whitelists ledgers, assets and forwarders)",
          "required": false,
          "repo": "https://github.com/fatlabsxyz/tongo"
        },
        {
          "name": "AVNU paymaster used by the Relayer",
          "role": "paymaster",
          "public": false,
          "license": "proprietary",
          "operator": "AVNU",
          "required": false
        },
        {
          "name": "Demo frontend (demo.tongo.cash)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Fat Solutions",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/tongo/Tongo.cairo#L535-L566",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/contracts/src/tongo/Tongo.cairo",
              "detail": "The ledger owner's only powers are change_auditor_key (rejected if the instance has no auditor) and approveTongo/revokeTongo, which gate receive_external_transfer from other ledgers. There is no pause, freeze, blacklist or replace_class in Tongo.cairo or Vault.cairo, and the Vault has no owner.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s -X POST -H 'content-type:application/json' https://starknet-rpc.publicnode.com -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"starknet_call\",\"params\":{\"request\":{\"contract_address\":\"0x00b32618c475b2fb50b0facd2c49136be6e77281834dc86bdae652680faad4d3\",\"entry_point_selector\":\"0x2f9dcd9248258202f28bd37f3175e5a6107267df83a34999b7ac96f0d53d62e\",\"calldata\":[]},\"block_id\":\"latest\"}}' | jq -c .result",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tongo.cash/protocol/vault.html",
              "quote": "Tongo contracts have a set owner (and an optional auditor) that have full control of the contract",
              "detail": "The docs describe the owner's control in broad terms; the code limits it to auditor rotation and external-transfer approval.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement contracts have no pause, freeze, blacklist or upgrade path. At Starknet block 16117583, get_tongo_config on the USDC, STRK and ETH v2 ledgers returned owner 0x3bb4…a4e7 and no auditor (Option::None). The owner can therefore only allow or refuse external transfers from other ledgers, which ordinary transfers within a ledger do not use. The docs' phrase \"full control of the contract\" overstates what the code allows. Judgment call: the substance fits 3, but 3 needs onchain evidence, and the schema cannot hold Starknet addresses, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/tongo/Tongo.cairo#L191-L294",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/contracts/src/tongo/Tongo.cairo",
              "detail": "fund, transfer, withdraw and ragequit are external and authorised only by the zero-knowledge proof for the Tongo key; withdraw sends ERC-20 to any Starknet address named in the proof, and any caller may submit.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/contracts/src/tongo/Tongo.cairo?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | sed -n 191,294p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tongo.cash/protocol/contracts.html",
              "quote": "Tongo 0x00b32618c475b2fb50b0facd2c49136be6e77281834dc86bdae652680faad4d3",
              "detail": "Addresses and class hashes are listed in the docs; the ABIs ship in the SDK (packages/tongo-sdk/src/abi).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer funds a Tongo account and transfers to the payee's public key, and the payee rolls over and withdraws. Every step is a direct contract call with a proof built client-side by the public SDK. A Starknet account pays the gas, and no provider signature or relayer is involved. The Relayer is an optional alternative for users without a Starknet account. Addresses and ABIs are documented. Judgment call: the substance fits 3, but 3 needs onchain evidence that the schema cannot express for Starknet, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/tongo-sdk/src/account/account.data.service.ts#L200-L215",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/tongo-sdk/src/account/account.data.service.ts",
              "detail": "The SDK reads account history from Starknet events through the RpcProvider the integrator supplies; the SDK source contains no hardcoded service URL.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/tongo-sdk/src/account/account.data.service.ts?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | sed -n 200,215p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tongo.cash/protocol/relayer.html",
              "quote": "The Relayer has an owner that manages whitelists",
              "detail": "The Relayer and the AVNU paymaster behind it serve only users without a funded Starknet account.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No relayer, paymaster, indexer or API is required. Proofs are made client-side, state comes from the RPC, and the user can pay gas from their own Starknet account. The optional Relayer path depends on AVNU's paymaster and on the Relayer owner's whitelists.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/tongo/Tongo.cairo#L191-L294",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/contracts/src/tongo/Tongo.cairo",
              "detail": "Settlement checks only proofs, nonces and balances; there is no address or country check. A grep of the SDK source for country, geolocation, sanction and chainalysis finds nothing.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/contracts/src/tongo/Tongo.cairo?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | grep -niE \"sanction|blacklist|blocklist|country\"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The contracts and SDK contain no filtering. The demo frontend is closed and was not inspected. The Relayer's whitelists cover ledgers, assets and forwarders, not users. Judgment call: 3 needs a package or trace, and the Starknet sequencer is a further point of filtering outside this code, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tongo.cash/protocol/contracts.html",
              "quote": "Here we list the Tongo instances deployed on mainnet and sepolia",
              "detail": "The docs enumerate the wrapped ERC-20s (native USDC, STRK, ETH, USDT, WBTC) with their Vault and ledger addresses; the SDK has no token list.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens are enumerated in the docs, and onchain through each Vault's get_vault_config, which we read but cannot cite as onchain evidence here. No document tells users that Circle can freeze native USDC held by a Vault. Nor does any document state that Starknet's single StarkWare sequencer can censor transactions. Scored 1: enumerated in docs only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "finding": "The onchain class hashes match the docs (Tongo 0x072c…471e, Vault 0x044d…121f), but we could not show that the source compiles to them. Voyager returned 403 and was not bypassed, Starkscan renders client-side, and Starknet has no Sourcify. No rebuild was attempted.",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/tree/7dac05e823f83620fe231605ba81642a178657ad/packages",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages",
              "detail": "The tongo monorepo holds the Cairo contracts (ledger, vault, relayer) and the TypeScript SDK; the SHE proof library is a separate public repo. No frontend repository is public.",
              "checked_at": "2026-10-09",
              "recheck": "gh repo list fatlabsxyz --limit 50 --json name,isArchived"
            }
          ],
          "finding": "Contracts and the SDK are public, and no backend or indexer is needed. The demo frontend at demo.tongo.cash has no public source. Judgment call: anchor 2 means everything but the backend, which here would include the frontend, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/tongo-sdk/README.md#L1-L40",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/tongo-sdk/README.md",
              "detail": "The SDK README covers provider and account setup and operations; deployment parameters are in the docs (Vault deploy_tongo).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Docs exist for using the SDK and deploying ledgers. Reproduction not attempted, so capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/structs/events.cairo#L13-L92",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/contracts/src/structs/events.cairo",
              "detail": "Event structs (Fund, Withdraw, Transfer and others) are defined in the repo, and generated ABIs for Tongo, Vault and Aux ship in packages/tongo-sdk/src/abi.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/tongo-sdk/src/abi?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq '.[].name'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ABIs and event schemas are in the repo. No protocol API exists or is needed. There is no export function; account history is rebuilt from events by the SDK. Judgment call: 2, as for other API-free protocols.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/LICENSE",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "LICENSE",
              "detail": "tongo (contracts and SDK) is Apache-2.0; she is Apache-2.0 (GitHub licence API); the SDK's npm dependencies @fatsolutions/she and @fatsolutions/cairo-abi-codec declare Apache-2.0 and ISC.",
              "checked_at": "2026-10-09",
              "recheck": "for r in tongo she; do echo $r $(gh api repos/fatlabsxyz/$r --jq '.license.spdx_id // \"none\"'); done",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Both repositories needed to run the protocol carry Apache-2.0. The cairo-abi-codec GitHub repo has no LICENSE file, but its npm package declares ISC; we did not list it as a repo. The docs repo is unlicensed but not needed to run.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/LICENSE",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "LICENSE",
              "detail": "LICENSE has two commits, 3e57e0c8 (2025-09-18, \"Add LICENSE\", Apache 2.0) and 439e07e2 (2026-01-27, a one-line edit, still Apache 2.0); the repo has no CONTRIBUTING or CLA file.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/commits?path=LICENSE&sha=7dac05e823f83620fe231605ba81642a178657ad\" --jq '.[].sha'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No CLA and no relicensing event; no written licence-stability commitment.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/tongo-sdk/package.json#L1-L75",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/tongo-sdk/package.json",
              "detail": "The SDK depends on open packages (starknet.js, @scure, @noble, @fatsolutions/she, cairo-abi-codec); no API key or hosted service is configured.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/tongo-sdk/package.json?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | jq .dependencies",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Production use needs only the public contracts, SDK and a Starknet RPC. The AVNU paymaster matters only on the optional Relayer path. Judgment call: no O3 reproduction, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/tongo-sdk/package.json#L1-L75",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/tongo-sdk/package.json",
              "detail": "No analytics, telemetry, error-reporting or fingerprinting dependency in the SDK.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/tongo-sdk/package.json?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | grep -iE \"sentry|analytics|posthog|mixpanel|amplitude|segment|gtag\"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK ships no telemetry. The demo frontend is closed and was not inspected, and no trace was run. Judgment call: absence shown only in code is capped at 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/tongo/Tongo.cairo#L191-L216",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/contracts/src/tongo/Tongo.cairo",
              "detail": "Operations take a public key, amounts (public for fund and withdraw, encrypted for transfer), a destination address, proofs and hints; audit ciphertexts are required only when the instance has an auditor key.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/contracts/src/tongo/Tongo.cairo?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | sed -n 191,216p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The protocol collects nothing beyond keys, amounts and addresses, and no required component holds user data. The canonical v2 ledgers were deployed without an auditor (get_tongo_config returned Option::None at block 16117583), so no third party receives decryptable copies of balances. Per the docs, an auditor cannot be added later. Instances deployed with an auditor would score lower.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/structs/events.cairo#L13-L92",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/contracts/src/structs/events.cairo",
              "detail": "TransferEvent emits the sender and receiver public keys as event keys with only encrypted amounts; FundEvent links the funding Starknet address to the Tongo key with a plaintext amount; WithdrawEvent links the key to the destination address with a plaintext amount.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/contracts/src/structs/events.cairo?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | sed -n 13,92p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tongo hides transfer amounts but not who paid whom. Every transfer publishes the payer's and payee's Tongo public keys. Funding ties a Starknet address to a key, and withdrawal ties a key to a Starknet address, both with plaintext amounts. Users can make fresh keys, but each must be funded. Judgment call: payer-payee linkage is public by design and implied rather than stated in the docs, which stress hidden amounts. Between 1 and 0 we take 1, because the event schema is public in the repo.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/tongo-sdk/README.md#L19-L30",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/tongo-sdk/README.md",
              "detail": "The integrator passes its own RpcProvider (\"YOUR_RPC_PROVIDER\"); the relayed path takes a paymaster URL as a parameter (RelayerAccount).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/tongo-sdk/README.md?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | sed -n 19,30p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "On the direct path only the chosen RPC sees requests. The optional relayed path adds the AVNU paymaster, which is named and set by the caller. Judgment call: 3 would need a package or trace, and the demo frontend was not inspected, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/tongo-sdk/README.md#L19-L30",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/tongo-sdk/README.md",
              "detail": "The RPC is a constructor argument in the SDK; no indexer is used.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/tongo-sdk/README.md?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | sed -n 19,30p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The RPC is configurable in the SDK, and there is no indexer to host. The only official UI (the demo) is closed, so we could not check whether a UI setting exists. Scored 2: configurable via code.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/tongo/Vault.cairo#L150-L190",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/contracts/src/tongo/Vault.cairo",
              "detail": "The Vault releases ERC-20 only to Tongo ledgers it deployed, and ledgers release only on a valid withdraw or ragequit proof by the key holder; neither contract has an owner path to move funds or replace its class.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/contracts/src/tongo/Vault.cairo?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | sed -n 150,190p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Funds sit in a non-upgradeable Vault, released only against the key holder's proof. The provider cannot redirect them. Judgment call: the substance fits 3, but 3 needs onchain evidence that the schema cannot express for Starknet, so 2. The class hashes we read match the docs. Native USDC inherits Circle's freeze power over the Vault address (C5).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/tongo/Tongo.cairo#L40-L46",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/contracts/src/tongo/Tongo.cairo",
              "detail": "Neither Tongo.cairo nor Vault.cairo calls replace_class or has an upgrade entrypoint; on Starknet a contract can change code only through replace_class in its own code.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/contracts/src/tongo/Tongo.cairo?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | grep -c replace_class",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The ledger and Vault classes are non-upgradeable. The docs' class hashes match getClassHashAt for the v2 instances at block 16117583, but we could not verify that this source compiles to them (O1). Judgment call: the substance fits 3, but without onchain evidence in the schema and without class verification, 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/tongo-sdk/src/operations/fund.ts#L80-L91",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/tongo-sdk/src/operations/fund.ts",
              "detail": "populateApprove() approves the ledger for exactly amount x rate of the ERC-20 being funded.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/tongo-sdk/src/operations/fund.ts?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | sed -n 80,91p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The SDK asks for exact-amount approvals, and transfers need none. The ledger's own MAX approval to its Vault is contract-to-contract. Judgment call: the code fits 3, but 3 needs a distributed package or trace, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/tongo/Tongo.cairo#L191-L294",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/contracts/src/tongo/Tongo.cairo",
              "detail": "withdraw and ragequit are callable by anyone with the key holder's proof and send ERC-20 to the address named in the proof.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/contracts/src/tongo/Tongo.cairo?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | sed -n 235,294p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=2, C2=2, C3=3 and O3=1. If Fat Solutions disappears, the non-upgradeable Vault and ledgers keep working. The key holder can withdraw or ragequit, and can keep transferring, with the public SDK and any RPC. S1 and C2 are capped at 2 only by the onchain evidence format, and no public frontend build exists. Scored 2: funds are retrievable through a verified direct path.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/tongo-sdk/.env#L1-L6",
              "commit": "7dac05e823f83620fe231605ba81642a178657ad",
              "path": "packages/tongo-sdk/.env",
              "detail": "A committed .env holds a local devnet RPC (127.0.0.1:5050), devnet test keys and a devnet account; the SDK otherwise keeps the Tongo private key client-side and has no API keys or webhooks.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/fatlabsxyz/tongo/contents/packages/tongo-sdk/.env?ref=7dac05e823f83620fe231605ba81642a178657ad\" --jq .content | base64 -d | cut -d= -f1",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Users' secrets are their Tongo keys, generated and used client-side. Relayed operations are signed with the Tongo key. The repo commits devnet-only test keys in packages/tongo-sdk/.env, a hygiene issue rather than a production secret. Judgment call: 2 (minor issues).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://reports.zksecurity.xyz/reports/tongo/",
              "quote": "On October 13th, 2025, FatSolutions engaged zkSecurity to perform a security audit of its Tongo",
              "detail": "The zkSecurity report covers the SHE library and the Tongo contracts and provers, with findings such as a weak Fiat-Shamir transform in the bit proof; it is also committed at audits/Audit_of_Tongo.pdf.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "One audit, from October 2025, predates the v2 Vault, ledger and Relayer architecture now deployed. We found no audited commit hash in the report text and did not trace fixes. No bug bounty or SECURITY file. Scored 1: audit report only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "The ledger and Vault contracts have no address or country check, and the SDK has no geolocation or country gate. tongo.cash links no terms page, and we found no first-party document listing countries. Judgment call: the closed demo frontend at demo.tongo.cash was not inspected and might geoblock; the SDK path does not depend on it.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/tongo/Tongo.cairo#L191-L294",
            "commit": "7dac05e823f83620fe231605ba81642a178657ad",
            "path": "packages/contracts/src/tongo/Tongo.cairo",
            "detail": "fund, withdraw and ragequit check proofs, nonces and balances only; no caller, address or country restriction.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: the v2 canonical Tongo ledgers and Vaults on Starknet mainnet. Starknet state was read via starknet-rpc.publicnode.com at block 16117583, using starknet_call and starknet_getClassHashAt. Those reads cannot be cited as onchain evidence because the schema accepts only 20-byte EVM or base58 addresses. This caps C1, C2, S1 and S2 at 2, as the findings explain. Usage is small: the v2 USDC Vault held 7.78 USDC and the other v2 Vaults held 0, while the larger v1 STRK instance held about 295.6 STRK. Contracts are identical at tag v2.0.0 (47ea644b) and master (7dac05e8). We ran no transactions, built nothing and inspected no frontend.",
      "audits": {
        "searched": "The audits/ folders and READMEs of github.com/fatlabsxyz/tongo and fatlabsxyz/she, the docs at docs.tongo.cash, and zkSecurity's public report index (reports.zksecurity.xyz). Both READMEs name only the zkSecurity audit.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "zkSecurity",
            "date": "2025-10",
            "type": "audit",
            "scope": "SHE homomorphic encryption library (Cairo verifiers and TypeScript sigma-protocol provers) and the Tongo Cairo contracts and SDK provers",
            "url": "https://reports.zksecurity.xyz/reports/tongo/",
            "repo": "https://github.com/fatlabsxyz/tongo",
            "covers_deployed": "partly",
            "findings": "2 high, 2 medium, 5 low, 2 informational",
            "note": "Engagement began 2025-10-13 for two weeks on private repositories; the report gives no audited commit. The same report is committed at audits/Audit_of_Tongo.pdf in both repos. It predates the v2 Vault and ledger architecture deployed on Starknet."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 1,
          "limiting": [
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1"
          ]
        },
        "F": {
          "score": 2,
          "limiting": [
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 1,
          "limiting": [
            "P3"
          ]
        },
        "S": {
          "score": 1,
          "limiting": [
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 17,
        "short": 5,
        "unk": 1,
        "total": 23
      }
    },
    {
      "slug": "tornado-cash",
      "name": "Tornado Cash (Classic pools)",
      "type": "transfer",
      "website": "https://github.com/tornadocash",
      "primary_chain": {
        "name": "Ethereum",
        "chain_id": 1,
        "basis": "The classic UI's networkConfig.js (tornado-classic-ui@a83fae07 L11-L60) lists Ethereum mainnet first (netId1, deployedBlock 9116966), and the onchain InstanceRegistry 0xB20c…A911 lists 19 enabled mainnet instances. Unit: the 4 ETH pools (0.1/1/10/100) and the 8 stablecoin pools (DAI 100-100k, USDC 100/1k, USDT 100/1k). Excluded: cDAI and WBTC pools, other chains (BSC, Polygon, Gnosis, Arbitrum, Optimism, Avalanche), Nova, and governance-only contracts (staking, vesting)."
      },
      "repos": [
        {
          "url": "https://github.com/tornadocash/tornado-core",
          "role": "contracts",
          "license": "GPL-3.0"
        },
        {
          "url": "https://github.com/tornadocash/tornado-classic-ui",
          "role": "frontend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/tornadocash/tornado-cli",
          "role": "sdk",
          "license": "none"
        },
        {
          "url": "https://github.com/tornadocash/tornado-relayer",
          "role": "backend",
          "license": "none"
        },
        {
          "url": "https://github.com/tornadocash/tornado-governance",
          "role": "contracts",
          "license": "MIT"
        },
        {
          "url": "https://github.com/tornadocash/tornado-subgraph",
          "role": "indexer",
          "license": "none"
        },
        {
          "url": "https://github.com/tornadocash/websnark",
          "role": "sdk",
          "license": "GPL-3.0"
        },
        {
          "url": "https://github.com/tornadocash/snarkjs",
          "role": "sdk",
          "license": "GPL-3.0"
        },
        {
          "url": "https://github.com/tornadocash/circomlib",
          "role": "sdk",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc",
          "chain_id": 1,
          "role": "ETH 0.1 pool",
          "verified": "sourcify"
        },
        {
          "address": "0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
          "chain_id": 1,
          "role": "ETH 1 pool",
          "verified": "sourcify"
        },
        {
          "address": "0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF",
          "chain_id": 1,
          "role": "ETH 10 pool",
          "verified": "sourcify"
        },
        {
          "address": "0xA160cdAB225685dA1d56aa342Ad8841c3b53f291",
          "chain_id": 1,
          "role": "ETH 100 pool",
          "verified": "sourcify"
        },
        {
          "address": "0xD4B88Df4D29F5CedD6857912842cff3b20C8Cfa3",
          "chain_id": 1,
          "role": "DAI 100 pool",
          "verified": "sourcify"
        },
        {
          "address": "0xFD8610d20aA15b7B2E3Be39B396a1bC3516c7144",
          "chain_id": 1,
          "role": "DAI 1000 pool",
          "verified": "sourcify"
        },
        {
          "address": "0x07687e702b410Fa43f4cB4Af7FA097918ffD2730",
          "chain_id": 1,
          "role": "DAI 10000 pool (0.7.6 build, no operator)",
          "verified": "sourcify"
        },
        {
          "address": "0x23773E65ed146A459791799d01336DB287f25334",
          "chain_id": 1,
          "role": "DAI 100000 pool (0.7.6 build, no operator)",
          "verified": "sourcify"
        },
        {
          "address": "0xd96f2B1c14Db8458374d9Aca76E26c3D18364307",
          "chain_id": 1,
          "role": "USDC 100 pool",
          "verified": "sourcify"
        },
        {
          "address": "0x4736dCf1b7A3d580672CcE6E7c65cd5cc9cFBa9D",
          "chain_id": 1,
          "role": "USDC 1000 pool",
          "verified": "sourcify"
        },
        {
          "address": "0x169AD27A470D064DEDE56a2D3ff727986b15D52B",
          "chain_id": 1,
          "role": "USDT 100 pool",
          "verified": "sourcify"
        },
        {
          "address": "0x0836222F2B2B24A3F36f98668Ed8F0B38D1a872f",
          "chain_id": 1,
          "role": "USDT 1000 pool",
          "verified": "sourcify"
        },
        {
          "address": "0xce172ce1F20EC0B3728c9965470eaf994A03557A",
          "chain_id": 1,
          "role": "Groth16 withdraw verifier (all pools)",
          "verified": "sourcify"
        },
        {
          "address": "0x83584f83f26aF4eDDA9CBe8C730bc87C364b28fe",
          "chain_id": 1,
          "role": "MiMC hasher (generated bytecode)",
          "verified": "none"
        },
        {
          "address": "0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b",
          "chain_id": 1,
          "role": "TornadoRouter (optional UI path)",
          "verified": "sourcify"
        },
        {
          "address": "0xB20c66C4DE72433F3cE747b58B86830c459CA911",
          "chain_id": 1,
          "role": "InstanceRegistry proxy (governance admin)",
          "verified": "sourcify"
        },
        {
          "address": "0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2",
          "chain_id": 1,
          "role": "RelayerRegistry proxy (governance admin)",
          "verified": "sourcify"
        },
        {
          "address": "0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce",
          "chain_id": 1,
          "role": "TORN Governance (LoopbackProxy)",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Tornado pool instances (4 ETH, 4 DAI, 2 USDC, 2 USDT)",
          "role": "contracts",
          "public": true,
          "license": "GPL-3.0",
          "operator": "none (operator set to zero address; no proxy)",
          "required": true,
          "repo": "https://github.com/tornadocash/tornado-core"
        },
        {
          "name": "Withdraw verifier and MiMC hasher",
          "role": "contracts",
          "public": true,
          "license": "GPL-3.0",
          "operator": "none (no admin functions)",
          "required": true,
          "repo": "https://github.com/tornadocash/tornado-core"
        },
        {
          "name": "Withdraw circuit and proving key (tornado-core v2.1 release assets)",
          "role": "other",
          "public": true,
          "license": "GPL-3.0",
          "operator": "none (static files from the 2020 trusted setup)",
          "required": true,
          "repo": "https://github.com/tornadocash/tornado-core"
        },
        {
          "name": "Proof-generation client (tornado-core cli.js with websnark, snarkjs, circomlib)",
          "role": "sdk",
          "public": true,
          "license": "GPL-3.0",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/tornadocash/tornado-core"
        },
        {
          "name": "Ethereum mainnet and a JSON-RPC endpoint of the user's choice",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Ethereum validators; RPC chosen by the user",
          "required": true,
          "repo": "https://github.com/ethereum/go-ethereum"
        },
        {
          "name": "tornado-cli (mainnet CLI recommended by the tornado-core README)",
          "role": "sdk",
          "public": true,
          "license": "none",
          "operator": "user",
          "required": false,
          "repo": "https://github.com/tornadocash/tornado-cli"
        },
        {
          "name": "TornadoRouter (deposit and relayed-withdraw entry used by the UI)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "TORN governance (rescueTokens only; not upgradeable)",
          "required": false
        },
        {
          "name": "InstanceRegistry and FeeManager (upgradeable proxies)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "TORN governance",
          "required": false
        },
        {
          "name": "RelayerRegistry (upgradeable proxy) and registered relayers",
          "role": "relayer",
          "public": true,
          "license": "none",
          "operator": "independent relayers staking TORN; registry admin is TORN governance",
          "required": false,
          "repo": "https://github.com/tornadocash/tornado-relayer"
        },
        {
          "name": "TORN governance (LoopbackProxy, TORN token voting)",
          "role": "other",
          "public": true,
          "license": "MIT",
          "operator": "TORN holders",
          "required": false,
          "repo": "https://github.com/tornadocash/tornado-governance"
        },
        {
          "name": "Classic UI (archived GitHub source; live build on IPFS via tornadocash.eth)",
          "role": "frontend",
          "public": true,
          "license": "MIT",
          "operator": "TORN governance controls the tornadocash.eth name",
          "required": false,
          "repo": "https://github.com/tornadocash/tornado-classic-ui"
        },
        {
          "name": "The Graph hosted subgraphs (UI default, hardcoded)",
          "role": "indexer",
          "public": true,
          "license": "none",
          "operator": "The Graph hosted service",
          "required": false,
          "repo": "https://github.com/tornadocash/tornado-subgraph"
        },
        {
          "name": "Chainalysis sanctions oracle lookup in the UI (0x40C5…C8fb)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Chainalysis",
          "required": false
        },
        {
          "name": "ip.tornado.cash IP-echo service called by tornado-cli",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "unknown",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/contracts/Tornado.sol#L28-L34",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "contracts/Tornado.sol",
              "detail": "The only privileged role in the pool source (tag v2.0, solc 0.5.11, the build deployed in Dec 2019) is operator, which can call updateVerifier and changeOperator (L116-L123); there is no pause, freeze, blacklist or allowlist. The Tornado and MerkleTreeWithHistory contracts in the Sourcify source of 0x47CE…2936 are identical to this file apart from line endings.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
              "address": "0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
              "block_number": 26141552,
              "detail": "operator() of the ETH 1 pool returns the zero address at block 26141552; operator() also returns zero on the 0.1, 10, 100 ETH, DAI 100/1000, USDC and USDT pools at block 26141280, and reverts (no such function) on the DAI 10k/100k pools, whose 0.7.6 source has no operator.",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936 \"operator()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x570ca735",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc",
              "address": "0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc",
              "block_number": 26141280,
              "detail": "The ETH 0.1 pool's source adds operator-only migrateState, initializeTreeForMigration and finishMigration; operator() returns zero, so none can be called.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x570ca735",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b",
              "address": "0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b",
              "block_number": 26141552,
              "detail": "The optional TornadoRouter refuses deposits and withdrawals for instances the InstanceRegistry marks DISABLED and calls RelayerRegistry.burn on withdraw; its governance() is the TORN governance proxy 0x5efd…A1Ce. All 19 registry instances read state 1 (enabled) at block 26140925.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x5aa6e675",
                "expect": "0x0000000000000000000000005efda50f22d34f262c29268506c5fa42cb56a1ce"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The pool contracts that hold and release funds have no pause, freeze, blacklist or allowlist. Their one admin role, operator, could only swap the verifier, and it reads as the zero address onchain on every pool that has it; the two newer DAI pools have no operator at all. The verifier has no admin. TORN governance does control a gate one step out: the optional TornadoRouter checks an upgradeable InstanceRegistry and RelayerRegistry, so governance could disable an instance on the router path. Judgment call: we score the pools as the settlement contracts and give 3, because a payer and payee can call the pools directly (C2) and the router gate does not reach that path.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/contracts/Tornado.sol#L62-L92",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "contracts/Tornado.sol",
              "detail": "deposit(commitment) and withdraw(proof, root, nullifierHash, recipient, relayer, fee, refund) are external with no caller check; the relayer is only a fee recipient bound into the proof, and fee may be zero (ETHTornado.sol L29-L40 pays recipient directly).",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/networkConfig.js#L44-L60",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "networkConfig.js",
              "detail": "Mainnet pool addresses per denomination are committed in the UI config, and abis/Instance.abi.json holds the pool ABI.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-classic-ui/contents/networkConfig.js?ref=a83fae0772c8da084c0e76b3a756b456f5b9f5bb\" --jq .content | base64 -d | sed -n 44,60p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/src/cli.js#L193-L240",
              "commit": "1ef6a263ac6a0e476d063fcb269a9df65a1bd56a",
              "path": "src/cli.js",
              "detail": "The reference client sends withdraw directly to the pool from the user's own account when no relayer URL is given (L236).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xA160cdAB225685dA1d56aa342Ad8841c3b53f291",
              "address": "0xA160cdAB225685dA1d56aa342Ad8841c3b53f291",
              "block_number": 26141280,
              "detail": "The deployed ETH 100 pool is a Sourcify match to this source and has no proxy (EIP-1967 implementation slot zero).",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://sourcify.dev/server/v2/contract/1/0xA160cdAB225685dA1d56aa342Ad8841c3b53f291 | jq .match",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer can deposit and a payee holding the note can withdraw by calling the pool contracts directly, with no relayer, router, API or signature from anyone else. Addresses and ABI are committed in the public UI repo, and the reference client calls the pool directly. We did not run a transaction. The payment is completed by handing the note to the payee off-chain; the protocol has no on-chain payee field at deposit time.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/contracts/ETHTornado.sol#L29-L40",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "contracts/ETHTornado.sol",
              "detail": "Withdrawal pays denomination minus fee to the recipient and pays a relayer only if fee > 0; any account may submit the transaction.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/services/events.js#L326-L341",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "services/events.js",
              "detail": "The UI reads deposit events from The Graph and then from the RPC, so the indexer is optional; the proving key is a static GitHub release asset (tornado-core v2.1).",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-classic-ui/contents/services/events.js?ref=a83fae0772c8da084c0e76b3a756b456f5b9f5bb\" --jq .content | base64 -d | sed -n 326,341p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2",
              "address": "0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2",
              "block_number": 26141552,
              "detail": "Relayers are optional; the RelayerRegistry lets anyone owning an ENS subdomain register with minStakeAmount 5000 TORN; relayer code is public (tornado-relayer, archived).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Settlement needs only the pools, a proof client and an Ethereum RPC. A relayer is optional: it exists so a withdrawer can pay gas from the withdrawn amount instead of from a funded account, which matters for privacy but not for settlement. The indexer is optional too, as the UI falls back to RPC event reads. Judgment call: we score 3 although withdrawing to a fresh address without a relayer needs gas from elsewhere, which can reduce privacy (see P3); the cell measures whether settlement depends on a hosted intermediary, and it does not.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/store/metamask.js#L333-L346",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "store/metamask.js",
              "detail": "On wallet connect (L427) the UI calls isSanctioned(address) on the Chainalysis sanctions oracle 0x40C57923924B5c5c5455c48D93317139ADDaC8fb and, if true, redirects the page away; pages/451.vue shows \"Unavailable For Legal Reasons\".",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-classic-ui/contents/store/metamask.js?ref=a83fae0772c8da084c0e76b3a756b456f5b9f5bb\" --jq .content | base64 -d | sed -n 333,346p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/contracts/Tornado.sol#L62-L92",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "contracts/Tornado.sol",
              "detail": "The pool contracts check only the commitment, nullifier, Merkle root and proof; there is no address or country check.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF",
              "address": "0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF",
              "block_number": 26141280,
              "detail": "The deployed ETH 10 pool matches that source on Sourcify, so a wallet screened out by the UI can still call it directly (C2).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The pools are neutral: no address or country filtering. The archived classic UI screens the connecting wallet against the Chainalysis sanctions oracle and sends listed addresses away. The check is visible in public code, the list source is identified by its oracle address, and the direct pool path bypasses it. tornado-core's cli.js has no screening. Judgment call: this fits anchor 3 in substance, but 3 needs a distributed package or trace for the client, and we also did not inspect the build currently served at tornadocash.eth, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xB20c66C4DE72433F3cE747b58B86830c459CA911",
              "address": "0xB20c66C4DE72433F3cE747b58B86830c459CA911",
              "block_number": 26140925,
              "detail": "InstanceRegistry lists each instance with its token (DAI 0x6B17…1d0F, USDC 0xA0b8…eB48, USDT 0xdAC1…1ec7, cDAI, WBTC, or ETH) and state; networkConfig.js in the UI enumerates the same per network.",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0xB20c66C4DE72433F3cE747b58B86830c459CA911 \"instances(address)(bool,address,uint8,uint24,uint32)\" 0x4736dCf1b7A3d580672CcE6E7c65cd5cc9cFBa9D --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x032bb44300000000000000000000000047ce0c6ed5b0ce3d3a51fdb1c52dc66a7c3c2936",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "drift": true
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
              "address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
              "block_number": 26141584,
              "detail": "USDC isBlacklisted() returns false for both USDC pools, and USDT isBlackListed() returns false for both USDT pools, at block 26141584; both issuers retain the power to blacklist.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xfe575a870000000000000000000000004736dcf1b7a3d580672cce6e7c65cd5cc9cfba9d",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens and pools are enumerated onchain and in the UI config. Neither the repos nor the UI tell users that USDC and USDT can blacklist a pool address, which would lock every note in that pool; the pools were not blacklisted at our block. ETH and DAI pools carry no issuer freeze. Ethereum L1 has no sequencer. Scored 2: enumerated in code, assumptions not stated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
              "address": "0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
              "block_number": 26141280,
              "detail": "Sourcify returns match (partial, metadata differs) for all 12 pools and the verifier 0xce17…557A, exact_match for the router, registries and FeeManager, and no record for the MiMC hasher 0x8358…28fe.",
              "checked_at": "2026-10-07",
              "recheck": "for a in 0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936 0xce172ce1F20EC0B3728c9965470eaf994A03557A 0x83584f83f26aF4eDDA9CBe8C730bc87C364b28fe; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/1/$a | jq -r .match; done"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/truffle-config.js#L86-L97",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "truffle-config.js",
              "detail": "Tag v2.0 pins solc 0.5.11 with optimizer runs 200, matching the deployed compiler; Verifier.sol is generated from the trusted-setup key and the hasher bytecode by scripts/compileHasher.js, neither committed as source.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The pools and verifier are partial matches on Sourcify, the governance-era contracts are full matches, and the hasher, which every deposit calls, has no Sourcify verification (it is generated bytecode; we could not load Etherscan). No rebuild was attempted. Judgment call: partial matches would support 2, but one settlement-path contract is unverified, so we take anchor 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/tree/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/contracts",
              "commit": "1ef6a263ac6a0e476d063fcb269a9df65a1bd56a",
              "path": "contracts",
              "detail": "All 47 repos in github.com/tornadocash are archived, last pushed between 2019 and 2022-08-22; they include contracts, circuits, CLI, classic UI, relayer, subgraphs and deploy scripts.",
              "checked_at": "2026-10-07",
              "recheck": "gh repo list tornadocash --limit 100 --json name,isArchived,pushedAt"
            }
          ],
          "finding": "Every layer has public source on GitHub, but all of it is archived since 2022. For the immutable pools and the proof client the archive is still the running code. The governance-era router and registries are public only as Sourcify source, and the frontend now served via tornadocash.eth and current relayer builds were not traced to any public repository in this review. Judgment call: between 2 and 1 we take 1, because we could not show the live frontend and relayer builds are public.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/README.md#L5-L22",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "README.md",
              "detail": "The README gives build steps (Node 14, yarn, .env, yarn generate) and an IPFS deploy script; tornado-core README L42-L78 covers build and the CLI.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Build and run documentation exists for the UI and the core client. Reproduction not attempted, so the score is capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/tree/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/abis",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "abis",
              "detail": "ABIs for the pool instance, router (TornadoProxy), RelayerRegistry and governance are committed; Deposit and Withdrawal events are defined in Tornado.sol L36-L37.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-classic-ui/contents/abis?ref=a83fae0772c8da084c0e76b3a756b456f5b9f5bb\" --jq '.[].name'"
            }
          ],
          "finding": "ABIs and event schemas are in the repo. There is no protocol API to document, as no backend is required. There is no payee export function; the note string is the only record a payee holds. Judgment call: we treat the absence of any required API as satisfying the API part, giving 2; no export, so not 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/LICENSE",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "LICENSE",
              "detail": "tornado-core (pools, circuits, verifier generation, cli.js) is GPL-3.0 at the deployed tag; the websnark and snarkjs forks are GPL-3.0 (GitHub license API).",
              "checked_at": "2026-10-07",
              "recheck": "for r in tornado-core websnark snarkjs circomlib tornado-classic-ui tornado-cli tornado-relayer tornado-subgraph; do echo $r $(gh api repos/tornadocash/$r --jq '.license.spdx_id // \"none\"'); done",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/circomlib/blob/c372f14d324d57339c88451834bf2824e73bbdbc/package.json#L25",
              "commit": "c372f14d324d57339c88451834bf2824e73bbdbc",
              "path": "package.json",
              "detail": "The circomlib fork pinned by tornado-core has no LICENSE file; its package.json declares GPL-3.0. tornado-cli has no LICENSE file (package.json says ISC); tornado-relayer and tornado-subgraph have none.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every required component carries an OSI licence: GPL-3.0 for the pools, circuits and proof client, and MIT for the classic UI. The circomlib fork used in proof generation states GPL-3.0 only in package.json, with no LICENSE file; its upstream is GPL-3.0. The optional tornado-cli, relayer and subgraph repos have no LICENSE file. Judgment call: we count the package.json declaration on circomlib as a licence, and we take 2 rather than 3 because of the unlicensed optional repos.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/.github/CONTRIBUTING.md#L1-L12",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": ".github/CONTRIBUTING.md",
              "detail": "The UI's contributing guide asks for focused PRs and has no CLA. tornado-core has no CONTRIBUTING file, and its LICENSE has a single commit, 21a9545b (2019-07-17).",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-core/commits?path=LICENSE&sha=1ef6a263ac6a0e476d063fcb269a9df65a1bd56a\" --jq '.[].sha'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no CLA and no relicensing event, and the GitHub repos are archived. No written licence-stability commitment exists.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/scripts/downloadKeys.js#L4-L30",
              "commit": "1ef6a263ac6a0e476d063fcb269a9df65a1bd56a",
              "path": "scripts/downloadKeys.js",
              "detail": "The circuit and proving key come from tornado-core GitHub release assets (v2.1); the client needs only a user-supplied RPC.",
              "checked_at": "2026-10-07",
              "recheck": "gh api repos/tornadocash/tornado-core/releases --jq '.[0].assets[].name'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No proprietary plugin or hosted-only service is needed. The pools, proving key and client are public, and any Ethereum RPC works. The UI's default Infura and Alchemy RPCs, The Graph, and the Chainalysis oracle are all optional. Judgment call: the code supports 3, but with no O3 reproduction we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/package.json#L21-L61",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "package.json",
              "detail": "None of the UI dependencies is an analytics, telemetry, error-reporting or fingerprinting package; nuxt.config.js L53 sets a CSP with script-src 'self'.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-classic-ui/contents/package.json?ref=a83fae0772c8da084c0e76b3a756b456f5b9f5bb\" --jq .content | base64 -d | grep -iE \"sentry|analytics|gtag|amplitude|mixpanel|segment|posthog|hotjar|fingerprint\"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The archived UI and the core client ship no analytics or telemetry. When a remote RPC is used, tornado-cli calls ip.tornado.cash to show the user's IP; that call is counted under P4. We ran no trace and did not inspect the live IPFS build. Judgment call: absence shown only in code is capped at 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/circuits/withdraw.circom#L29-L39",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "circuits/withdraw.circom",
              "detail": "The public inputs are root, nullifierHash, recipient, relayer, fee and refund. The private inputs (nullifier, secret, Merkle path) stay in the user's client. Deposit takes only a commitment.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-core/contents/circuits/withdraw.circom?ref=7033f34434208cde40503a8daf71c1c0f8dab578\" --jq .content | base64 -d | sed -n 29,39p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The protocol collects only what settlement needs: a commitment at deposit, and recipient, relayer and fee at withdrawal. No required component holds account, identity or contact data. An optional relayer sees the recipient and the proof it relays.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/contracts/Tornado.sol#L36-L37",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "contracts/Tornado.sol",
              "detail": "Deposit emits commitment, leafIndex and timestamp, and the depositor is the tx sender. Withdrawal emits recipient, nullifierHash, relayer and fee. The proof hides which commitment a nullifier spends.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-core/contents/contracts/Tornado.sol?ref=7033f34434208cde40503a8daf71c1c0f8dab578\" --jq .content | base64 -d | sed -n 36,37p"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xce172ce1F20EC0B3728c9965470eaf994A03557A",
              "address": "0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
              "block_number": 26141280,
              "detail": "verifier() on each of the 12 pools returns the Groth16 verifier 0xce17…557A (read at block 26141280). Amounts are fixed per pool by denomination().",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x2b7ac3f3",
                "expect": "0x000000000000000000000000ce172ce1f20ec0b3728c9965470eaf994a03557a"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Onchain data shows who deposited and who received, but not which deposit paid which withdrawal. Amounts are fixed denominations, and there is no memo or invoice field. Linkage can still come from timing, distinctive gas or funding patterns, low pool activity, reused addresses, or the optional router EncryptedNote event, which ties the depositor's address to an encrypted note backup. Judgment call: anonymity-set size depends on user behaviour and is not scored; we score what the code and chain reveal, which is anchor 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/services/graph.js#L22-L31",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "services/graph.js",
              "detail": "The UI queries The Graph hosted-service subgraphs at hardcoded URLs. Its RPC defaults are Infura and Alchemy with build-time keys (networkConfig.js L30-L39), replaceable in Settings. The Chainalysis oracle is read through the RPC.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-classic-ui/contents/services/graph.js?ref=a83fae0772c8da084c0e76b3a756b456f5b9f5bb\" --jq .content | base64 -d | sed -n 22,31p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-cli/blob/378ddf8b8b92a4924037d7b64a94dbfd5a7dd6e8/cli.js#L1226-L1235",
              "commit": "378ddf8b8b92a4924037d7b64a94dbfd5a7dd6e8",
              "path": "cli.js",
              "detail": "tornado-cli calls https://ip.tornado.cash when the RPC is not local, unless the private-RPC flag is set.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "On the minimal required path (core client plus RPC), only the RPC the user chooses sees the request. The optional UI adds The Graph (hardcoded) and default Infura and Alchemy RPCs (swappable in Settings). An optional relayer, when used, sees the recipient and the user's IP unless Tor is used. tornado-cli adds an IP-echo call. All of these are named in code. Judgment call: we score 2 because the hardcoded Graph endpoint cannot be swapped by config, although a user avoids it by not using the UI.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/components/Settings.vue#L8-L45",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "components/Settings.vue",
              "detail": "The UI settings offer an RPC dropdown and a custom RPC URL field. The indexer URL is fixed in services/graph.js; the indexer code is public (tornado-subgraph).",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-classic-ui/contents/components/Settings.vue?ref=a83fae0772c8da084c0e76b3a756b456f5b9f5bb\" --jq .content | base64 -d | sed -n 8,45p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The RPC can be set in the UI, and with --rpc in the CLI. The indexer URL can be changed only in code, though the UI falls back to RPC reads. Scored 2: the indexer is configurable via code only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/contracts/ERC20Tornado.sol#L29-L49",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "contracts/ERC20Tornado.sol",
              "detail": "Funds sit in the pool between deposit and withdrawal and leave only to the recipient (and an optional relayer fee) bound into a valid proof for an unspent nullifier; no function lets any role move pool funds.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x23773E65ed146A459791799d01336DB287f25334",
              "address": "0x23773E65ed146A459791799d01336DB287f25334",
              "block_number": 26141280,
              "detail": "The DAI 100k pool (0.7.6 build) has no operator function, and its EIP-1967 implementation slot is zero; the 0.5.11 pools have operator() = 0x0 (see C1).",
              "checked_at": "2026-10-07",
              "recheck": "cast storage 0x23773E65ed146A459791799d01336DB287f25334 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The pools are non-upgradeable escrows that release funds only to whoever holds the note's secret, who chooses the recipient in the proof. No operator, governance or relayer can redirect funds. A relayer cannot change the recipient or fee because both are bound into the proof. Whoever holds the note controls the funds, so a payer who keeps a copy of a note handed to a payee can still withdraw first.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
              "address": "0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
              "block_number": 26141280,
              "detail": "The EIP-1967 implementation slot reads zero on all 12 pools and on the verifier and router; pools have no upgrade function, and operator() (which could swap the verifier) is 0x0.",
              "checked_at": "2026-10-07",
              "recheck": "cast storage 0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2",
              "address": "0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2",
              "block_number": 26141280,
              "detail": "RelayerRegistry, InstanceRegistry and FeeManager are proxies whose admin slot is the governance proxy 0x5efd…A1Ce; governance is its own admin (LoopbackProxy).",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x0000000000000000000000005efda50f22d34f262c29268506c5fa42cb56a1ce"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce",
              "address": "0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce",
              "block_number": 26141584,
              "detail": "EXECUTION_DELAY is 172800 s (2 days) after a 432000 s (5 day) voting period; execute() delegatecalls the proposal contract (tornado-governance Governance.sol L184-L200), so a passed proposal can do anything governance can.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x37f135d7",
                "expect": "0x000000000000000000000000000000000000000000000000000000000002a300"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xC503893b3e3c0C6b909222b45f2a3a259a52752D",
              "address": "0xC503893b3e3c0C6b909222b45f2a3a259a52752D",
              "block_number": 26141584,
              "detail": "proposals(20) has target 0xC503…752D, endTime 1684394654 (2023-05-18) and executed = true; the verified code at the target includes an owner-only selfdestruct (emergencyStop), and Sourcify records its creation in tx 0x4eeffe76…042b at block 17299150 (2023-05-20), after voting closed.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "No one can change the pool, verifier or router code: none is a proxy, and the one pool role that could swap the verifier is set to zero. TORN governance (5-day vote, 2-day execution delay, delegatecall execution) can upgrade the InstanceRegistry, RelayerRegistry and FeeManager, which only the optional router path consults, and it owns the tornadocash.eth name that serves the UI. Proposal 20's target was created after its vote closed and carries a selfdestruct, which shows that code executed by governance need not be the code voters saw. Judgment call: we score the settlement contracts at 3; the governance risk is in the router path and the frontend, both of which a user can avoid.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/store/token.js#L149-L166",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "store/token.js",
              "detail": "approvalAmount defaults to 'unlimited' (L13), which approves 2^256-1 to the router; components/ApproveModalBox.vue offers the user a choice between the deposit amount and unlimited.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/src/cli.js#L88-L101",
              "commit": "1ef6a263ac6a0e476d063fcb269a9df65a1bd56a",
              "path": "src/cli.js",
              "detail": "The core client approves exactly the deposit amount to the pool.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The UI asks by default for an unlimited allowance to TornadoRouter and shows the choice in its approval dialog. The router is not upgradeable, and deposit pulls only the denomination from msg.sender, but any allowance left over remains exposed to the router's fixed code. The core client approves exactly the deposit amount, which would score higher. Judgment call: we score the UI default because it is the published frontend, and take 1 (unbounded by default, disclosed).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF",
              "address": "0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF",
              "block_number": 26141280,
              "detail": "The pools are immutable with operator 0x0, and withdraw is callable by anyone holding a valid proof (C2).",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF \"operator()(address)\" --rpc-url https://ethereum-rpc.publicnode.com"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/scripts/downloadKeys.js#L4-L30",
              "commit": "1ef6a263ac6a0e476d063fcb269a9df65a1bd56a",
              "path": "scripts/downloadKeys.js",
              "detail": "The proving key and circuit needed to withdraw are public GitHub release assets.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=3, C2=3, C3=3 and O3=1. Funds sit in immutable pools that no one can redirect (S1). A note holder can withdraw by calling the pool directly with the public client and proving key (C2), and no relayer or indexer is required (C3). Settlement can continue the same way. A public frontend build exists in the archived classic UI, but we did not reproduce it (O3=1). Judgment call: 2, not 3, for that reason.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/networkConfig.js#L1-L39",
              "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
              "path": "networkConfig.js",
              "detail": "The UI builds INFURA_KEY and ALCHEMY_*_KEY from env into client-side RPC URLs, so those keys ship in the browser bundle; they authorise RPC usage only. There are no webhooks or merchant API keys.",
              "checked_at": "2026-10-07",
              "recheck": "gh api \"repos/tornadocash/tornado-classic-ui/contents/networkConfig.js?ref=a83fae0772c8da084c0e76b3a756b456f5b9f5bb\" --jq .content | base64 -d | sed -n 1,39p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The user secret is the note (nullifier and secret), generated and kept client-side. The protocol has no API keys or webhooks. The UI embeds RPC provider keys in its bundle, a minor issue since they grant only RPC quota. Integrity of the served frontend depends on whoever controls tornadocash.eth (TORN governance, see S2). Judgment call: 2 for the bundled RPC keys.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/abdk-consulting/audits/blob/57af593b14bb3701cf659937b1b7b6483009a0cc/tornado/Tornado_solidity_audit.pdf",
              "commit": "57af593b14bb3701cf659937b1b7b6483009a0cc",
              "path": "tornado/Tornado_solidity_audit.pdf",
              "detail": "ABDK's Solidity audit pins peppersec/tornado-mixer commit 0484408e (2019-10-17) and links fix commits such as d0e312eb (merge of PR 24, \"audit-6\"); circuit and cryptographic reviews sit in the same folder.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/README.md#L23-L33",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "README.md",
              "detail": "The README links the ABDK reports at tornado.cash URLs, which no longer resolve. The deployed tag v2.0 (7033f344) is 107 commits after the audited commit, with contract changes; no bug bounty or SECURITY file exists in the repos.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "ABDK audited the contracts and circuits at a pinned commit, and the report links fix commits. The deployed code was built from tag v2.0, 107 commits later, and we could not confirm every change after the audit was reviewed. There is no live bug bounty. The router, registries and governance upgrades were not reviewed here. Judgment call: 1 rather than 2, because the audited commit is not the deployed commit.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. On 2022-08-08 the US Treasury's OFAC designated Tornado Cash (https://home.treasury.gov/news/press-releases/jy0916). In Van Loon v. Department of the Treasury, No. 23-50669, the Fifth Circuit held that Tornado Cash's immutable smart contracts are not the property of a foreign national or entity and cannot be blocked under IEEPA, and remanded (https://www.ca5.uscourts.gov/opinions/pub/23/23-50669-CV0.pdf). On 2025-03-21 Treasury announced it had removed the sanctions (https://home.treasury.gov/news/press-releases/sb0057; https://ofac.treasury.gov/recent-actions/20250321). On 2023-08-23 the US Attorney for SDNY announced charges against two founders (https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations); later outcomes were not reviewed here. On 2024-05-14 the Oost-Brabant district court in the Netherlands convicted a developer of money laundering and imposed 64 months (ECLI:NL:RBOBR:2024:2069, https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RBOBR:2024:2069); we did not check for any appeal.",
      "availability": {
        "model": "global",
        "note": "The pools are immutable contracts with no live operator and no address or country check, so deposit and withdraw are callable from anywhere. The archived official classic UI has no country or IP geolocation gate in its source (grep for country, geolocation, ipapi, jurisdiction finds nothing); it screens the connecting wallet address against the Chainalysis sanctions oracle and redirects listed addresses to a 451 page. That is an address filter, not a country list. We found no first-party terms page listing countries; the GitHub org is archived and the classic UI source contains no terms text naming countries. Judgment call: we did not inspect the UI build currently served at tornadocash.eth, which could differ from the archived source. Legality of use differs by jurisdiction (see `context`); that is not an availability restriction by the provider.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/contracts/Tornado.sol#L62-L92",
            "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
            "path": "contracts/Tornado.sol",
            "detail": "deposit() and withdraw() in the deployed v2.0 source check only the commitment, nullifier, Merkle root and zkSNARK proof; there is no caller, address or country restriction.",
            "checked_at": "2026-10-09"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/tornadocash/tornado-classic-ui/blob/a83fae0772c8da084c0e76b3a756b456f5b9f5bb/store/metamask.js#L333-L346",
            "commit": "a83fae0772c8da084c0e76b3a756b456f5b9f5bb",
            "path": "store/metamask.js",
            "detail": "The classic UI's only access check is isSanctioned(address) on the Chainalysis oracle at wallet connect; a grep of the source at this commit for country, geolocation, ipapi, ip-api and jurisdiction finds no country gate.",
            "checked_at": "2026-10-09",
            "recheck": "curl -sL https://codeload.github.com/tornadocash/tornado-classic-ui/tar.gz/a83fae0772c8da084c0e76b3a756b456f5b9f5bb | tar xz --exclude='*/static/*' && grep -rniE \"countr|geoloc|ipapi|ip-api|jurisdic\" --include='*.js' --include='*.vue' tornado-classic-ui-*",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: 12 Ethereum mainnet pools (ETH 0.1/1/10/100, DAI 100/1k/10k/100k, USDC 100/1k, USDT 100/1k), the shared verifier 0xce17…557A and the hasher 0x8358…28fe. Pool and slot reads are pinned at blocks 26141280 and 26141552, governance and token reads at 26141584, and registry state at 26140925 (publicnode serves only recent blocks, so the reads span several blocks). The github.com/tornadocash org is archived (all 47 repos, last push 2022-08-22). We cite it for the immutable pools and the clients; later community source was not reviewed. Governance: TORN-weighted LoopbackProxy with 72 proposals at our read. Proposal 20 (May 2023) is recorded in S2 from onchain state only. The reported 2024 frontend backdoor was not evidenced from a primary source here and is not scored. The hasher is generated bytecode with no Sourcify record; Etherscan could not be loaded. No transactions, UI runs, traces, or self-host attempts were made.",
      "audits": {
        "searched": "The tornado-core README audit section (its tornado.cash/audits links no longer resolve), the classic UI README (links a Decurity dApp audit at tornado.cash, which no longer resolves and is not in Decurity's public audits repo), the ABDK portfolio at github.com/abdk-consulting/audits (tornado folder), all archived github.com/tornadocash repos, and the Trail of Bits publications list. ABDK's 2020 audit of the Tornado Farm anonymity-mining contracts is in the same folder but is not in the payment path, so it is not listed. No published audit of the router, registries or governance contracts was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "ABDK Consulting",
            "date": "2019-11-29",
            "type": "review",
            "scope": "Cryptographic review of the mixer protocol (Pedersen and MiMC hashing, nullifier and commitment design) and its implementation.",
            "url": "https://github.com/abdk-consulting/audits/blob/57af593b14bb3701cf659937b1b7b6483009a0cc/tornado/Tornado_cryptographic_review.pdf",
            "covers_deployed": "partly",
            "note": "Reviews the protocol design used by the deployed pools; the implementation it read was the then-current master of peppersec/tornado-mixer (now tornadocash/tornado-core), not a pinned commit."
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2019-11-25",
            "type": "audit",
            "scope": "Withdraw circuit, Merkle tree checker and hash templates (circom) in tornado-mixer.",
            "url": "https://github.com/abdk-consulting/audits/blob/57af593b14bb3701cf659937b1b7b6483009a0cc/tornado/Tornado_circuit_audit.pdf",
            "commit": "0484408e82e8f1eebd081186cb11189aa0e9b57f",
            "repo": "https://github.com/tornadocash/tornado-core",
            "covers_deployed": "partly",
            "findings": "No major issues; minor issues, many fixed in linked commits, one left open",
            "note": "The repository was then named peppersec/tornado-mixer. The deployed proving key comes from the tornado-core v2.1 release assets; we did not compare the deployed circuit with the audited commit."
          },
          {
            "auditor": "ABDK Consulting",
            "date": "2019-11-19",
            "type": "audit",
            "scope": "Pool contracts (Mixer, ETH and ERC20 mixers, Merkle tree) in tornado-mixer.",
            "url": "https://github.com/abdk-consulting/audits/blob/57af593b14bb3701cf659937b1b7b6483009a0cc/tornado/Tornado_solidity_audit.pdf",
            "commit": "0484408e82e8f1eebd081186cb11189aa0e9b57f",
            "repo": "https://github.com/tornadocash/tornado-core",
            "covers_deployed": "partly",
            "findings": "No critical issues; major and moderate flaws marked fixed (last fix commit d0e312eb); some minor issues deferred or declined",
            "note": "The deployed pools were built from tag v2.0 (7033f344), 107 commits after the audited commit, with contract changes (see S6)."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C5"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O1",
            "O2",
            "O3"
          ]
        },
        "F": {
          "score": 2,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 2,
          "limiting": [
            "P1",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 1,
          "limiting": [
            "S3",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 17,
        "short": 5,
        "unk": 1,
        "total": 23
      }
    },
    {
      "slug": "tria-card",
      "name": "Tria",
      "type": "incumbent",
      "website": "https://www.tria.so",
      "repos": [],
      "contracts": [],
      "components": [
        {
          "name": "Tria app and backend (web and mobile, card management, BestPath routing)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Threely Dimensions, Inc. (Tria)",
          "required": true
        },
        {
          "name": "Tria TSS wallet key infrastructure",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Tria",
          "required": true
        },
        {
          "name": "Third National, LLC and partner Card Program Providers (issuer, collateral)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Third National, LLC and partners",
          "required": true
        },
        {
          "name": "Visa (card network)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Sumsub (identity verification, biometrics)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub",
          "required": true
        },
        {
          "name": "Collateral contracts (chain and addresses not published)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Card Program Providers",
          "required": true
        }
      ],
      "context": "Per its Terms of Service, Tria is Threely Dimensions, Inc., governed by Delaware law, and says it is not a bank, money services business, card issuer or other financial institution and does not hold users' funds, collateral or keys. The Terms name Third National, LLC and partners as Card Program Providers that issue the Tria Card and extend credit secured by digital-asset collateral; the card is issued under licence from Visa.",
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-international",
              "quote": "Tria and Issuer reserve the right to block and terminate transactions and suspend access to your Account",
              "detail": "International Card Terms s5 let Tria and the issuer block transactions and suspend accounts; no notice period is stated.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Tria and the issuer can block an individual cardholder's transactions and suspend the account with no stated notice. No settlement contracts are published, so no onchain role can be read. Judgment call: documented per-account blocking meets anchor 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/platform-agreement",
              "quote": "under which Third National, LLC and one or more of their partners",
              "detail": "Terms of Service say the card is issued and credit extended by Third National and partners; Tria provides only the front-end.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Card payments are authorised and settled by the issuer and its partners; no direct contract path is documented or published. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/platform-agreement",
              "quote": "under which Third National, LLC and one or more of their partners",
              "detail": "The card depends on Tria's closed app and on the Card Program Providers.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Required intermediaries (Tria backend, issuer, Visa) are closed and single-vendor. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/platform-agreement",
              "quote": "you are not subject to sanctions or otherwise designated on any list of prohibited or restricted parties",
              "detail": "Terms require users not to be sanctioned or in restricted jurisdictions (UN, OFAC, US State Department, EU, UK lists).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Sanctions screening is disclosed in the Terms only; no code or contracts show where it runs, and it cannot be bypassed. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-international",
              "quote": "means the Ethereum Blockchain, Polygon Blockchain, Optimism Blockchain, Arbitrium Blockchain",
              "detail": "The International Card Terms list Supported Blockchains for collateral (Ethereum, Polygon, Optimism, Arbitrum, others at the issuer's discretion) and let the issuer designate collateral assets; no token list or freeze powers are stated.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Chains are enumerated in the card terms only (with an open-ended clause); collateral tokens and their issuers' freeze powers are not listed. Enumerated in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/TriaHQ/tria-krapi-seoul-ai-builders/tree/32f9168bd605712aabfed73275d0442621b04d3e/track1-personal-finance-analyst",
              "commit": "32f9168bd605712aabfed73275d0442621b04d3e",
              "path": "track1-personal-finance-analyst",
              "detail": "The TriaHQ org has four public repos - this ideathon dataset repo and forks of relay-server, sdk-testing-grounds and rainbowkit; none contains Tria's card, wallet, SDK or backend code. The npm packages tria-sdk-core/tria-sdk-web (2023) point at github.com/TriaHQ/tria-core-sdk, which returns 404, and the @tria-sdk/* packages named in the docs are not on the npm registry.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Nothing in the card stack is public. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/TriaHQ/tria-krapi-seoul-ai-builders/tree/32f9168bd605712aabfed73275d0442621b04d3e/track1-personal-finance-analyst",
              "commit": "32f9168bd605712aabfed73275d0442621b04d3e",
              "path": "track1-personal-finance-analyst",
              "detail": "No public code or README for running any part of the card product exists.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "No self-host path. Reproduction not attempted.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/TriaHQ/tria-krapi-seoul-ai-builders/tree/32f9168bd605712aabfed73275d0442621b04d3e/track1-personal-finance-analyst",
              "commit": "32f9168bd605712aabfed73275d0442621b04d3e",
              "path": "track1-personal-finance-analyst",
              "detail": "No repo needed to run the product is public; all required components are closed.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "All required components are closed. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/platform-agreement",
              "quote": "under which Third National, LLC and one or more of their partners",
              "detail": "The card requires Tria's hosted platform and the Card Program Providers.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "The product cannot run without Tria's proprietary platform and the issuer. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/privacy-policy",
              "quote": "We may engage others to provide analytics services and serve advertisements across the web and/or mobile applications",
              "detail": "Privacy Policy s4 discloses third-party analytics and advertising using cookies and persistent identifiers.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics and advertising trackers are disclosed in the privacy policy; the app is closed, so default state cannot be checked. Judgment call: disclosed in docs, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/privacy-policy",
              "quote": "We utilize a third party, Sumsub",
              "detail": "Privacy Policy describes identity verification with Sumsub, including biometric comparison of a selfie or video with a government ID.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Collection beyond settlement needs (identity documents, biometrics) is disclosed in the privacy policy only. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/privacy-policy",
              "quote": "We utilize a third party, Sumsub",
              "detail": "Sumsub, analytics and advertising providers, Third National and Visa are disclosed in the privacy policy and terms.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties in the flow are disclosed in documents only and cannot be swapped. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-international",
              "quote": "Issuer reserves the right to designate which forms of Digital Assets may be used as Collateral",
              "detail": "Card Terms s3 say a Linked Wallet provides digital-asset Collateral securing charges, which the issuer can liquidate if a payment is unpaid after one day or the collateral value falls below charges.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.tria.so/platform-agreement",
              "quote": "Tria does not hold, store, or take custody of your funds, digital assets, collateral, or private keys",
              "detail": "Tria disclaims custody; it says nothing about who controls the collateral contracts.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Card spending is secured by collateral the issuer can liquidate, disclosed in the card terms. Where the collateral sits and who controls it onchain is not published. Judgment call: disclosed issuer-controlled collateral fits anchor 1 at the documented cap.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "notes": "Eligibility: no public repository needed to run the product and no published or verified contract, so type is incumbent. Searched 2026-10-07: GitHub org TriaHQ (four repos: an ideathon dataset and forks of relay-server, sdk-testing-grounds, tria-rainbowkit); tria-labs/TriaLabs (unrelated Tria Labs, triafed.com) and triaso (0 repos); gh search repos \"tria sdk\" (unrelated projects); npm @tria-sdk/core, connect, authenticate(-react/-web), react-native, chains, utils, constants (all 404) and legacy tria-sdk-core/tria-sdk-web 2023 (repository github.com/TriaHQ/tria-core-sdk, 404); docs.tria.so (54 pages incl. CoreSDK, BestPath, Security and TSS, TX Flow, supported networks, all legal pages; only example wallet addresses in SDK samples, no card or collateral contracts); www.tria.so (client-rendered shell). The card terms are a collateral-backed Third National program with a generic Supported Blockchains list; the collateral chain and contracts are not published, so no onchain cell could be scored.",
      "availability": {
        "model": "blocklist",
        "countries": [
          "CU",
          "IR",
          "KP",
          "SY",
          "AF",
          "BY",
          "CF",
          "CD",
          "ER",
          "ET",
          "GN",
          "GW",
          "IQ",
          "LB",
          "LY",
          "ML",
          "MM",
          "NI",
          "RU",
          "SO",
          "SS",
          "SD",
          "VE",
          "YE",
          "ZW"
        ],
        "note": "From section 4 of Tria's Prohibited Use Policy (the same text is published as the Prohibitions List, which the platform agreement incorporates). It names sanctioned countries \"including, without limitation\" Cuba, Iran, North Korea and Syria, plus the Crimea, Donetsk and Luhansk regions of Ukraine (sub-national, not listed as codes), and high-risk jurisdictions \"including but not limited to\" 21 more countries (Myanmar is named twice). Both lists are open-ended, and the platform agreement also excludes any country subject to EU, UK, UN or US sanctions; only named countries are listed here. Card programme variants: the international card terms require attesting that you are not a US citizen; US users have separate US card terms, which name no state limits.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tria.so/prohibited-use-policy",
            "detail": "Section 4 (Sanctions and Restricted Jurisdictions) names the sanctioned and high-risk jurisdictions where the Tria Card may not be applied for or used.",
            "quote": "jurisdictions that Tria prohibits due to high money-laundering, fraud, or compliance risk, including but not limited to: Afghanistan, Belarus, Central African Republic",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tria.so/prohibited-use-policy",
            "detail": "The same section names the sanctioned countries and Ukrainian regions.",
            "quote": "Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, or Luhansk regions of Ukraine",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tria.so/card-terms-international",
            "detail": "The international card terms are for non-US citizens; US users are covered by the separate US card terms.",
            "quote": "You attest that you are not a United States citizen",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-12"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true
          }
        ],
        "conversion": "at_spend",
        "note": "Inferred from the Card Terms fee schedule, which charges a \"USDC Settlement/Deposit\" fee; no Tria page names the card-balance token outright. Top-ups from 1,000+ tokens on Bitcoin, Ethereum, Polygon, Base, Arbitrum, Optimism, BSC, Aptos and Solana are swapped by BestPath into \"the required currency\" and credited to the card balance, which the Card Terms treat as digital-asset collateral liquidated to repay charges; the help centre says crypto is converted at payment time. The collateral chain and contract are not published.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tria.so/card-terms-international",
            "detail": "The International Card Terms fee schedule lists a USDC settlement and deposit fee of up to 1%.",
            "quote": "USDC Settlement/Deposit: Up to 1%",
            "checked_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tria.so/en/articles/14854432-what-are-provider-fees",
            "detail": "The help centre says a top-up may swap the deposited asset into the currency the card balance requires, and recommends USDC or USDT on L2s as needing the fewest conversion steps.",
            "quote": "Converting your specific asset into the required currency",
            "checked_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tria.so/en/articles/13513481-what-are-tria-cards",
            "detail": "The help centre says crypto is converted at payment time.",
            "quote": "Your crypto is converted at payment time",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "docs.tria.so (all pages, including Security and TSS, TX Flow and the card terms; no audit is mentioned), the TriaHQ GitHub org (no card, wallet or SDK code), Rain's security page (audits under NDA, Sherlock named) and the Sherlock report repo (one Rain report). The international card terms carry Rain's name (\"Your Rain Payment Card Terms\"). No audit of Tria's app, TSS key infrastructure or BestPath routing is published.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Sherlock",
            "date": "2025-02-11",
            "type": "contest",
            "scope": "Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest",
            "url": "https://github.com/sherlock-protocol/sherlock-reports/blob/main/audits/2025.02.11%20-%20Final%20-%20Rain%20Private%20Best%20Efforts%20Audit%20Contest%20Report.pdf",
            "commit": "6f578d5b9c9fa35bbe857959a50fa5aab4fa611a",
            "repo": "https://github.com/SignifyHQ/collateral-contract-evm-v2",
            "covers_deployed": "unknown",
            "findings": "0 high, 2 medium (statement payoff rounding; missing Chainlink min/max answer check)",
            "note": "Logged because the card is a Rain programme (Third National issuer, collateral on Ethereum, Polygon, Optimism or Arbitrum per the card terms). Tria publishes no collateral contract, so the audited code was not tied to this card. The Rain repo is private; contest ran 2-8 December 2024 on b432939a, 6f578d5 is the fix commit."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O2",
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 13,
        "unk": 10,
        "total": 23
      }
    },
    {
      "slug": "tuyo-card",
      "name": "Tuyo Card",
      "type": "card",
      "website": "https://tuyo.com",
      "primary_chain": {
        "name": "Base",
        "chain_id": 8453,
        "basis": "Tuyo's FAQ says \"The Tuyo Card and account services operate on Base\" and the card guide says the card is powered by USDC on Base. Tuyo's recovery guide names the account contracts on Base: Kernel 3.2 implementation 0xD830D15D... and ECDSA validator 0x845ADb2C... (ZeroDev). Excluded: Ethereum, Arbitrum, BSC and Polygon, which are deposit and withdraw networks only. I could not identify a sample Tuyo account or its card collateral contract, so per-account onchain cells are unknown."
      },
      "repos": [
        {
          "url": "https://github.com/zerodevapp/kernel",
          "role": "contracts",
          "license": "MIT"
        }
      ],
      "contracts": [
        {
          "address": "0xD830D15D3dc0C269F3dBAa0F3e8626d33CFdaBe1",
          "chain_id": 8453,
          "role": "ZeroDev Kernel 3.2 implementation (Tuyo smart accounts)",
          "verified": "sourcify"
        },
        {
          "address": "0x845ADb2C711129d4f3966735eD98a9F09fC4cE57",
          "chain_id": 8453,
          "role": "ZeroDev ECDSA validator (root validator)",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "ZeroDev Kernel 3.2 smart account and ECDSA validator",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "ZeroDev (code); account owned by the user",
          "required": true,
          "repo": "https://github.com/zerodevapp/kernel"
        },
        {
          "name": "Card collateral contracts (not identified)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "card provider (not named by Tuyo)",
          "required": true
        },
        {
          "name": "Tuyo mobile app (signer key, card UI)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Tuyo, Inc.",
          "required": true
        },
        {
          "name": "Tuyo backend",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Tuyo, Inc.",
          "required": true
        },
        {
          "name": "Card provider and issuer (unnamed third-party issuer)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "KYC by the card provider",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        },
        {
          "name": "Bridge (fiat on and off ramp, virtual accounts)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Bridge Ventures LLC",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Terms-of-Service-1f5bde14709281b2a8fff4a20910b4ed",
              "archive": "data/archive/tuyo-card-terms.txt",
              "quote": "Tuyo may suspend or terminate your access to the Service at any time if it determines, in its sole discretion, that you do not meet these eligibility requirements",
              "detail": "Terms of Service (updated 28 July 2026) s2.1; s3.4 also reserves the right to restrict transaction submission; card use is subject to the unnamed Issuer's terms.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Tuyo can suspend an individual's access at its sole discretion, with no notice period stated. The card issuer's own terms were not public to me. The FAQ says withdrawals to the user's own wallet still work when an account is restricted, but that is exit, not payment. Judgment call: per-user suspension with no stated notice meets anchor 0. The account contracts would not support a pause.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Terms-of-Service-1f5bde14709281b2a8fff4a20910b4ed",
              "archive": "data/archive/tuyo-card-terms.txt",
              "quote": "which is issued by a third party card issuer",
              "detail": "Terms s3.1; card payments are authorised and settled by the issuer over Visa, funded from USDC on Base.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Merchants are paid by the issuer over Visa. Nothing documents a way to complete a card payment by calling contracts directly.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.tuyo.com/guides/tuyo-card-availability.html",
              "quote": "The card provider has additional country, U.S. state, and territory restrictions",
              "detail": "Card issuance runs through an unnamed card provider and the Tuyo app; neither has public code.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The card requires Tuyo's closed app and backend, an unnamed card provider and issuer, and Visa. All are closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.tuyo.com/guides/tuyo-card-availability.html",
              "quote": "The card provider has additional country, U.S. state, and territory restrictions",
              "detail": "The guide tabulates country and U.S. state exclusions; Terms s2.1 require OFAC and SDN eligibility.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Geographic and sanctions filtering is disclosed in docs. The card settlement contracts could not be inspected, so the neutrality of the settlement layer cannot be shown. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.tuyo.com/guides/card.html",
              "quote": "The card is powered by USDC on Base",
              "detail": "The card token and chain are stated in docs; Circle's freeze powers and Base's sequencer are not mentioned.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "USDC on Base is enumerated in docs only. Issuer freeze and sequencer assumptions are not stated. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/8453/0xD830D15D3dc0C269F3dBAa0F3e8626d33CFdaBe1",
              "address": "0xD830D15D3dc0C269F3dBAa0F3e8626d33CFdaBe1",
              "block_number": 52290868,
              "detail": "Sourcify reports match (partial, not exact) for the Kernel 3.2 implementation and for the ECDSA validator 0x845ADb2C...; both have code at this block.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The account contracts are partially verified. The card collateral contracts that hold spendable funds were not identified, so not every settlement contract is verified. Some contracts verified, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/src/Kernel.sol#L1-L2",
              "commit": "cfedcb9b047838f72491baaadef8fe7a95b2c837",
              "path": "src/Kernel.sol",
              "detail": "The smart-account contracts (ZeroDev Kernel, tag v3.2) are public; no Tuyo-owned public repo exists (GitHub user \"tuyo\" has 0 repos; searches found none).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Only third-party account contracts are public. Tuyo's app, backend and card integration are closed. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/LICENSE.txt",
              "commit": "cfedcb9b047838f72491baaadef8fe7a95b2c837",
              "path": "LICENSE.txt",
              "detail": "Kernel is MIT (Copyright 2023 ZeroDev, Inc.).",
              "checked_at": "2026-10-07",
              "drift": true
            }
          ],
          "finding": "The account contracts are MIT, but the required app, backend and card services are closed. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Terms-of-Service-1f5bde14709281b2a8fff4a20910b4ed",
              "archive": "data/archive/tuyo-card-terms.txt",
              "quote": "which is issued by a third party card issuer",
              "detail": "The card depends on the Issuer and Tuyo's Mobile Apps.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The card cannot run without proprietary services.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Privacy-Policy-ab80528d2dfa4860854dee593fbad459",
              "archive": "data/archive/tuyo-card-privacy.txt",
              "quote": "We may share technical information related to API usage with specific third parties for analytics and security purposes.",
              "detail": "The Privacy Policy (17 July 2024) discloses usage statistics, IP and device data and sharing with analytics third parties.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Analytics are disclosed but the vendors are not named. The app is closed and no trace was run. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.tuyo.com/guides/tuyo-card-availability.html",
              "quote": "The card provider has additional country, U.S. state, and territory restrictions",
              "detail": "The guide says identity verification and the card provider's review apply; the Privacy Policy lists name, email and bank details for ramps but predates the card and does not describe card KYC.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Card KYC is required and its existence is disclosed, but the policy does not list the card KYC fields or a legal basis. Judgment call: disclosed in docs, so 1. It could be 0 because the policy is stale.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Terms-of-Service-1f5bde14709281b2a8fff4a20910b4ed",
              "archive": "data/archive/tuyo-card-terms.txt",
              "quote": "which is issued by a third party card issuer",
              "detail": "Neither the Terms, the Privacy Policy nor the help guides name the card provider, issuer or KYC vendor; only Bridge (ramps) is named.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The card provider, issuer, KYC vendor and analytics vendors that see each payment are not named in any Tuyo document I found. Card Map names Rain, but that is a third-party claim. Undisclosed third parties in the flow, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/src/Kernel.sol#L80-L95",
              "commit": "cfedcb9b047838f72491baaadef8fe7a95b2c837",
              "path": "src/Kernel.sol",
              "detail": "execute and upgradeTo are guarded by onlyEntryPointOrSelfOrRoot, which lets a direct caller through when the root validator's hook accepts it; the ECDSA validator accepts its recorded owner.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.tuyo.com/guides/recover-kernel-assets.html",
              "quote": "This direct transaction route does not require a bundler or paymaster",
              "detail": "Tuyo's guide walks the user through calling execute on their Kernel 3.2 account with the mnemonic-derived signer, and warns that funds in collateral contracts need separate release rules.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Chain of reasoning. S1 is unknown: the collateral contract was not identified. C2 = 0 and C3 = 0: the card stops without Tuyo and its provider. O3 is unknown: there is no public frontend. Funds in the user's Kernel account are retrievable through a documented manual contract call with the user's own signer, and the Terms say the same. Funds already moved to card collateral may follow the provider's release rules. Documented manual call, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. Tuyo, Inc. operates the app; the Terms of Service (28 July 2026) say the card is issued by an unnamed third-party issuer, and fiat ramps and virtual accounts are provided by licensed Financial Services Providers (Bridge is named in the Privacy Policy). The Terms state that Tuyo never holds the user's private key and that a suspended user can still withdraw through a block explorer. I found no primary source naming the issuer or its regulator.",
      "notes": "Scored from Tuyo's Terms (Notion, client-rendered, archived), Privacy Policy (archived), the help.tuyo.com guides (curl-readable), the ZeroDev Kernel source at tag v3.2, and Sourcify for the two Base contracts that Tuyo names. I could not identify a sample Tuyo account or its card collateral. base.blockscout.com is behind a Cloudflare challenge (not bypassed), Base public RPC refuses USDC log scans over 300 blocks, and Rain's docs need a login. As a result S1, S2, S3, P3 and the card-path onchain facts are unknown. Card Map (third party) lists Rain as issuer; no Tuyo document confirms it.",
      "availability": {
        "model": "blocklist",
        "countries": [
          "AF",
          "BD",
          "BY",
          "CN",
          "CD",
          "CU",
          "IN",
          "IR",
          "IQ",
          "LB",
          "LY",
          "ML",
          "MM",
          "NP",
          "NG",
          "KP",
          "RU",
          "SO",
          "SS",
          "SD",
          "SY",
          "TR",
          "UA",
          "GB",
          "VE",
          "VN",
          "YE",
          "IL",
          "NI",
          "PR",
          "VI",
          "AS",
          "GU",
          "MP"
        ],
        "note": "Two layers, both from Tuyo's help guides (verified by Tuyo on 16 July 2026 against its Prohibitions page, last updated 15 July 2026). The 27 platform-wide prohibited jurisdictions block all Tuyo services, the card included. The card provider adds issuance exceptions; of these only Israel and Nicaragua are not already platform-wide prohibitions. The card provider also blocks card payments (spending) in CU, IR, KP, RU, SY, UA and VE. In the US, the card cannot be issued to residents of Arizona, Delaware, Georgia, Idaho, Louisiana, Maryland, Mississippi, Missouri, Nevada, New Mexico, North Dakota, Ohio, Oregon, Rhode Island, South Dakota, Tennessee, Vermont, Washington, Wisconsin or the District of Columbia. Puerto Rico, the U.S. Virgin Islands, American Samoa, Guam and the Northern Mariana Islands are also excluded. They have their own ISO codes, so they are in the list. The Terms of Service add a general exclusion of US-embargoed or sanctioned jurisdictions without naming them.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/tuyo-availability.html",
            "detail": "Tuyo's platform-wide prohibited jurisdictions table, which applies to the card. It lists 27 countries, from Afghanistan to Yemen, including the United Kingdom.",
            "quote": "Tuyo is generally available outside the platform-wide prohibited jurisdictions below",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/tuyo-availability.html",
            "detail": "The United Kingdom row of the platform-wide table, quoted as an example.",
            "quote": "United Kingdom (GB) Not available",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/tuyo-card-availability.html",
            "detail": "The card provider's issuance exceptions add Israel and Nicaragua to the platform-wide list. The page also lists the US states and territories where the card cannot be issued.",
            "quote": "Israel (IL) Not available Available",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/tuyo-card-availability.html",
            "detail": "The Nicaragua row of the card provider's issuance exceptions.",
            "quote": "Nicaragua (NI) Not available Available",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true,
            "chain_id": 8453,
            "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
          }
        ],
        "conversion": "at_spend",
        "note": "The card spends only USDC on Base. Other tokens deposited on Base, Ethereum, Arbitrum, BSC or Polygon must be converted to Base USDC in the app first; this is a manual step, not an auto-swap at spend. EURC held in Cash cannot pay by card. The card can also spend USDC sitting in a Tuyo Earn strategy (a yield vault), so the debited position may be a vault share redeemed for USDC at spend; users can turn this off. Fiat received on virtual accounts is converted to USDC (USD, MXN) or EURC (EUR) by Bridge. The card collateral contract was not identified, so the onchain debit path is not confirmed.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/card.html",
            "detail": "Card guide names USDC on Base as the only compatible token, with other deposits converted inside Tuyo.",
            "quote": "The card is powered by USDC on Base. You can deposit USDC (or any token) on Base, Ethereum, Arbitrum, BNB Smart Chain (BSC), or Polygon, and convert to Base USDC inside Tuyo",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/card.html",
            "detail": "Card FAQ says the card can spend USDC while it is in an Earn strategy, and this can be disabled.",
            "quote": "The Tuyo Card can spend your USDC even while it is in an Earn strategy, so it keeps earning until you spend",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/card-spendable-balance.html",
            "detail": "The card spends dollars only; euros in Cash must be converted first.",
            "quote": "The app explains that your card spends dollars. Euros cannot pay by card yet.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "Tuyo's site and help guides (no audit or security page; no Tuyo-owned contract is published), the audits/ folder of github.com/zerodevapp/kernel at tag v3.2 (cfedcb9, the source of the Kernel 3.2 implementation and ECDSA validator Tuyo names) and v3.3, ZeroDev's docs audits page (points to that folder; the current dev branch for v4 has no audits folder), and the ChainLight and KALOS reports themselves. Left out: KALOS reports on the Recovery/Weighted ECDSA plugin and the WebAuthn plugin, which are not in Tuyo's account path. No published audit was found for the Kernel v3.2 changes (December 2024) or for the card collateral contracts, whose operator Tuyo does not name.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Felix Kim (independent)",
            "date": "2024-06",
            "type": "review",
            "scope": "Shared ZeroDev Kernel component: incremental review of Kernel changes from v3.0 to v3.x (changes only), plus the WebAuthn, MultiChainWebAuthn and Weighted validators and the SpendingLimit hook.",
            "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/audits/v_3_1_incremental_audit.pdf",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "partly",
            "findings": "3 minor, all in the Weighted validator and SpendingLimit hook; none in the Kernel diff",
            "note": "Review period 27 May to 9 June 2024; uploaded to the repository in August 2024 as the v3.1 incremental audit. The Kernel 3.2 release (December 2024) changed Kernel.sol, ExecLib and the core managers again after this review."
          },
          {
            "auditor": "KALOS (HAECHI LABS)",
            "date": "2024-04-12",
            "type": "audit",
            "scope": "Shared ZeroDev Kernel component: Kernel v3 KernelFactory and FactoryStaker (filed as kalos_v3_plugins.pdf).",
            "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/audits/kalos_v3_plugins.pdf",
            "commit": "85617952ec4cdf8d6478a9139540968fb92a6f10",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "unknown",
            "findings": "No security issues found",
            "note": "The factory deploys Kernel accounts; which factory Tuyo uses to deploy its accounts was not established."
          },
          {
            "auditor": "ChainLight (Theori)",
            "date": "2024-04-05",
            "type": "audit",
            "scope": "Shared ZeroDev Kernel component: Kernel v3.0 (ERC-7579) core contracts, including the validation, executor, hook and selector managers, ExecLib and the ECDSA validators.",
            "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/audits/chainlight_v3_0.pdf",
            "commit": "8646f2c25f2727019d91cbfb43f9c5688acc6fc2",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "partly",
            "findings": "2 high, 2 medium, 3 low, 5 informational; 9 patched, 1 acknowledged, 2 informational in progress",
            "note": "Audited commits 5f08673 and 8646f2c (March 2024, named in the report as zerodevapp/kernel_v3). Tuyo accounts run the Kernel 3.2 implementation 0xD830D15D..., which adds the v3.1 and v3.2 changes on top of the audited v3.0 code; the ECDSA validator is the audited design."
          },
          {
            "auditor": "KALOS (HAECHI LABS)",
            "date": "2023-09-20",
            "type": "audit",
            "scope": "Shared ZeroDev Kernel component: Kernel v2.2 and Kernel v2.2-Lite (KernelLiteECDSA), factories and executors.",
            "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/audits/kalos_v2_2_lite.pdf",
            "commit": "f00ee0fb519a3d85a5814c0b2fecfe476db36ed0",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "no",
            "findings": "1 critical, resolved",
            "note": "Superseded Kernel v2 line; Tuyo runs Kernel 3.2."
          },
          {
            "auditor": "KALOS (HAECHI LABS)",
            "date": "2023-08-09",
            "type": "audit",
            "scope": "Shared ZeroDev Kernel component: Kernel v2.2 core, factories, executors and validators (ECDSA, session key, kill switch).",
            "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/audits/kalos_v2_2.pdf",
            "commit": "199ae7d838f21b37f069267c86e8eeb6f0175a69",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "no",
            "findings": "1 critical, 2 high, 4 medium, 1 tip; 7 resolved, 1 acknowledged",
            "note": "Superseded Kernel v2 line; same audited commit and findings as the v2.1 report."
          },
          {
            "auditor": "KALOS (HAECHI LABS)",
            "date": "2023-08-09",
            "type": "audit",
            "scope": "Shared ZeroDev Kernel component: Kernel v2.1 core, factories, executors and validators (ECDSA, session key, kill switch).",
            "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/audits/kalos_v2_1.pdf",
            "commit": "199ae7d838f21b37f069267c86e8eeb6f0175a69",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "no",
            "findings": "1 critical, 2 high, 4 medium, 1 tip; 7 resolved, 1 acknowledged",
            "note": "Superseded Kernel v2 line; Tuyo runs Kernel 3.2."
          },
          {
            "auditor": "KALOS (HAECHI LABS)",
            "date": "2023-07-13",
            "type": "audit",
            "scope": "Shared ZeroDev Kernel component: original ZeroDev wallet Kernel (v1), account factory, MinimalAccount and session key plugin.",
            "url": "https://github.com/zerodevapp/kernel/blob/cfedcb9b047838f72491baaadef8fe7a95b2c837/audits/kalos_v1.pdf",
            "commit": "ae356c5478fc7c500bf270d864ef5eee70f292e6",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "no",
            "findings": "5 tips, 3 resolved",
            "note": "Superseded Kernel v1 line, audited in the former ZeroDev-wallet-kernel repository (now zerodevapp/kernel)."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 0,
        "short": 12,
        "unk": 11,
        "total": 23
      }
    },
    {
      "slug": "umbra",
      "name": "Umbra Cash",
      "type": "transfer",
      "website": "https://app.umbra.cash",
      "primary_chain": {
        "name": "Ethereum",
        "chain_id": 1,
        "basis": "umbra-js lists the same Umbra address on every chain, with mainnet first and the earliest start block (umbra-protocol@07a64aee umbra-js/src/classes/Umbra.ts L44-L92), and the frontend's supportedChains puts Mainnet first (frontend/src/components/models.ts L50-L61). Unit: the Umbra contract 0xFb2d…5401 and StealthKeyRegistry 0x31fe…38f3 on Ethereum. Excluded: Optimism, Polygon, Base, Arbitrum and Gnosis deployments of the same code, the optional UmbraBatchSend and Uniswap withdraw hook, and testnets."
      },
      "repos": [
        {
          "url": "https://github.com/ScopeLift/umbra-protocol",
          "role": "contracts",
          "license": "MIT"
        },
        {
          "url": "https://github.com/ScopeLift/umbra-subgraph",
          "role": "indexer",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
          "chain_id": 1,
          "role": "Umbra (payments and announcements)",
          "verified": "sourcify"
        },
        {
          "address": "0x31fe56609C65Cd0C510E7125f051D440424D38f3",
          "chain_id": 1,
          "role": "StealthKeyRegistry",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "Umbra contract",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "ScopeLift (owner EOA sets toll only; no proxy)",
          "required": true,
          "repo": "https://github.com/ScopeLift/umbra-protocol"
        },
        {
          "name": "StealthKeyRegistry (or ENS records) for receiver public keys",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "none (no admin functions)",
          "required": true,
          "repo": "https://github.com/ScopeLift/umbra-protocol"
        },
        {
          "name": "umbra-js SDK (stealth key derivation, scanning, sends)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/ScopeLift/umbra-protocol"
        },
        {
          "name": "Ethereum mainnet and a JSON-RPC endpoint of the user's choice",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Ethereum validators; RPC chosen by the user",
          "required": true,
          "repo": "https://github.com/ethereum/go-ethereum"
        },
        {
          "name": "Umbra API (token list, fee estimates, withdrawal relayer)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "ScopeLift",
          "required": false
        },
        {
          "name": "Hosted Ponder indexer behind the /api/ponder Netlify proxy",
          "role": "indexer",
          "public": false,
          "license": "proprietary",
          "operator": "ScopeLift",
          "required": false
        },
        {
          "name": "Umbra subgraph (The Graph)",
          "role": "indexer",
          "public": true,
          "license": "none",
          "operator": "ScopeLift",
          "required": false,
          "repo": "https://github.com/ScopeLift/umbra-subgraph"
        },
        {
          "name": "app.umbra.cash frontend",
          "role": "frontend",
          "public": true,
          "license": "MIT",
          "operator": "ScopeLift (Netlify)",
          "required": false,
          "repo": "https://github.com/ScopeLift/umbra-protocol"
        },
        {
          "name": "Etherscan-family APIs (recipient key lookup from tx history)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Etherscan",
          "required": false
        },
        {
          "name": "Chainalysis sanctions oracle lookup in umbra-js (0x40C5…C8fb)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Chainalysis",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/contracts/Umbra.sol#L34-L145",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "contracts-core/contracts/Umbra.sol",
              "detail": "The only owner powers are setToll, setTollCollector and setTollReceiver (L67-L85). Every send must pay exactly the current toll (L112-L115, L138), and the toll has no upper bound; there is no pause, blacklist or allowlist, and withdrawals do not check the toll.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "block_number": 26153546,
              "detail": "owner() is 0x5777…7232, an address with no code (EOA), also listed as admin in contracts-core/deploy-history/mainnet-latest.json; toll() is 0 at block 26153546.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xFb2dc580Eed955B528407b4d36FfaFe3da685401 \"owner()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000005777aa6f437399af6cef2fce0be8d4b4ed7c7232"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/address/0x5777Aa6F437399Af6cef2Fce0BE8D4B4eD7C7232",
              "address": "0x5777Aa6F437399Af6cef2Fce0BE8D4B4eD7C7232",
              "eoa": true,
              "block_number": 26153546,
              "detail": "The owner address has no code at block 26153546.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "The contract cannot pause, freeze or block addresses, and withdrawals are untouched by any admin. But the owner, a single EOA, can set the per-payment toll to any value, which would make new sends uneconomic or impossible for everyone, with no delay. The toll is 0 today. Judgment call: a toll is an anti-spam fee, not a pause, but because it is unbounded and EOA-held it can stop settlement, so anchor 0 (EOA-held role).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/contracts/Umbra.sol#L106-L239",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "contracts-core/contracts/Umbra.sol",
              "detail": "sendEth and sendToken are open to any caller; withdrawToken is called by the stealth address itself, and withdrawTokenOnBehalf can be submitted by anyone holding the stealth address's signature.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/contracts-core/contracts/Umbra.sol?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | sed -n 106,239p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "block_number": 26153546,
              "detail": "The deployed Umbra contract is an exact Sourcify match whose source equals Umbra.sol at 07a64aee apart from a trailing newline; the address is documented in umbra-js (Umbra.ts L44).",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer sends by calling the contract directly; ETH goes straight to the stealth address, tokens wait in the contract until the stealth key withdraws them, directly or through anyone it signs for. The address and ABI are in the public SDK. We did not run a transaction.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/umbra-js/src/classes/Umbra.ts#L444-L470",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "umbra-js/src/classes/Umbra.ts",
              "detail": "Announcement scanning uses a subgraph if configured and falls back to RPC logs on failure; chainConfig may set subgraphUrl to false.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/umbra-js/src/classes/Umbra.ts?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | sed -n 444,470p",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/utils/umbra-api.ts#L34-L36",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "frontend/src/utils/umbra-api.ts",
              "detail": "The app's relayer and token list come from the hardcoded Umbra API (mainnet.api.umbra.cash), whose code is not public; the contract accepts withdrawTokenOnBehalf from any submitter.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Settlement needs only the contracts, the SDK and an RPC. The closed Umbra API relayer is optional: the stealth address can withdraw itself, or any account can submit its signed withdrawal. The indexer is optional too. Judgment call: withdrawing tokens without the relayer needs gas from elsewhere, which affects privacy, not settlement, so 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/umbra-js/src/utils/utils.ts#L927-L1192",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "umbra-js/src/utils/utils.ts",
              "detail": "assertSupportedAddress rejects recipients and destinations on hardcoded banned lists and, for single recipients, those flagged by the Chainalysis sanctions oracle 0x40C5…C8fb; it is called on send and withdraw (Umbra.ts L227, L268, L336, L397).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/umbra-js/src/utils/utils.ts?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | sed -n 1170,1192p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "block_number": 26153546,
              "detail": "The deployed contract has no address or country checks.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "The contracts are neutral. The SDK screens addresses against public lists and the Chainalysis oracle, visibly in code, and the direct contract path bypasses it (C2 = 3). Judgment call: this meets anchor 3 in substance, but the repo's umbra-js 0.3.0 is not on npm (latest is 0.2.2), so there is no package to pin and we ran no trace; 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/utils/umbra-api.ts#L65-L80",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "frontend/src/utils/umbra-api.ts",
              "detail": "The app's supported-token list is fetched from the Umbra API (/tokens?chainId=) at runtime; the contract accepts any ERC20.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Chains are enumerated in the SDK, but supported tokens live only in a hosted API response, and we found no statement that issuer freezes can lock tokens held by the Umbra contract or a stealth address. Scored 0: not enumerated in code or docs.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x31fe56609C65Cd0C510E7125f051D440424D38f3",
              "address": "0x31fe56609C65Cd0C510E7125f051D440424D38f3",
              "block_number": 26153546,
              "detail": "Sourcify returns exact_match for Umbra and StealthKeyRegistry (and UmbraBatchSend); their sources equal the repo files apart from a trailing newline.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0xFb2dc580Eed955B528407b4d36FfaFe3da685401 0x31fe56609C65Cd0C510E7125f051D440424D38f3; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/1/$a | jq -r .match; done"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/hardhat.config.ts#L165-L195",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "contracts-core/hardhat.config.ts",
              "detail": "Hardhat pins solc 0.8.7 and 0.7.6 with optimizer runs 999999, matching the Sourcify compilation settings.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Both settlement contracts are full Sourcify matches and the build settings are in the repo. Judgment call: anchor 3 also needs a build from the pinned commit that reproduces the bytecode; the repo files differ by a trailing newline, which changes the metadata hash, and we did not rebuild, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/tree/07a64aeef305399a86afe72e502156d72babcc17/frontend",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "frontend",
              "detail": "The monorepo holds contracts-core (with deploy history), contracts-periphery, umbra-js and the frontend; umbra-subgraph holds the subgraph. The Umbra API and Ponder indexer code are not in any ScopeLift repo we found; their request and response types are in frontend/src/components/models.ts.",
              "checked_at": "2026-10-09",
              "recheck": "gh repo list ScopeLift --limit 100 --json name | jq -r '.[].name' | grep -i umbra"
            }
          ],
          "finding": "Contracts, SDK, frontend, subgraph and deploy history are public. The backend (Umbra API relayer and token list) and the production Ponder indexer are closed. Judgment call: their API types are committed in the frontend, which we accept as the schema for 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/README.md#L85-L140",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "README.md",
              "detail": "The README gives development instructions (install, env setup from .env.example, build and test per workspace).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Build and run documentation exists, with an .env.example. Reproduction not attempted, so capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/contracts/Umbra.sol#L12-L27",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "contracts-core/contracts/Umbra.sol",
              "detail": "Announcement and TokenWithdrawal event schemas are in the contract; ABIs ship in umbra-js, and the Umbra API types are in frontend/src/components/models.ts.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/contracts-core/contracts/Umbra.sol?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | sed -n 12,27p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ABIs, events and the API's types are in the repo. We found no payee export in a non-proprietary format. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/LICENSE.txt",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "LICENSE.txt",
              "detail": "The umbra-protocol monorepo (contracts, SDK, frontend) is MIT; umbra-subgraph has no licence (GitHub license API returns null).",
              "checked_at": "2026-10-09",
              "recheck": "for r in umbra-protocol umbra-subgraph; do echo $r $(gh api repos/ScopeLift/$r --jq '.license.spdx_id // \"none\"'); done",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every required component is MIT. The optional subgraph repo has no licence. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/README.md#L223-L231",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "README.md",
              "detail": "Contributions are by fork and PR with no CLA; LICENSE.txt has been MIT since 2020-05-21 (commits ee79a21e, 6e31df6b, d0c1e113, ec1646d8 only changed copyright text).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/commits?path=LICENSE.txt&sha=07a64aeef305399a86afe72e502156d72babcc17\" --jq '.[].sha'",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "No CLA and no relicensing; no written licence-stability commitment. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/utils/umbra-api.ts#L65-L80",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "frontend/src/utils/umbra-api.ts",
              "detail": "The frontend falls back to an empty token list if the Umbra API fails, so the hosted app's token sends and relayed withdrawals depend on the closed API; the SDK and contracts do not.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/frontend/src/utils/umbra-api.ts?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | sed -n 65,80p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The protocol runs with public code and any RPC. The closed Umbra API and Ponder indexer are optional for the protocol, but a self-hosted copy of the app loses token sends and relayed withdrawals without them. Scored 2: optional proprietary components.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/package.json#L21-L40",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "frontend/package.json",
              "detail": "No analytics, telemetry, error-reporting or fingerprinting dependency; bnc-notify is initialised without a dappId in UI-only mode (frontend/src/utils/alerts.ts L7-L10).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/frontend/package.json?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | grep -iE \"sentry|analytics|gtag|amplitude|mixpanel|segment|posthog|fingerprint|datadog\"",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "The SDK and frontend ship no analytics or telemetry. Judgment call: absence shown only in code, with no package for the current SDK and no trace, is capped at 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/pages/PrivacyPolicy.vue#L5-L30",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "frontend/src/pages/PrivacyPolicy.vue",
              "detail": "The privacy policy says hosting providers may log request IP addresses, retained up to 90 days, and that no cookies are used.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/frontend/src/pages/PrivacyPolicy.vue?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | sed -n 5,30p",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "The protocol takes only a stealth address, amount, token, ephemeral key and ciphertext; there is no account or form. The hosted app's servers and the Umbra API log IP addresses, disclosed in a privacy policy committed to the repo and avoidable by using the SDK. Judgment call: the only extra data is IP logging on optional hosted services, disclosed in a versioned document, so 2 rather than 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/contracts/Umbra.sol#L12-L27",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "contracts-core/contracts/Umbra.sol",
              "detail": "Announcement emits the stealth address, amount, token, ephemeral public key x-coordinate and a 32-byte ciphertext; TokenWithdrawal emits the stealth address and the acceptor.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/contracts-core/contracts/Umbra.sol?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | sed -n 12,27p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Each payment goes to a fresh stealth address that observers cannot tie to the payee; the payer, amount and token are public. The link reappears if the payee withdraws to a known address, funds the stealth address from a known account, or batches withdrawals; the README states these limits. Judgment call: this is a stealth-address pattern with no invoice data, so 3 on what the code reveals; withdrawal hygiene is behavioural.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/umbra-js/src/classes/TxHistoryProvider.ts#L6-L25",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "umbra-js/src/classes/TxHistoryProvider.ts",
              "detail": "Recipient public-key lookup by transaction history calls Etherscan-family APIs; the app also calls the Umbra API (umbra-api.ts L36), the Ponder proxy, TxPrice and POAP APIs, and WalletConnect.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/umbra-js/src/classes/TxHistoryProvider.ts?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | sed -n 6,25p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Beyond the RPC, the app sends requests to ScopeLift's API and indexer and to Etherscan, TxPrice and POAP; the Chainalysis check is an RPC read. All are named in code. The Umbra API URL is hardcoded; the RPC and subgraph URLs come from env or SDK config. Judgment call: 2, as the hardcoded API is avoidable by using the SDK.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/umbra-js/src/classes/Umbra.ts#L100-L145",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "umbra-js/src/classes/Umbra.ts",
              "detail": "The SDK takes the provider from the caller and accepts a custom chainConfig with any subgraphUrl or false (RPC logs only); the app reads RPC and indexer URLs from env at build time.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/umbra-js/src/classes/Umbra.ts?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d | sed -n 100,145p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "RPC and indexer are configurable in the SDK, and the subgraph code is public. Judgment call: the production indexer is a Ponder deployment whose code we did not find, and the app has no UI setting, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/contracts/Umbra.sol#L106-L278",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "contracts-core/contracts/Umbra.sol",
              "detail": "ETH is forwarded to the stealth address in the same call; tokens are recorded in tokenPayments and released only to an acceptor chosen by the stealth key. collectTolls moves only the contract's ETH balance (tolls).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "block_number": 26153546,
              "detail": "Implementation slot zero (no proxy); ETH balance 0 at block 26153546.",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0xFb2dc580Eed955B528407b4d36FfaFe3da685401 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ETH payments are direct transfers to an address only the payee controls; token payments sit in a non-upgradeable contract that releases them only on the stealth key's instruction. No role can redirect funds.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "block_number": 26153546,
              "detail": "Umbra and StealthKeyRegistry have zero EIP-1967 implementation and admin slots, are exact Sourcify matches, and their source has no upgrade, delegatecall or selfdestruct path.",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0xFb2dc580Eed955B528407b4d36FfaFe3da685401 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103 --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Non-upgradeable. The owner can change only the toll settings (see C1).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/pages/AccountSend.vue#L1032-L1038",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "frontend/src/pages/AccountSend.vue",
              "detail": "When the allowance is short, the app approves MaxUint256 to the Umbra contract (and to UmbraBatchSend at L1157-L1163); no unlimited-approval wording was found in the en-US strings.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "The app requests an unlimited allowance by default without saying so. The spender is immutable and pulls only from msg.sender, which limits the exposure, but the anchor concerns the scope requested. Scored 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "block_number": 26153546,
              "detail": "The contract is not a proxy and withdrawToken / withdrawTokenOnBehalf are open to the stealth key or its signature (C2).",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xFb2dc580Eed955B528407b4d36FfaFe3da685401 \"toll()(uint256)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x285aaa20",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=3, C2=3, C3=3, O3=1. Payees keep their funds without ScopeLift: ETH is already in the stealth address, and tokens can be withdrawn by calling the contract with keys derived client-side. Sending can continue via the SDK and an RPC, provided the owner EOA does not raise the toll (C1). A public frontend exists but was not reproduced (O3=1). Judgment call: 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/umbra-js/src/classes/TxHistoryProvider.ts#L6-L25",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "umbra-js/src/classes/TxHistoryProvider.ts",
              "detail": "umbra-js reads ETHERSCAN_API_KEY and per-chain explorer keys from process.env, and the frontend .env.example lists them with RPC URLs, so a browser build embeds them; they authorise only explorer and RPC quota.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ScopeLift/umbra-protocol/contents/frontend/.env.example?ref=07a64aeef305399a86afe72e502156d72babcc17\" --jq .content | base64 -d",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Spending and viewing keys are derived from a wallet signature in the browser and never sent anywhere. There are no webhooks or merchant keys. Explorer and RPC keys ship in the client bundle. Judgment call: 2 for the bundled read-only keys.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/i18n/locales/en-US.json#L191-L195",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "path": "frontend/src/i18n/locales/en-US.json",
              "detail": "The FAQ states the contracts were audited by ConsenSys Diligence (2021-03 report) and umbra-js by Least Authority; the Least Authority PDF resolves, while the ConsenSys page returned 403 to curl and was not read.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-12"
            }
          ],
          "finding": "Audit reports are linked, but we could not read an audited commit from either report, so we cannot tie them to the deployed bytecode. No bug bounty or SECURITY file found. Scored 1: audit report only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "The contracts have no address or country checks, and neither umbra-js nor the app has a country gate; the app's terms name no restricted countries. umbra-js refuses sanctioned addresses (hardcoded lists and the Chainalysis oracle), which is address-level screening, not geographic.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/contracts/Umbra.sol#L106-L145",
            "commit": "07a64aeef305399a86afe72e502156d72babcc17",
            "path": "contracts-core/contracts/Umbra.sol",
            "detail": "Sends check only the toll and amounts; a search of frontend/src, umbra-js/src and netlify for country, geo and restricted found no country gate.",
            "recheck": "gh api -X GET search/code -f q='country repo:ScopeLift/umbra-protocol' --jq '.items[].path'",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: Ethereum Umbra 0xFb2d…5401 and StealthKeyRegistry 0x31fe…38f3; the same addresses exist on Optimism, Polygon, Base and Arbitrum and were not read. Reads at block 26153546 via publicnode. tollCollector is an EOA (0x12aE…2615) and tollReceiver an account with EIP-7702 delegation code whose VERSION() returns 1.3.0 (0xb443…17F9). The ConsenSys Diligence audit page returned 403 and was not bypassed. No transactions, UI runs, traces or self-host attempts.",
      "audits": {
        "searched": "The app FAQ (\"Has Umbra been audited?\" in frontend/src/pages/FAQ.vue at umbra-protocol@07a64aee), the ScopeLift/umbra-protocol and umbra-subgraph repos (no audits folder), ConsenSys Diligence's audit page (HTML returned 403 to scripted requests; the PDF resolves), Least Authority's publications, Cure53's report list and the paulmillr/noble-secp256k1 audit folder. No audit of StealthKeyRegistry (added August 2021), the Umbra API, relayer or Ponder indexer was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Least Authority",
            "date": "2021-05-25",
            "type": "audit",
            "scope": "umbra-js SDK (stealth key derivation, encryption, scanning, ENS/CNS key lookup)",
            "url": "https://leastauthority.com/static/publications/LeastAuthority_ScopeLift_Umbra-js_Final_Audit_Report.pdf",
            "commit": "48991f0fabbcf19bb9882903c6ccf8e21a4f9c6d",
            "repo": "https://github.com/ScopeLift/umbra-protocol",
            "covers_deployed": "partly",
            "findings": "3 issues (64-bit default stealth security, missing curve check, noble-secp256k1 key bias) and 3 suggestions; issues resolved, verification at 3796fa74",
            "note": "umbra-js has had about 90 commits since June 2021, so the shipped SDK has moved on from the audited code."
          },
          {
            "auditor": "Cure53",
            "date": "2021-04-22",
            "type": "audit",
            "scope": "noble-secp256k1 library (shared dependency used by umbra-js for elliptic-curve operations), around v1.2",
            "url": "https://cure53.de/pentest-report_noble-lib.pdf",
            "covers_deployed": "partly",
            "findings": "1 high, 2 medium, 1 informational; the three security issues confirmed fixed",
            "note": "Funded by Umbra and a Gitcoin grant and linked from the Umbra FAQ. umbra-js now depends on @noble/secp256k1 ^1.7.1, later than the audited version."
          },
          {
            "auditor": "ConsenSys Diligence",
            "date": "2021-03",
            "type": "audit",
            "scope": "Umbra.sol and IUmbraHookReceiver.sol; cursory review of the ENS StealthKeyResolver",
            "url": "https://consensys.io/diligence/audits/2021/03/umbra-smart-contracts/umbra-audit-2021-03.pdf",
            "commit": "fa2e17367d66a85f20c77299ded5942d9ab64fe0",
            "repo": "https://github.com/ScopeLift/umbra-protocol",
            "covers_deployed": "partly",
            "findings": "1 minor finding (fixed) and 4 recommendations (1 fixed)",
            "note": "Umbra.sol changed after the audit only for the two fixes (7cfdc81b, d6e4235f) and visibility/formatting edits, so the deployed Umbra contract is close to the audited code; the deployed StealthKeyRegistry was written in August 2021 and is not in scope. Off-chain code was excluded."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C5"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 2,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 2,
          "limiting": [
            "P1",
            "P2",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S3"
          ]
        }
      },
      "tally": {
        "holds": 18,
        "short": 5,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "wirex-one",
      "name": "Wirex One",
      "type": "card",
      "website": "https://www.wirexapp.com/legal/one/terms",
      "primary_chain": {
        "name": "Base",
        "chain_id": 8453,
        "basis": "The Wirex One web app bundle (archived) sets companyName \"Wirex One\", calls the Wirex BaaS API and registers chain 8453; Wirex's BaaS repo (7dff6ea) names Base and production ContractRegistry 0xAFa697eb..., whose FundsManagement runs card debits (Card-Debit-POS). Reads pinned to Base block 52290735. Excluded: legacy Wirex Pay chain 31415 (not in the RPC list), Stellar, chain 5042."
      },
      "repos": [
        {
          "url": "https://github.com/wirexapp/wirex-baas-agent-skills",
          "role": "docs",
          "license": "Apache-2.0"
        }
      ],
      "contracts": [
        {
          "address": "0xAFa697ebC7919998AF5CdE325Fbe990dC926aae4",
          "chain_id": 8453,
          "role": "ContractRegistry (owner and admin EOA; unverified)",
          "verified": "none"
        },
        {
          "address": "0xFB384a73e9B89b01749C1127cDe4FeA20fb9F06a",
          "chain_id": 8453,
          "role": "FundsManagement proxy (wallet executor; card debits)",
          "verified": "sourcify"
        },
        {
          "address": "0x9D56758B772CA389802E97D832D0DAf6b8E47703",
          "chain_id": 8453,
          "role": "FundsManagement implementation",
          "verified": "sourcify"
        },
        {
          "address": "0x51ca975555B547f9E3224d60e97292360f1f9DB7",
          "chain_id": 8453,
          "role": "Accounts proxy",
          "verified": "sourcify"
        },
        {
          "address": "0x780c27ece1037B65553A306317780fD4Ecf571a3",
          "chain_id": 8453,
          "role": "ExecutionDelayPolicy proxy (withdrawal delay)",
          "verified": "sourcify"
        },
        {
          "address": "0x8CE61167f79aae19a528C30f5ebfcf7FC2242890",
          "chain_id": 8453,
          "role": "ExecutionDelayPolicy implementation",
          "verified": "sourcify"
        },
        {
          "address": "0xfb7Fb83C837b0AD724DfeDB02D45a82c053647cF",
          "chain_id": 8453,
          "role": "TokensRegistry proxy (implementation unverified)",
          "verified": "sourcify"
        },
        {
          "address": "0xbFACe6Ad3c7f07714F2Cc0a2651436f897537a95",
          "chain_id": 8453,
          "role": "FundsBuffer proxy (receives card debits)",
          "verified": "sourcify"
        },
        {
          "address": "0xED22eA8be14bea1dd70fD0A770D2498117cfE0fF",
          "chain_id": 8453,
          "role": "ProxyAdmin of FundsManagement (owner EOA)",
          "verified": "none"
        },
        {
          "address": "0x7a55A64c4527A2fD8e423F4c0F684C14FDe774c1",
          "chain_id": 8453,
          "role": "Sample user wallet (Kernel v3.1 proxy)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "Wirex BaaS contracts on Base (registry, FundsManagement, policies)",
          "role": "contracts",
          "public": true,
          "license": "none",
          "operator": "Wirex (owner EOA 0x8b72...e0ab)",
          "required": true
        },
        {
          "name": "Kernel v3.1 smart account (ZeroDev)",
          "role": "wallet",
          "public": true,
          "license": "MIT",
          "operator": "user, with Wirex executor module installed",
          "required": true
        },
        {
          "name": "Wirex One app (web and mobile)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Wirex",
          "required": true
        },
        {
          "name": "Wirex BaaS API (api-baas.wirexapp.com)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Wirex",
          "required": true
        },
        {
          "name": "FundsManagementOracle (EOA that executes card debits)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Wirex",
          "required": true
        },
        {
          "name": "Privy key management (user signer)",
          "role": "signer",
          "public": false,
          "license": "proprietary",
          "operator": "Privy",
          "required": true
        },
        {
          "name": "ERC-4337 bundler and paymaster (operator for Base not identified)",
          "role": "bundler",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed (repo docs show bundler.wirexpay.com for Polygon)",
          "required": true
        },
        {
          "name": "Card issuer (Wirex Limited; Novatti in AU/NZ)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Wirex Limited, Novatti Group",
          "required": true
        },
        {
          "name": "Visa or Mastercard",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa, Mastercard",
          "required": true
        },
        {
          "name": "Identity verification provider (not named)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "undisclosed",
          "required": true
        },
        {
          "name": "Crossmint Europe (EEA crypto-asset services, SEPA off-ramp)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Crossmint Europe S.L.",
          "required": false
        },
        {
          "name": "Web app analytics (Sentry, Amplitude, Google Tag Manager, GrowthBook)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Sentry, Amplitude, Google, GrowthBook",
          "required": false
        },
        {
          "name": "Settlement tokens (USDC, USDT, EURC, DAI; Wirex synthetics WUSD, WEUR)",
          "role": "contracts",
          "public": true,
          "license": "proprietary",
          "operator": "Circle, Tether, Sky, Wirex",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xAFa697ebC7919998AF5CdE325Fbe990dC926aae4",
              "address": "0xAFa697ebC7919998AF5CdE325Fbe990dC926aae4",
              "block_number": 52290735,
              "detail": "ContractRegistry owner() and admin() both return 0x8b72904e3685448E6f890d65a15D2aA206C1e0ab, which has no code (EOA); contractByName(\"FundsManagementOracle\") returns 0x467F3ACD346A3Aa56F612820367023B94dC73d3f, also an EOA.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xf851a440",
                "expect": "0x0000000000000000000000008b72904e3685448e6f890d65a15d2aa206c1e0ab"
              },
              "recheck": "cast call 0xAFa697ebC7919998AF5CdE325Fbe990dC926aae4 \"admin()(address)\" --rpc-url https://mainnet.base.org; cast code 0x8b72904e3685448E6f890d65a15D2aA206C1e0ab --rpc-url https://mainnet.base.org",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/8453/0x9D56758B772CA389802E97D832D0DAf6b8E47703",
              "address": "0x9D56758B772CA389802E97D832D0DAf6b8E47703",
              "block_number": 52290735,
              "detail": "FundsManagement (Sourcify match) processOutgoingTransaction (L293-L346) is onlyOracle and moves any amount of a token out of a named user wallet via executeFromExecutor; the oracle and admin addresses are read from the registry, which the owner EOA can repoint.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/terms",
              "detail": "Terms 4.17 let Wirex restrict or block addresses through Wirex One for sanctions or risk policy.",
              "quote": "Wirex may restrict or block access, through Wirex One, to certain On-Chain Infrastructure, digital assets, or blockchain addresses",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no pause flag, but there is a stronger power. A single oracle EOA, set in a registry whose owner and admin is one EOA, both decides and executes every debit from user wallets, and the Terms let Wirex block addresses. No multisig, no timelock, and it can target individual wallets. The Terms' statement that Wirex cannot move a user's assets does not match FundsManagement's oracle path.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/tx/0x38f4c152e86d59aadd0fb72242575ddd1a25deeb4890e2fb75db380f44aa013b",
              "address": "0xFB384a73e9B89b01749C1127cDe4FeA20fb9F06a",
              "block_number": 52290735,
              "detail": "A card purchase (OutgoingTransactionProcessed, transactionType \"Card-Debit-POS\", currency EUR) debited WUSD from wallet 0x7a55A64c4527A2fD8e423F4c0F684C14FDe774c1; 392 such events were emitted in the 200 blocks before 52290735, all through the onlyOracle path.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Card payments settle through the issuer and card network offchain. The onchain debit can only be run by Wirex's oracle EOA. A user can withdraw their own tokens directly (see S4), but that is exit, not settlement.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://one.wirexapp.com",
              "detail": "The production web app config hardcodes externalApiUrl https://api-baas.wirexapp.com and loads its runtime config from it.",
              "quote": "externalApiUrl:rc(\"https://api-baas.wirexapp.com\")",
              "archive": "data/archive/wirex-one-web-app-config.txt",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-onboarding/references/WALLET-DEPLOYMENT.md#L122-L131",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "skills/wirex-baas-onboarding/references/WALLET-DEPLOYMENT.md",
              "detail": "The wallet example sends user operations through Wirex-run bundler and paymaster endpoints (bundler.wirexpay.com, paymaster.wirexpay.com).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Card debits need Wirex's API and oracle key, wallet signing goes through Privy, and user operations are sponsored by a Wirex paymaster. None of it is public or has a fallback. Closed, single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/terms",
              "detail": "The Terms disclose that Wirex may block blockchain addresses for sanctions, regulation or its own risk policy.",
              "quote": "Wirex may restrict or block access, through Wirex One, to certain On-Chain Infrastructure, digital assets, or blockchain addresses",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/8453/0x8CE61167f79aae19a528C30f5ebfcf7FC2242890",
              "address": "0x8CE61167f79aae19a528C30f5ebfcf7FC2242890",
              "block_number": 52290735,
              "detail": "ExecutionDelayPolicy classifies every user operation and rejects \"Restricted\" types (L118-L131, L355-L368); the classification follows admin-set registry entries and whitelists (setApprovedCall, onlyAdmin).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The contracts let the admin decide which user operations are allowed, and the Terms disclose address blocking for sanctions or risk policy, without naming a list. The filtering is disclosed in the Terms, and the settlement layer is not shown to be neutral, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xfb7Fb83C837b0AD724DfeDB02D45a82c053647cF",
              "address": "0xfb7Fb83C837b0AD724DfeDB02D45a82c053647cF",
              "block_number": 52290735,
              "detail": "TokensRegistry retrieveAllTokensV2() lists USDC, USDT, DAI, EURC, OUSD, OEUR and the Wirex synthetics WUSD (base USDC) and WEUR (base EURC).",
              "checked_at": "2026-10-07",
              "recheck": "cast call 0xfb7Fb83C837b0AD724DfeDB02D45a82c053647cF \"retrieveAllTokensV2()((address,string,uint256,bool,address)[])\" --rpc-url https://mainnet.base.org"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-overview/references/ENVIRONMENTS.md#L163-L171",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "skills/wirex-baas-overview/references/ENVIRONMENTS.md",
              "detail": "The repo doc enumerates the Base production tokens (USDC, USDT, EURC, WUSD, WEUR) with addresses; no file in the repo mentions issuer freeze or blacklist powers or Base's sequencer.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens are enumerated onchain and in a versioned repo document. Users are not told about the issuers' freeze powers (Circle and Tether blacklists), Wirex's own control of the upgradeable WUSD/WEUR synthetics, or Base's centralized sequencer. Enumerated, assumptions not stated, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/8453/0x9D56758B772CA389802E97D832D0DAf6b8E47703",
              "address": "0x9D56758B772CA389802E97D832D0DAf6b8E47703",
              "block_number": 52290735,
              "detail": "Sourcify v2 gives exact_match for the Accounts, FundsManagement, ExecutionDelayPolicy, TokensRegistry and FundsBuffer proxies, and match (partial) for the FundsManagement, Accounts, ExecutionDelayPolicy and FundsBuffer implementations; the ContractRegistry 0xAFa697eb... and the TokensRegistry implementation 0x6098927a... have no Sourcify match.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Most logic contracts are verified as partial matches, but the registry that routes every role and address is unverified, and so is one implementation. No build script is public. Some contracts verified, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/README.md#L1-L16",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "README.md",
              "detail": "The only Wirex repo for this stack is a set of agent skills (Markdown docs and tests) describing the BaaS REST API and contracts; the wirexapp and wirexpay orgs hold no SDK, app, backend or indexer source (wirexpay has forks of rundler, ultra-relay and Argo CD only).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Contract source is visible only through Sourcify verification. The app, API, oracle, indexer and SDK are closed. Contracts only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/README.md#L1-L16",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "README.md",
              "detail": "The README installs agent skills for calling Wirex's hosted API; there are no build or deploy instructions for any component.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no self-host path: no deployable code is public. Reproduction not attempted.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-crypto/references/ABI-REFERENCE.md#L1-L13",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "skills/wirex-baas-crypto/references/ABI-REFERENCE.md",
              "detail": "ABI fragments for ContractRegistry, Accounts, TokensRegistry, Kernel and ERC20 only; nothing for FundsManagement, ExecutionDelayPolicy or FundsBuffer. The REST API is described in Markdown, with no OpenAPI file and no export format.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Partial ABIs and prose API docs for BaaS integrators are in a repo. There is no machine-readable API schema, no ABI for the contracts that move funds, and no user data export. Judgment call: partial coverage fits \"documented only\" (1) better than 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/8453/0x9D56758B772CA389802E97D832D0DAf6b8E47703",
              "address": "0x9D56758B772CA389802E97D832D0DAf6b8E47703",
              "block_number": 52290735,
              "detail": "The verified FundsManagement and ExecutionDelayPolicy sources carry SPDX-License-Identifier UNLICENSED.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The contracts are published as UNLICENSED, and the app, API, oracle, issuer and Privy are closed. Nothing needed to run the product can be forked.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://one.wirexapp.com",
              "detail": "The app requires the hosted BaaS API at startup.",
              "quote": "externalApiUrl:rc(\"https://api-baas.wirexapp.com\")",
              "archive": "data/archive/wirex-one-web-app-config.txt",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The product cannot run without Wirex's hosted API, oracle key, Privy and card partners.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://one.wirexapp.com",
              "detail": "The production web app bundle configures a Sentry DSN (ingest.de.sentry.io) and ships an Amplitude HTTP client, a Google Tag Manager loader and a GrowthBook client key.",
              "quote": "https://api2.amplitude.com/2/httpapi",
              "archive": "data/archive/wirex-one-web-app-config.txt",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/privacy",
              "detail": "The privacy policy says data is shared with providers for analytics, among other purposes, without naming them.",
              "quote": "support account creation, identity verification, wallet infrastructure, blockchain connectivity, transaction monitoring, fraud prevention, customer support, analytics and communications",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Error reporting, product analytics and tag management are on by default in the web app. The privacy policy discloses analytics only by category. Judgment call: category-level disclosure counts as \"disclosed in docs\" (1) rather than undisclosed (0); no trace was run.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/privacy",
              "detail": "The privacy policy lists identity, KYC, wallet and account-abstraction addresses, transaction data and device data among the data processed.",
              "quote": "account abstraction wallet addresses",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC and profile data go well beyond settlement needs. This is disclosed in the privacy policy, not in code or a versioned repo document, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/tx/0x38f4c152e86d59aadd0fb72242575ddd1a25deeb4890e2fb75db380f44aa013b",
              "address": "0xFB384a73e9B89b01749C1127cDe4FeA20fb9F06a",
              "block_number": 52290735,
              "detail": "Each card debit emits OutgoingTransactionProcessed with transaction and operation IDs, the plaintext type \"Card-Debit-POS\", fiat currency \"EUR\", amounts and the user's wallet; Accounts events carry the partner's parentEntity.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/privacy",
              "detail": "The privacy policy says public blockchain records hold wallet addresses, amounts and timestamps that can be linked to the user through off-chain records.",
              "quote": "We do not intend to write direct personal identifiers",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card purchase is published onchain against the user's wallet, with its type, currency and amount and a stable wallet address, so anyone can rebuild a cardholder's spending history. The linkage is disclosed in the privacy policy, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/privacy",
              "detail": "The privacy policy names categories of recipients (identity verification, wallet infrastructure, blockchain infrastructure, card and payment partners, analytics); the Terms name Privy, Crossmint and the card issuers.",
              "quote": "support account creation, identity verification, wallet infrastructure, blockchain connectivity, transaction monitoring, fraud prevention, customer support, analytics and communications",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Privy, the issuer, the card network, Crossmint, KYC and analytics vendors all see user or payment data. They are disclosed in the Terms and privacy policy (some only by category) and cannot be swapped. Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://one.wirexapp.com",
              "detail": "The API URL is baked in at build time and the Base chain is defined with https://mainnet.base.org as its RPC; the app exposes no setting to change either.",
              "quote": "rpcUrls:{default:{http:[\"https://mainnet.base.org\"]}",
              "archive": "data/archive/wirex-one-web-app-config.txt",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Endpoints are hardcoded in the app and the indexer is closed. Hardcoded, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://repo.sourcify.dev/8453/0x9D56758B772CA389802E97D832D0DAf6b8E47703",
              "address": "0x9D56758B772CA389802E97D832D0DAf6b8E47703",
              "block_number": 52290735,
              "detail": "processOutgoingTransaction (L293-L346) sends a wallet's tokens to FundsBuffer or to a destination set by configureTokenDestination (L1061-L1071, onlyAdmin); both are reachable only by Wirex EOAs.",
              "checked_at": "2026-10-07"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x7a55A64c4527A2fD8e423F4c0F684C14FDe774c1",
              "address": "0x7a55A64c4527A2fD8e423F4c0F684C14FDe774c1",
              "block_number": 52290735,
              "detail": "The sample user wallet (Kernel v3.1 proxy, accountId kernel.advanced.v0.3.1) has FundsManagement installed as executor (isModuleInstalled(2, FundsManagement) = true; FundsManagement.status = Live).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Between the user's wallet and the merchant, funds move into Wirex's FundsBuffer, and the oracle can send them to any destination the admin EOA sets. The Terms call the wallet self-custodial and say Wirex cannot move user assets, while the installed executor lets Wirex's oracle move them. The provider can redirect funds, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xED22eA8be14bea1dd70fD0A770D2498117cfE0fF",
              "address": "0xED22eA8be14bea1dd70fD0A770D2498117cfE0fF",
              "block_number": 52290735,
              "detail": "The FundsManagement proxy's EIP-1967 admin is this ProxyAdmin, whose owner() is EOA 0x8b72904e3685448E6f890d65a15D2aA206C1e0ab; the Accounts, ExecutionDelayPolicy, TokensRegistry and FundsBuffer ProxyAdmins have the same owner.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x0000000000000000000000008b72904e3685448e6f890d65a15d2aa206c1e0ab"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0xFB384a73e9B89b01749C1127cDe4FeA20fb9F06a",
              "address": "0xFB384a73e9B89b01749C1127cDe4FeA20fb9F06a",
              "block_number": 52290735,
              "detail": "EIP-1967 admin slot of the FundsManagement proxy.",
              "checked_at": "2026-10-07",
              "check": {
                "slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103",
                "expect": "0x000000000000000000000000ed22ea8be14bea1dd70fd0a770d2498117cfe0ff"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "One EOA can upgrade every BaaS contract (implementations were redeployed around block 52.04M, days before this read) with no timelock. EOA admin, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x7a55A64c4527A2fD8e423F4c0F684C14FDe774c1",
              "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
              "block_number": 52290735,
              "detail": "USDC allowance(sample wallet 0x7a55A64c..., FundsManagement) is 2^256-1; the WUSD allowance is also unlimited. FundsManagement.setApprovalsForRegistryTokens (L146-L163) grants type(uint256).max on every registry token at onboarding.",
              "checked_at": "2026-10-07",
              "check": {
                "call": "0xdd62ed3e0000000000000000000000007a55a64c4527a2fd8e423f4c0f684c14fde774c1000000000000000000000000fb384a73e9b89b01749c1127cde4fea20fb9f06a",
                "expect": "0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Onboarding gives the Wirex FundsManagement contract unlimited allowances on every supported token, and I found no user-facing disclosure. Unbounded, undisclosed, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-crypto/SKILL.md#L132-L161",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "skills/wirex-baas-crypto/SKILL.md",
              "detail": "ERC-20 withdrawals use a request-then-execute pattern enforced by ExecutionDelayPolicy; the policy storage at block 52290735 gives a 3-second normal delay and a 1-day delay for account changes.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived: S1 = 0 (the oracle and admin can move funds), C2 = 0, C3 = 0, O3 = 0. The contracts let a wallet owner withdraw through request-and-execute without Wirex's oracle, but the signing key is a Privy embedded wallet reached through the Wirex One app, and I could not verify an export path. Admin EOAs can also reclassify operations or upgrade the policy. Judgment call: access depends on the provider, so 0, not 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://one.wirexapp.com",
              "detail": "The production web app config contains a literal OAuth client secret for the wirexone SSO client (redacted in the archive copy).",
              "quote": "wxSsoClientSecret:rc(",
              "archive": "data/archive/wirex-one-web-app-config.txt",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "A client secret ships in the browser bundle. What it authorises was not tested and nothing was called with it. Secrets in client, no mitigation found, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. Per the Wirex One Terms (https://www.wirexapp.com/legal/one/terms), card-based regulated services are provided by Wirex Limited (England and Wales 09334596), authorised and regulated by the FCA as an electronic money institution (FRN 902025); card programme management in the EEA is by UAB Wirex (Lithuania 305118023); in Australia and New Zealand the card is provided by Novatti Group Limited; EEA crypto-asset services are provided by Crossmint Europe S.L., authorised by the Spanish CNMV as a crypto-asset service provider and by the Bank of Spain as a payment institution. The Terms describe the wallet as self-custodial, with keys generated and managed through Privy. Complaints go to the national ombudsman (FOS in the UK, AFCA in Australia).",
      "notes": "Wirex One (launched May 2026; replaced crypto in the classic Wirex app for EEA and AU users) runs on Wirex's BaaS stack on Base: Kernel v3.1 smart accounts with a Wirex FundsManagement executor and an ExecutionDelayPolicy. The link comes from the one.wirexapp.com production bundle (archived and redacted in data/archive/wirex-one-web-app-config.txt) together with Wirex's own BaaS repo, which publishes the Base registry. The legacy Wirex Pay chain (chain 31415, a Polygon CDK validium with \"Card\" contracts verified on its Blockscout) is not assessed: it is not in the dashboard RPC list and showed only bridge transactions in Sep-Oct 2026. The web bundle also contains an SSO client secret; it was not used.",
      "settlement": {
        "tokens": [
          {
            "symbol": "WUSD",
            "class": "platform",
            "chain_id": 8453,
            "address": "0xb4bB2032A73A53C0Aa7Dc9ee2d9658a978fA7bC2"
          },
          {
            "symbol": "WEUR",
            "class": "platform",
            "chain_id": 8453,
            "address": "0x379e120C1921bFD8f5E0A1a3C699e7e800b66606"
          }
        ],
        "conversion": "at_spend",
        "note": "Wirex's BaaS stack keeps every balance in two Wirex-issued wrapped tokens on Base: WUSD (USD) and WEUR (EUR). Deposits of USDC, USDT or EURC are bridged to Base and wrapped 1:1 into WUSD or WEUR; withdrawals unwrap WUSD to USDC and WEUR to EURC. Wirex also mints WUSD/WEUR directly for card refunds, incoming SEPA/ACH transfers, P2P and rewards, so the tokens are claims on Wirex rather than plain USDC/EURC wrappers. At card authorisation the FundsManagement executor debits WUSD or WEUR from the user's wallet to a FundsBuffer (CryptoOut), then Wirex settles to the card network in fiat (CardOut). Which of the two is debited follows the card and balance currency; no default is documented. Both tokens are upgradeable contracts controlled by Wirex.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-crypto/SKILL.md#L17-L29",
            "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
            "path": "skills/wirex-baas-crypto/SKILL.md",
            "detail": "Wirex's BaaS repo describes the unified balance model, with all balances held as WUSD and WEUR on Base and USDC, USDT or EURC deposits wrapped into them 1:1.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-cards/SKILL.md#L132-L139",
            "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
            "path": "skills/wirex-baas-cards/SKILL.md",
            "detail": "Card purchases debit funds onchain from the user wallet to a FundsBuffer through the FundsManagement executor, then settle to the card network.",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-overview/references/ENVIRONMENTS.md#L163-L171",
            "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
            "path": "skills/wirex-baas-overview/references/ENVIRONMENTS.md",
            "detail": "Production Base token table gives the WUSD and WEUR addresses (with USDC, USDT and EURC).",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.wirexapp.com/legal/one/terms",
            "detail": "The Wirex One Terms say assets may be converted or wrapped on transfer into Wirex's onchain infrastructure and unwrapped on the way back.",
            "quote": "any digital assets converted or wrapped on transfer to the On-Chain Infrastructure may be re-converted or unwrapped on such a transfer back",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "The wirexapp GitHub organisation including wirex-baas-agent-skills (no audits/ folder or audit mention for the contracts), wirexapp.com, web searches for Wirex and Wirex Pay contract audits (Hacken, Halborn, CertiK, Zellic), and the audits/ folder of github.com/zerodevapp/kernel (main and release/v3.3) for the Kernel v3.1 smart account. No audit of the Wirex BaaS contracts on Base (ContractRegistry, FundsManagement, ExecutionDelayPolicy, FundsBuffer) is published. Audits of the ERC-4337 EntryPoint are not logged here.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Felix Kim (independent auditor)",
            "date": "2024-06",
            "type": "audit",
            "scope": "Shared component: ZeroDev Kernel v3.0-to-3.x changes (incremental, the v3.1 release) plus WebAuthn, MultiChain WebAuthn and Weighted validators and the SpendingLimit hook",
            "url": "https://github.com/zerodevapp/kernel/blob/release/v3.3/audits/v_3_1_incremental_audit.pdf",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "partly",
            "findings": "3 minor (validator and hook issues)",
            "note": "Audit period 27 May-9 June 2024. Reviews only the diff from v3.0, so it relies on the ChainLight v3.0 audit for the rest of the account. Whether the sample wallet's implementation matches this code was not checked byte for byte."
          },
          {
            "auditor": "KALOS",
            "date": "2024-04-12",
            "type": "audit",
            "scope": "Shared component: ZeroDev Kernel v3 KernelFactory and FactoryStaker",
            "url": "https://github.com/zerodevapp/kernel/blob/main/audits/kalos_v3_plugins.pdf",
            "commit": "85617952ec4cdf8d6478a9139540968fb92a6f10",
            "repo": "https://github.com/zerodevapp/kernel",
            "covers_deployed": "unknown",
            "findings": "No security issues found",
            "note": "The file is named kalos_v3_plugins but its scope is the factory contracts."
          },
          {
            "auditor": "ChainLight (Theori)",
            "date": "2024-04-05",
            "type": "audit",
            "scope": "Shared component: ZeroDev Kernel v3.0 (ERC-7579 smart account) core and validation modules",
            "url": "https://github.com/zerodevapp/kernel/blob/main/audits/chainlight_v3_0.pdf",
            "commit": "8646f2c25f2727019d91cbfb43f9c5688acc6fc2",
            "repo": "https://github.com/zerodevapp/kernel_v3",
            "covers_deployed": "partly",
            "findings": "2 high, 2 medium, 3 low, 5 informational",
            "note": "Audit started 11 March 2024 on kernel_v3 commits 5f086737 and 8646f2c2. Wirex wallets run Kernel v3.1, whose changes from v3.0 were reviewed separately in June 2024. Does not cover the Wirex executor module or BaaS contracts."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S1",
            "S2",
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 1,
        "short": 20,
        "unk": 2,
        "total": 23
      }
    },
    {
      "slug": "wise",
      "name": "Wise",
      "type": "incumbent",
      "website": "https://wise.com",
      "repos": [
        {
          "url": "https://github.com/transferwise/digital-signatures-examples",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/transferwise/digital-signatures",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/transferwise/public-api-postman-collection",
          "role": "docs",
          "license": "MIT"
        },
        {
          "url": "https://github.com/transferwise/banks-reference-android",
          "role": "sdk",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/transferwise/wise-platform-samples",
          "role": "sdk",
          "license": "none"
        }
      ],
      "contracts": [],
      "notes": "Incumbent. Wise is a closed, custodial e-money and payments ledger. Customer balances are held by Wise and moved through Wise's own systems and partner banks. github.com/transferwise is the GitHub-verified org for wise.com (223 public repos). Listed repos are the ones that touch the transfer API: webhook and SCA signing examples, a signing library, a Postman collection, a reference Android bank integration and the Wise Platform samples. None of them runs the transfer rail. The remaining repos are internal tooling and data-science libraries (pipelinewise, wise-pizza and similar) and are excluded. Documents cited are the UK personal terms of use and the UK personal privacy notice (Wise Payments Limited), plus docs.wise.com, which serves Markdown copies of its client-rendered pages (the .md URLs are cited). Terms clause 26.1 asserts Wise's exclusive property over \"sample source code, and code libraries\", which conflicts with the MIT and Apache licences in those repos; the repo licences are recorded as found. Search log: docs/research/wise.md.",
      "context": "Wise Payments Limited states in its UK personal terms of use (clause 3.3) that it is an electronic money institution authorised by the Financial Conduct Authority under the Electronic Money Regulations 2011 and the Payment Services Regulations 2017, FCA reference number 900507. Clause 12.4 says Wise safeguards customer money under the PSRs, kept separate from the money Wise uses to run its business and held in Wise's name with established financial institutions, as cash, in secure assets such as government bonds, or through insurance guarantees, and that Wise may change safeguarding institutions or methods without notice. Clause 12.2 says Wise is not a bank and balances are not covered by any deposit protection scheme, including the FSCS. Source: https://wise.com/gb/legal/terms-of-use-personal (read 2026-10-07). Other Wise entities and jurisdictions have their own terms and were not read.",
      "components": [
        {
          "name": "Wise app and website",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "Wise",
          "required": true
        },
        {
          "name": "Wise Platform API (api.wise.com)",
          "role": "api",
          "public": false,
          "license": "proprietary",
          "operator": "Wise",
          "required": true
        },
        {
          "name": "Wise account ledger and transfer backend",
          "role": "ledger",
          "public": false,
          "license": "proprietary",
          "operator": "Wise",
          "required": true
        },
        {
          "name": "Wise KYC and verification (incl. third-party verification providers)",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Wise and unnamed verification providers",
          "required": true
        },
        {
          "name": "Partner banks and local payment schemes (pay-in and pay-out)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Banks and financial institutions (unnamed)",
          "required": true
        },
        {
          "name": "Fraud prevention agencies and services",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Third parties (unnamed)",
          "required": false
        },
        {
          "name": "Safeguarding institutions",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Established financial institutions (unnamed)",
          "required": false
        },
        {
          "name": "Card networks (Wise card)",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa / Mastercard",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/terms-of-use-personal",
              "quote": "We may suspend your Profile or Wise Account, or restrict its functionality if we have reasonable concerns about",
              "detail": "UK personal terms clause 8.4: Wise may suspend or restrict an individual account on reasonable concerns about account security, suspected unauthorised or fraudulent use, or suspected breach of the agreement or Acceptable Use Policy.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/terms-of-use-personal",
              "quote": "closing your Wise Account and terminating your access to our Services, which means your Wise Account is deactivated and/or your Profile will not be available, without notice",
              "detail": "Clause 8.5-8.6: notice of suspension 'as soon as we can, either before ... or soon after', unless unlawful or a security risk; among the listed actions, closure without notice and limiting the ability to send money or withdraw.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Wise can suspend, restrict or close an individual customer's account, including their ability to send or withdraw money. Notice may come after the fact, or not at all where that would be unlawful or compromise security, and closure can be without notice. The power is held by Wise unilaterally and is not limited by any multisig or timelock.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.wise.com/guides/developer.md",
              "quote": "These credentials are required for obtaining the tokens you'll need to make requests to the Wise API",
              "detail": "Wise API getting-started guide: all API calls need OAuth tokens from Wise-issued client credentials (or a personal API token for business accounts); production base URL is https://api.wise.com.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Transfers settle only on Wise's own ledger, reached through Wise's authenticated API or its app and website. No direct settlement path outside Wise exists.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.wise.com/guides/developer.md",
              "quote": "Your client credentials are scoped to your integration and access model",
              "detail": "Credentials are issued by Wise during partner onboarding with Wise's sales and implementation teams; access model is set by Wise.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every integration depends on Wise's hosted API, with credentials and access provisioned by Wise. None of the intermediary code is public and there is no fallback operator, so the dependency is closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "To keep our anti-fraud measures effective, we can't always share all the details about how we prevent fraud",
              "detail": "UK personal privacy notice section 3: fraud-prevention processing is not fully disclosed; section 6.2: automated processes may reject a proposed transaction or close an account.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/acceptable-use-policy",
              "quote": "Individuals, entities, or countries subject to international sanctions",
              "detail": "Acceptable Use Policy lists sanctioned individuals, entities and countries among unsupported customers, without naming the list source.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Wise screens at its own ledger, which is also the settlement layer. Sanctions restrictions are disclosed in the Acceptable Use Policy without a named list source. Wise states that it does not fully disclose how its automated fraud controls, which can reject transactions, work. Judgment call: that admission of partly undisclosed filtering is taken as anchor 0 rather than 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/transferwise/wise-platform-samples/blob/a7d09f2695b13adbe21fe0b0cb8ae603b983f0a8/README.md",
              "commit": "a7d09f2695b13adbe21fe0b0cb8ae603b983f0a8",
              "path": "README.md",
              "detail": "github.com/transferwise (verified org, 223 repos): the API-facing public code is samples (wise-platform-samples: oauth-connect, oauth-connect-popup, strong-customer-authentication), signing examples and a signing library, a Postman collection and a 2021 reference Android bank app. No backend, ledger, API server or deploy scripts.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Only client-side samples, a signing library and API collections are public. The platform that runs transfers is closed. Judgment call: 1 (SDK-level code only) rather than 0, consistent with M-Pesa's client libraries.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.wise.com/api-reference/balance-statement/tag.md",
              "quote": "Statements can be retrieved in multiple formats: JSON, CSV, PDF, XLSX, CAMT.053, MT940, or QIF",
              "detail": "Wise API reference: balance statements export in open formats (CSV, CAMT.053, MT940 and others).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/transferwise/public-api-postman-collection/blob/032ec3a052c0f42acfa061eb5f198aac1ee4cb46/README.md",
              "commit": "032ec3a052c0f42acfa061eb5f198aac1ee4cb46",
              "path": "README.md",
              "detail": "MIT-licensed Postman collection of the public API in a repo; last commit 2024-07-24, while the live API reference is versioned 2026q3 on docs.wise.com.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The API reference and an open-format statement export are documented on the hosted docs site. The only API schema in a repo is a Postman collection last updated in July 2024, which does not track the current API versions. Judgment call: 1 (documented only), because the versioned schema is not in a repo; a reviewer could argue 2 if the Postman collection is accepted as current.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/terms-of-use-personal",
              "quote": "are the exclusive property of Wise and its licensors",
              "detail": "Terms clause 26.1: the App, Website, API, developer tools, sample source code and code libraries are Wise's exclusive property, all rights reserved.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/transferwise/wise-platform-samples/blob/a7d09f2695b13adbe21fe0b0cb8ae603b983f0a8/README.md",
              "commit": "a7d09f2695b13adbe21fe0b0cb8ae603b983f0a8",
              "path": "README.md",
              "detail": "wise-platform-samples has no LICENSE file at this commit (root: .gitignore, CODEOWNERS, README.md, common, oauth-connect, oauth-connect-popup, strong-customer-authentication) and no licence statement in the README.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The components needed to run Wise are proprietary and closed, so nothing that runs the rail can be forked. Among the public repos, four carry MIT or Apache-2.0 licences and wise-platform-samples has none.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "Analytics and search engine providers that assist us in the improvement and optimisation of our site",
              "detail": "Privacy notice section 4.3 lists analytics providers and advertisers (cookies, pixels) among recipients; section 2.2 lists page interaction data (scrolling, clicks) collected from the website and app.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics and advertising tracking in the website and app are disclosed in the privacy notice. Which SDKs ship, and whether they are on by default, was not checked: the app is closed and no trace was run.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "a unique device identifier (for example, your device's IMEI number",
              "detail": "Privacy notice section 2: identity documents and biometric face scans for KYC; device data incl. IMEI, MAC address, VPN use and installed remote-access apps; precise geolocation if location sharing is allowed; page interaction data; phone book if access is given.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "Advertisers and advertising networks to select and serve relevant advertisements to you and others",
              "detail": "Section 4.3: mobile number and email shared in a secure format with social media networks for ad matching.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC collection is legally required and disclosed with its legal basis. Wise also collects device, behavioural and location data, and shares contact data for advertising, all beyond the legal requirement. Everything is disclosed in the privacy notice. Judgment call: anchor 1 (disclosed in a policy) and anchor 0 (collection beyond the stated legal requirement) both fit; took 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "Banks and other financial institutions we work with to provide you our services",
              "detail": "Privacy notice section 4: data shared with Wise group companies, partner banks and financial institutions, verification providers, fraud prevention agencies, analytics and advertising providers, regulators.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties that see payment data are disclosed by category in the privacy notice, but none is named (a list is available on request to privacy@wise.com). They cannot be swapped by the user.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/terms-of-use-personal",
              "quote": "Wise holds your funds in permissible investments in accordance with applicable laws",
              "detail": "Terms clause 12.2: customer money is held by Wise; clause 12.4: safeguarded in Wise's name with financial institutions.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Wise holds customer funds, as the terms disclose. Safeguarding is recorded under context and does not change the custody score.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.wise.com/guides/developer.md",
              "quote": "These credentials are required for obtaining the tokens you'll need to make requests to the Wise API",
              "detail": "All transfer and balance operations go through Wise-hosted endpoints (see C2, C3); no exit path outside Wise is documented.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived. S1 = 1 (provider custody), C2 = 0 (no direct settlement), C3 = 0 (closed single-vendor API), O3 unknown (nothing to self-host). Both funds and the ability to settle depend on Wise. Regulatory safeguarding in insolvency is noted under context and is not a technical exit.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/transferwise/digital-signatures-examples/blob/c29c3625cbf2afe571b045cea2fd1a5d99764f6b/verify-webhook-signature/verify-signature.js#L17-L32",
              "commit": "c29c3625cbf2afe571b045cea2fd1a5d99764f6b",
              "path": "verify-webhook-signature/verify-signature.js",
              "detail": "Reference Node handler verifies the X-Signature-SHA256 header as an RSA-SHA256 (PKCS#1 v1.5) signature over the raw body against Wise's sandbox public key; Java and Ruby versions are in the same directory.",
              "checked_at": "2026-10-07",
              "recheck": "gh api 'repos/transferwise/digital-signatures-examples/contents/verify-webhook-signature/verify-signature.js?ref=c29c3625cbf2afe571b045cea2fd1a5d99764f6b' --jq .content | base64 -d | sed -n 17,32p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.wise.com/guides/developer/webhooks/event-handling.md",
              "quote": "Each outgoing webhook request is signed",
              "detail": "Webhook docs: RSA/SHA256 signatures in X-Signature-SHA256, production and sandbox public keys published, and a link to the reference repo; integrators are told not to process requests whose signature fails.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.wise.com/guides/developer.md",
              "quote": "You can rotate and revoke client credentials",
              "detail": "Client credentials are scoped per integration and can be rotated and revoked in Developer Hub; mTLS and JOSE are offered as optional extra controls.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Webhooks are signed, and Wise's reference code at a pinned commit verifies the signature. Credentials are documented as scoped and rotatable. Whether secrets ever reach client bundles was not checked, because the apps and API are closed and no trace was run, so 3 is not available. Judgment call: 2. The verification is verified in code; the gaps are that secret handling is not inspectable, the reference code dates from 2021 and uses only the sandbox key, and the docs leave payload verification optional (\"where applicable\").",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "allowlist",
        "countries": [
          "EEA",
          "AD",
          "AR",
          "AU",
          "BH",
          "BL",
          "BR",
          "BV",
          "CA",
          "CH",
          "CL",
          "CN",
          "CO",
          "CR",
          "GB",
          "GE",
          "GF",
          "GG",
          "GI",
          "GP",
          "GU",
          "HK",
          "IL",
          "IM",
          "IN",
          "JE",
          "JP",
          "KR",
          "KW",
          "KY",
          "MC",
          "MF",
          "MK",
          "MO",
          "MQ",
          "MY",
          "NZ",
          "PE",
          "PH",
          "PM",
          "QA",
          "RE",
          "SA",
          "SG",
          "SX",
          "TH",
          "TW",
          "US",
          "UY",
          "YT",
          "ZA"
        ],
        "note": "Recorded as where a Wise account that holds money can be opened. Wise's \"Where can I use Wise?\" says you can hold money if you live in a country where you can open a Wise account, and its \"Where do I need to live to hold money with Wise?\" table lists 80 countries and territories (all 30 EEA states plus the 50 codes above). Restrictions in that table: US excluding Nevada; Bahrain, Israel and Malaysia personal accounts only; Hong Kong business accounts only; Brazil BRL only for residents; India only while travelling overseas; Thailand, Wise has temporarily stopped issuing currencies and account details. Send and receive reach further: Wise says you can register and send money from most countries, and it names places it does not serve at all (Afghanistan, Belarus, Burundi, Central African Republic, Chad, Congo, DR Congo, Cuba, Eritrea, Iran, Iraq, North Korea, Libya, Myanmar, Somalia, South Sudan, Russia, Sudan, Syria, Yemen, Venezuela, and the Crimea, Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine), where you cannot log in, register, use the card, or send or receive. Card eligibility is a narrower separate list, not used here.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://wise.com/help/articles/2813542/where-do-i-need-to-live-to-hold-money-with-wise",
            "quote": "You can hold money in your account if you live in one of the following countries and territories",
            "detail": "Wise Help Centre table of countries and territories (with per-country restrictions) where residents can hold money, i.e. open a Wise account.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://wise.com/help/articles/2978049/where-can-i-use-wise",
            "quote": "You can hold money if you live in a country where you can open a Wise account",
            "detail": "Wise Help Centre \"Where can I use Wise?\", which also lists the countries and regions Wise does not serve at all.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "audits": {
        "searched": "wise.com/security (says Wise holds SOC 1 Type 2, SOC 2 Type 2, PCI-DSS and ISO/IEC 27001; SOC reports are given to business customers under NDA; these are not code audits), Wise's 2019 TUV online-security certification blog post (a certification, not a code audit), the Wise Bugcrowd programme (no public disclosure allowed; a bug bounty, not an audit), github.com/transferwise (no audits folders in the listed repos), and web searches for Wise or TransferWise penetration test and code audit reports. No published code audit or penetration test report was found.",
        "checked_at": "2026-10-13",
        "reports": []
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3",
            "C4",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1",
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P2",
            "P3",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S2",
            "S3",
            "S4",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 1,
        "short": 12,
        "unk": 10,
        "total": 23
      }
    },
    {
      "slug": "worm",
      "name": "WORM (BETH proof-of-burn)",
      "type": "transfer",
      "website": "https://worm.cx",
      "primary_chain": {
        "name": "Ethereum",
        "chain_id": 1,
        "basis": "The contracts README (worm@b34b507d README.md L9-L19) lists deployments only on Ethereum mainnet, and the official CLI maps network \"mainnet\" to BETH 0x5624…9Cf8 (worm-miner@fd23cd80 common/src/contracts/network.rs L58-L66). Unit: BETH (proof-of-burn mint and spend), its two Groth16 verifiers, the Staking reward pool that mintCoin pays, and the BETHToETH hook used by the official send flow. Excluded: the WORM mining token, distributors and ICO contracts (not in the payment path), and Sepolia."
      },
      "repos": [
        {
          "url": "https://github.com/worm-privacy/worm",
          "role": "contracts",
          "license": "MIT"
        },
        {
          "url": "https://github.com/worm-privacy/proof-of-burn",
          "role": "contracts",
          "license": "MIT"
        },
        {
          "url": "https://github.com/worm-privacy/worm-miner",
          "role": "sdk",
          "license": "none"
        },
        {
          "url": "https://github.com/worm-privacy/worm-privacy.github.io",
          "role": "frontend",
          "license": "none"
        },
        {
          "url": "https://github.com/worm-privacy/trusted-setup",
          "role": "deploy",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
          "chain_id": 1,
          "role": "BETH (mintCoin, spendCoin)",
          "verified": "sourcify"
        },
        {
          "address": "0x7c155d52b78799d4975417a3815cDe8C5aec434f",
          "chain_id": 1,
          "role": "ProofOfBurnVerifier (Groth16)",
          "verified": "sourcify"
        },
        {
          "address": "0x5745a35b9c5938B2307F0287f45df5743A9D02e6",
          "chain_id": 1,
          "role": "SpendVerifier (Groth16)",
          "verified": "sourcify"
        },
        {
          "address": "0x03d4702b51a98661B89dF5fcBe8C4baeF84C60B7",
          "chain_id": 1,
          "role": "Staking (reward pool credited on every mint)",
          "verified": "sourcify"
        },
        {
          "address": "0xbA5A285806c343AaD955a40FE4b6e5e607B752b6",
          "chain_id": 1,
          "role": "BETHToETH swap hook (optional)",
          "verified": "sourcify"
        }
      ],
      "components": [
        {
          "name": "BETH contract (proof-of-burn mint and spend)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "none (no owner, no proxy; initializer cleared)",
          "required": true,
          "repo": "https://github.com/worm-privacy/worm"
        },
        {
          "name": "ProofOfBurn and Spend Groth16 verifiers",
          "role": "contracts",
          "public": true,
          "license": "GPL-3.0",
          "operator": "none",
          "required": true,
          "repo": "https://github.com/worm-privacy/worm"
        },
        {
          "name": "Staking reward pool (receives the 0.5% pool fee in mintCoin)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "none (no owner)",
          "required": true,
          "repo": "https://github.com/worm-privacy/worm"
        },
        {
          "name": "Proof-of-burn and spend circuits",
          "role": "other",
          "public": true,
          "license": "MIT",
          "operator": "none",
          "required": true,
          "repo": "https://github.com/worm-privacy/proof-of-burn"
        },
        {
          "name": "Trusted-setup parameters (GitHub release assets)",
          "role": "other",
          "public": true,
          "license": "none",
          "operator": "worm-privacy GitHub org",
          "required": true,
          "repo": "https://github.com/worm-privacy/trusted-setup"
        },
        {
          "name": "worm-miner CLI (local burn, proof and mint)",
          "role": "sdk",
          "public": true,
          "license": "none",
          "operator": "user",
          "required": true,
          "repo": "https://github.com/worm-privacy/worm-miner"
        },
        {
          "name": "Ethereum mainnet and an RPC that serves eth_getProof",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "Ethereum validators; RPC (hardcoded dRPC in the CLI)",
          "required": true,
          "repo": "https://github.com/ethereum/go-ethereum"
        },
        {
          "name": "Hosted prover and broadcaster (prover-2.worm.cx, worm-miner server)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "WORM team",
          "required": false
        },
        {
          "name": "worm.cx frontend (GitHub Pages build of worm-privacy.github.io)",
          "role": "frontend",
          "public": true,
          "license": "none",
          "operator": "WORM team",
          "required": false,
          "repo": "https://github.com/worm-privacy/worm-privacy.github.io"
        },
        {
          "name": "BETHToETH and BETHToERC20 hooks with CypherETH pool liquidity",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "none (immutable hooks); liquidity from third parties",
          "required": false,
          "repo": "https://github.com/worm-privacy/worm"
        },
        {
          "name": "Public RPCs, WalletConnect and Uniswap Permit2 used by the frontend",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "various (dRPC, NodeReal, GetBlock, others; WalletConnect; Uniswap)",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/src/BETH.sol#L10-L55",
              "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
              "path": "src/BETH.sol",
              "detail": "BETH inherits only ERC20, ReentrancyGuard and ERC20Permit; its one privileged role, initializer, can only set the reward pool once and then zeroes itself (L54). There is no pause, blacklist or allowlist. This file is identical to the Sourcify source of 0x5624…9Cf8.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm/contents/src/BETH.sol?ref=eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6\" --jq .content | base64 -d | sed -n 10,55p"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 26153606,
              "detail": "initializer() returns the zero address and rewardPool() is the Staking contract 0x03d4…60B7, so the one-time role has been used and cleared.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x5624344235607940d4d4EE76Bf8817d403EB9Cf8 \"initializer()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x9ce110d7",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x03d4702b51a98661B89dF5fcBe8C4baeF84C60B7",
              "address": "0x03d4702b51a98661B89dF5fcBe8C4baeF84C60B7",
              "block_number": 26153606,
              "detail": "Staking, which every mintCoin calls through depositReward, has no owner, no pause and no proxy (EIP-1967 implementation slot zero).",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No one can stop, freeze or block a burn or mint. Burning is a plain ETH transfer to an address with no known key. Minting is open to any caller with a valid proof. BETH has no owner, and its one-time initializer has been cleared onchain. The Staking contract it pays a fee into also has no admin.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/src/BETH.sol#L163-L240",
              "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
              "path": "src/BETH.sol",
              "detail": "mintCoin is public with no caller check. The receiver, broadcaster fee and prover fee are bound into the burn address through burnExtraCommitment (L176-L187), so whoever submits cannot change the payee. The payer chooses the receiver at burn time.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-miner/blob/fd23cd8012f550cf4950dad02e79c1ce9d39b809/README.md#L37-L64",
              "commit": "fd23cd8012f550cf4950dad02e79c1ce9d39b809",
              "path": "README.md",
              "detail": "The official CLI documents burn with a --receiver-address, and mint with a broadcaster that may be your own private key; --prover-fee defaults to 0 \"in case you want to prove it yourself\".",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm-miner/contents/README.md?ref=fd23cd8012f550cf4950dad02e79c1ce9d39b809\" --jq .content | base64 -d | sed -n 37,64p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 26153606,
              "detail": "The deployed BETH is a Sourcify exact match to that source and has no proxy (EIP-1967 implementation slot zero).",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer can send ETH to a burn address that commits to the payee, and anyone can then call mintCoin with a locally generated proof. The payee receives BETH, or ETH through the optional swap hook. No signature, relayer or API from the provider is needed. Addresses are in the README and the CLI, and the ABI is committed in worm-miner. The proof must use a block hash from the last 256 blocks, which any client can choose at mint time. We did not run a transaction. Note that the payee receives BETH, a token whose ETH value depends on market liquidity; the burned ETH itself cannot be recovered.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-miner/blob/fd23cd8012f550cf4950dad02e79c1ce9d39b809/Makefile#L1-L20",
              "commit": "fd23cd8012f550cf4950dad02e79c1ce9d39b809",
              "path": "Makefile",
              "detail": "The CLI fetches proving parameters from worm-privacy/trusted-setup GitHub release assets and proves locally; its server binary is the same prover/broadcaster that others can run for fees.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm-miner/contents/Makefile?ref=fd23cd8012f550cf4950dad02e79c1ce9d39b809\" --jq .content | base64 -d | sed -n 1,20p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-privacy.github.io/blob/5c309e254871bdda9a3537f35c7f06c7f25527e4/src/app/tools/burn-eth/mint-beth.tsx#L362-L366",
              "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
              "path": "src/app/tools/burn-eth/mint-beth.tsx",
              "detail": "The frontend's mint tool lists the WORM public prover and a local machine endpoint; its one-page send flow (src/app/wormhole/loading.tsx L169-L208) uses the default WORM prover for proving and relaying.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No hosted service is required. The CLI proves locally from public parameters and can broadcast from any key. Prover and broadcaster code is public (worm-miner server). Fees for a third-party prover or broadcaster are fixed in the burn commitment, so the market is open to anyone. The official one-page send flow does default to the WORM-run prover. Judgment call: 3, because the protocol path does not need it and the self-host code is in the repo; the frontend default is counted under P2 and P4.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/src/BETH.sol#L163-L240",
              "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
              "path": "src/BETH.sol",
              "detail": "mintCoin checks only the nullifier, the mint cap, a recent block hash and the proof; there is no address or country check.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-privacy.github.io/tree/5c309e254871bdda9a3537f35c7f06c7f25527e4/src",
              "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
              "path": "src",
              "detail": "A grep of the frontend source for country, geolocation, ipapi, sanction and chainalysis finds nothing.",
              "checked_at": "2026-10-09",
              "recheck": "S=5c309e254871bdda9a3537f35c7f06c7f25527e4; for f in $(gh api \"repos/worm-privacy/worm-privacy.github.io/git/trees/$S?recursive=1\" --jq '.tree[].path | select(test(\"^src/.*[.]tsx?$\"))'); do gh api \"repos/worm-privacy/worm-privacy.github.io/contents/$f?ref=$S\" --jq .content | base64 -d | grep -iE \"countr|geoloc|ipapi|sanction|chainalysis\" && echo \"^ $f\"; done"
            }
          ],
          "finding": "The settlement contracts and the official clients contain no address or country filtering, and the direct path needs no provider service. Whether the hosted prover filters requests could not be seen. Judgment call: the substance fits 3, but 3 needs a distributed package or a trace, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xbA5A285806c343AaD955a40FE4b6e5e607B752b6",
              "address": "0xbA5A285806c343AaD955a40FE4b6e5e607B752b6",
              "block_number": 26153606,
              "detail": "The BETHToETH hook is immutably wired to BETH and to the CypherETH swap router 0x20C5…b0Ab; the burned asset is native ETH only (proof-of-burn reads an account balance).",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xbA5A285806c343AaD955a40FE4b6e5e607B752b6 \"swapRouterContract()(address)\" --rpc-url https://ethereum-rpc.publicnode.com"
            }
          ],
          "finding": "The only asset is native ETH, which no issuer can freeze. Ethereum L1 has no sequencer. The payee receives BETH, an immutable ERC-20, and the hooks sell it for ETH or tokens through one named AMM router. The repos do not state the liquidity or price risk of BETH against ETH, which is the main inherited exposure. Scored 2: enumerated in code, assumptions not stated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 26153606,
              "detail": "Sourcify returns exact_match for BETH, both verifiers, Staking and both hooks. BETH was compiled with solc 0.8.28 and deployed at block 24436025. Its source equals src/BETH.sol at worm@eab0f53b (2026-02-11); main has since changed the pool-fee logic.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0x5624344235607940d4d4EE76Bf8817d403EB9Cf8 0x7c155d52b78799d4975417a3815cDe8C5aec434f 0x5745a35b9c5938B2307F0287f45df5743A9D02e6 0x03d4702b51a98661B89dF5fcBe8C4baeF84C60B7; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/1/$a | jq -r .match; done"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/foundry.toml#L1-L4",
              "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
              "path": "foundry.toml",
              "detail": "foundry.toml pins no solc version or optimizer settings, so the build that produced the deployed bytecode is recorded only in Sourcify metadata.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every settlement contract is an exact Sourcify match, and the deployed BETH source matches an untagged commit (eab0f53b) in the public repo. Etherscan was not checked: it blocks automated access. No rebuild was attempted, and the repo does not pin compiler settings. Judgment call: 2, not 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-privacy.github.io/blob/5c309e254871bdda9a3537f35c7f06c7f25527e4/package.json#L1-L70",
              "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
              "path": "package.json",
              "detail": "The org publishes contracts (worm), circuits (proof-of-burn), the CLI and prover server (worm-miner), the trusted-setup transcript and the frontend that GitHub Pages serves at worm.cx (CNAME worm.cx; worm.cx answers with server GitHub.com).",
              "checked_at": "2026-10-09",
              "recheck": "gh repo list worm-privacy --limit 50 --json name,isArchived,pushedAt",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Contracts, circuits, client, prover/broadcaster server, setup and frontend are all public, and no indexer is needed. The hosted prover at prover-2.worm.cx could not be tied to a specific public build. Judgment call: 2 rather than 3 for that reason.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-miner/blob/fd23cd8012f550cf4950dad02e79c1ce9d39b809/README.md#L1-L35",
              "commit": "fd23cd8012f550cf4950dad02e79c1ce9d39b809",
              "path": "README.md",
              "detail": "The README gives build steps for the CLI and server (Rust toolchain, apt packages, cargo build) and a Docker option; the Makefile downloads parameters.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Build and run instructions exist for the CLI and prover server. Reproduction not attempted, so capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-miner/tree/fd23cd8012f550cf4950dad02e79c1ce9d39b809/common/src/contracts/abis",
              "commit": "fd23cd8012f550cf4950dad02e79c1ce9d39b809",
              "path": "common/src/contracts/abis",
              "detail": "BETH, BETHToETH, Staking and WORM ABIs are committed; the prover server's HTTP endpoints (GET/POST /proof, GET /proof/{nullifier}, GET/POST /relay) are listed in the README.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm-miner/contents/common/src/contracts/abis?ref=fd23cd8012f550cf4950dad02e79c1ce9d39b809\" --jq '.[].name'"
            }
          ],
          "finding": "ABIs and the optional prover API are in the repo. The API is a README list, not OpenAPI. There is no payee export; the CLI writes burn.json and note files for the user. Scored 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-miner/blob/fd23cd8012f550cf4950dad02e79c1ce9d39b809/README.md#L1-L5",
              "commit": "fd23cd8012f550cf4950dad02e79c1ce9d39b809",
              "path": "README.md",
              "detail": "worm-miner, the only published proof-generation client, has no LICENSE file at this commit (top level holds .github, Cargo files, Dockerfile, Makefile, README.md, cli, common, server), and the GitHub licence API returns none. The frontend, trusted-setup and witness repos also have none.",
              "checked_at": "2026-10-09",
              "recheck": "for r in worm proof-of-burn worm-miner worm-privacy.github.io trusted-setup witness; do echo $r $(gh api repos/worm-privacy/$r --jq '.license.spdx_id // \"none\"'); done",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/LICENSE",
              "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
              "path": "LICENSE",
              "detail": "The contracts repo LICENSE is MIT, but BETH.sol, Staking.sol and the hooks carry SPDX UNLICENSED headers; the verifiers are GPL-3.0; proof-of-burn (circuits) is MIT.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The contracts and circuits repos carry MIT, though the deployed source files say UNLICENSED in their SPDX headers. The proof client a payer or payee needs to settle without the hosted prover, worm-miner, has no licence, and neither do the frontend and trusted-setup repos. Scored 0: a repository needed to run the product has no licence.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/LICENSE",
              "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
              "path": "LICENSE",
              "detail": "The LICENSE file has one commit (9e21f5f7, 2025-06-06); the repo has no CONTRIBUTING or CLA file.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm/commits?path=LICENSE&sha=eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6\" --jq '.[].sha'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No CLA and no relicensing event; no written licence-stability commitment.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-miner/blob/fd23cd8012f550cf4950dad02e79c1ce9d39b809/Makefile#L1-L20",
              "commit": "fd23cd8012f550cf4950dad02e79c1ce9d39b809",
              "path": "Makefile",
              "detail": "The proving parameters and circuit data come from public GitHub release assets; the CLI needs only an Ethereum RPC.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/worm-privacy/trusted-setup/releases --jq '.[].tag_name'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No proprietary plugin or hosted-only service is needed. The hosted prover is optional. Judgment call: the code supports 3, but with no O3 reproduction we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-privacy.github.io/blob/5c309e254871bdda9a3537f35c7f06c7f25527e4/package.json#L16-L54",
              "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
              "path": "package.json",
              "detail": "The frontend dependencies include no analytics, telemetry, error-reporting or fingerprinting package; wallet connectors (RainbowKit, WalletConnect, @metamask/sdk, @base-org/account) are present.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm-privacy.github.io/contents/package.json?ref=5c309e254871bdda9a3537f35c7f06c7f25527e4\" --jq .content | base64 -d | grep -iE \"sentry|analytics|gtag|amplitude|mixpanel|segment|posthog|hotjar|fingerprint\"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Neither the frontend nor the Rust CLI ships an analytics or error-reporting SDK. The wallet-connector libraries may send their own connection telemetry; we did not assess that, and we ran no trace. Judgment call: absence shown only in code is capped at 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-privacy.github.io/blob/5c309e254871bdda9a3537f35c7f06c7f25527e4/src/app/wormhole/loading.tsx#L163-L182",
              "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
              "path": "src/app/wormhole/loading.tsx",
              "detail": "The one-page send flow posts the burn key, receiver address, fees and the burn address's account proof to DEFAULT_ENDPOINT (https://prover-2.worm.cx), with no option to change it in this flow.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm-privacy.github.io/contents/src/app/wormhole/loading.tsx?ref=5c309e254871bdda9a3537f35c7f06c7f25527e4\" --jq .content | base64 -d | sed -n 163,182p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The protocol needs nothing beyond the burn and mint data, and the CLI sends nothing elsewhere. The official one-page send flow, however, hands the WORM-run prover the burn key and receiver, which link the payer's burn to the payee. The prover cannot redirect funds, but it learns the payment. The code shows this, but no policy or UI text discloses it. Judgment call: anchor 2 needs the extra data to be clearly optional, and in this flow it is not. Anchor 0 means undisclosed collection, but this is visible in public code. We take 1, the lower of the two remaining anchors.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/src/BETH.sol#L133-L160",
              "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
              "path": "src/BETH.sol",
              "detail": "mintCoin calldata carries the block number, nullifier, remaining-coin commitment, fees, prover, revealedAmount and revealedAmountReceiver in plaintext. The burn itself is a plain ETH transfer to an address derived from a secret burn key.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 26153606,
              "detail": "MINT_CAP is 10 ETH per burn; amounts are arbitrary up to the cap.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x5624344235607940d4d4EE76Bf8817d403EB9Cf8 \"MINT_CAP()(uint256)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x98f1312e",
                "expect": "0x0000000000000000000000000000000000000000000000008ac7230489e80000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The chain shows a payer sending ETH to what looks like an ordinary address, and later a mint to the payee. The proof hides which burn funded which mint. Both amounts are plaintext and arbitrary, so the burned amount and the revealed amount, minus fees, can be matched. Partial reveals through spendCoin weaken this. Judgment call: 2, minimal linkage, because amounts are revealed. The size of the anonymity set and any timing correlation are behavioural, so we leave them out of the score.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-privacy.github.io/blob/5c309e254871bdda9a3537f35c7f06c7f25527e4/src/components/tools/rainbowkit-root.tsx#L64-L83",
              "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
              "path": "src/components/tools/rainbowkit-root.tsx",
              "detail": "The frontend hardcodes twelve public mainnet RPCs (dRPC, merkle.io, LlamaRPC, NodeReal and GetBlock with keys, publicnode, MEV Blocker, Flashbots and others); eth_getProof for the burn address goes through them.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-miner/blob/fd23cd8012f550cf4950dad02e79c1ce9d39b809/common/src/contracts/network.rs#L49-L56",
              "commit": "fd23cd8012f550cf4950dad02e79c1ce9d39b809",
              "path": "common/src/contracts/network.rs",
              "detail": "The CLI hardcodes https://eth.drpc.org for mainnet, with no flag to override it.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Third parties see the payment in both official clients. The frontend sends the burn address's proof request to a fixed list of public RPCs, and its send flow sends the burn key to the WORM prover. The CLI uses dRPC. All of these are named in public code, but none can be swapped by configuration. Judgment call: anchor 2 needs them to be swappable by config, which they are not; 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-miner/blob/fd23cd8012f550cf4950dad02e79c1ce9d39b809/common/src/contracts/network.rs#L49-L56",
              "commit": "fd23cd8012f550cf4950dad02e79c1ce9d39b809",
              "path": "common/src/contracts/network.rs",
              "detail": "Network::url() returns a fixed URL per network (mainnet https://eth.drpc.org).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm-miner/contents/common/src/contracts/network.rs?ref=fd23cd8012f550cf4950dad02e79c1ce9d39b809\" --jq .content | base64 -d | sed -n 49,56p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Both official clients hardcode their RPC endpoints: the CLI uses dRPC, and the frontend uses a fixed list. No indexer is involved. Scored 0: hardcoded.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/src/BETH.sol#L176-L240",
              "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
              "path": "src/BETH.sol",
              "detail": "The burn address commits to the receiver, fees and hook; mintCoin mints only to those parties, and spendCoin mints remaining value only to the recorded coinOwner. No function lets any role move or redirect value.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 26153606,
              "detail": "The verifiers are immutable constructor arguments; proofOfBurnVerifier() returns 0x7c15…434f.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x5624344235607940d4d4EE76Bf8817d403EB9Cf8 \"proofOfBurnVerifier()(address)\" --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "call": "0x7151a471",
                "expect": "0x0000000000000000000000007c155d52b78799d4975417a3815cde8c5aec434f"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Between burn and mint, no one holds the value: the ETH is gone, and the right to mint is fixed to the payee by the burn-address commitment. A prover or broadcaster can only collect the fees the payer set. Whoever holds the burn key decides when to mint, but cannot change the recipient. The payee ends up with BETH, not ETH (see C2 and C5).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 26153606,
              "detail": "The EIP-1967 implementation slot is zero on BETH, both verifiers, Staking and BETHToETH; none has an upgrade function or owner.",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0x5624344235607940d4d4EE76Bf8817d403EB9Cf8 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://ethereum-rpc.publicnode.com",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No one can change the code: every contract in the payment path is non-upgradeable with no admin. Later fixes on the main branch (configurable pool share) would need a new deployment, so they are not in force.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-privacy.github.io/blob/5c309e254871bdda9a3537f35c7f06c7f25527e4/src/lib/core/contracts/uniswap/burn-any-erc20.ts#L21-L46",
              "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
              "path": "src/lib/core/contracts/uniswap/burn-any-erc20.ts",
              "detail": "Burning ETH needs no approval. For the ERC-20 path the frontend approves maxUint256 to Permit2 once (permit2.ts L17-L24), then signs a PermitSingle for about 110% of the input with a 30-minute expiry to the Universal Router.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm-privacy.github.io/contents/src/lib/core/contracts/uniswap/burn-any-erc20.ts?ref=5c309e254871bdda9a3537f35c7f06c7f25527e4\" --jq .content | base64 -d | sed -n 21,46p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The default ETH payment path needs no approval. The ERC-20 path uses Permit2 with a bounded, expiring permit to the router, on top of the standard unlimited approval to Permit2. In mintCoin, BETH approves the hook for the exact hook allowance and resets it to zero. Judgment call: the substance is close to 3, but 3 needs a distributed package or trace, so 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 26153606,
              "detail": "BETH is immutable with no admin (C1, S2), and mintCoin is callable by anyone with a proof (C2).",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0x5624344235607940d4d4EE76Bf8817d403EB9Cf8 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc --rpc-url https://ethereum-rpc.publicnode.com"
            }
          ],
          "finding": "Derived from S1=3, C2=3, C3=3 and O3=1. No one can redirect funds (S1). A payee or payer holding the burn key can mint with the public CLI and proving parameters (C2). No hosted service is required (C3). A public frontend build exists, but we did not reproduce it (O3=1). Judgment call: 2, not 3. Two caveats: the CLI's hardcoded dRPC endpoint would need a code edit if dRPC disappeared, and BETH's value depends on market liquidity.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-privacy.github.io/blob/5c309e254871bdda9a3537f35c7f06c7f25527e4/src/components/tools/rainbowkit-root.tsx#L64-L109",
              "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
              "path": "src/components/tools/rainbowkit-root.tsx",
              "detail": "The frontend source embeds NodeReal and GetBlock RPC keys in URLs and a WalletConnect project ID; there are no merchant API keys or webhooks. The burn key is generated client-side and saved to a local JSON backup (wormhole/rest.tsx L142).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/worm-privacy/worm-privacy.github.io/contents/src/components/tools/rainbowkit-root.tsx?ref=5c309e254871bdda9a3537f35c7f06c7f25527e4\" --jq .content | base64 -d | sed -n 64,109p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The bundled keys grant only RPC quota. The user's secret, the burn key, is created and backed up client-side, but the one-page send flow sends it to the WORM prover (P2). That exposes the payment link, not the funds, because the recipient is fixed. Judgment call: 2 (minor issues).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm/blob/b34b507d4dfc4e57fcb2857c9816569e54526144/README.md#L1-L7",
              "commit": "b34b507d4dfc4e57fcb2857c9816569e54526144",
              "path": "README.md",
              "detail": "The contracts README says BETH was audited by Hashlock (hashlock.com/audits/worm) and yAudit (reports.yaudit.dev/2025-11-Worm).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://reports.yaudit.dev/2025-11-Worm",
              "quote": "Worm | yAudit Reports",
              "detail": "The yAudit page (dated 2025-11-15, tagged zk and circom) embeds the PDF 2025-11-Worm-proofofburn.pdf.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Two audit reports are linked. The yAudit report predates the February 2026 BETH deployment and is tagged as a circuit review. We could not extract an audited commit from either report, so we cannot tie them to the deployed commit eab0f53b. We found no bug bounty and no SECURITY file. Scored 1: audit reports only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "BETH has no address or country check, and both official clients (the worm.cx frontend source and the worm-miner CLI) contain no geolocation or country gate. We found no terms page listing countries; the frontend source has no terms text. Judgment call: the hosted prover at prover-2.worm.cx, used by the frontend's send flow, might filter requests, which we could not see. The CLI path avoids it.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/src/BETH.sol#L163-L240",
            "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
            "path": "src/BETH.sol",
            "detail": "mintCoin has no caller, address or country restriction.",
            "checked_at": "2026-10-09"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/worm-privacy/worm-privacy.github.io/tree/5c309e254871bdda9a3537f35c7f06c7f25527e4/src",
            "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
            "path": "src",
            "detail": "A grep of the frontend source for country, geolocation, ipapi, sanction and chainalysis finds nothing.",
            "checked_at": "2026-10-09"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: BETH on Ethereum mainnet and the contracts it calls. Reads at block 26153606 via ethereum-rpc.publicnode.com. Deployed BETH source = worm@eab0f53b (2026-02-11); main (b34b507d) has later, undeployed changes. The payee receives BETH, an ERC-20 claim on burned ETH whose ETH value depends on market liquidity; the official send flow converts it to ETH through the BETHToETH hook. WORM (the mining token), distributors, ICO and Staking epochs are out of scope except where mintCoin pays the pool fee. No transactions, traces or self-host attempts.",
      "audits": {
        "searched": "The READMEs and file trees of github.com/worm-privacy/worm, proof-of-burn and worm-miner (no audits/ folder), the Hashlock and yAudit pages linked from the contracts README, and yAudit's report index. Audited commits were compared with the deployed commit eab0f53b cited in this file.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "Hashlock",
            "date": "2025-11",
            "type": "audit",
            "scope": "BETH.sol (proof-of-burn mint and spend), WORM.sol and Staking.sol",
            "url": "https://hashlock.com/wp-content/uploads/2025/12/WORM-Smart-Contract-Audit-Report-Final-Report-v2.pdf",
            "commit": "0134fb6ca0680fbff32e32b152b669c6ab5af066",
            "repo": "https://github.com/worm-privacy/worm",
            "covers_deployed": "partly",
            "findings": "2 high, 4 low, 1 QA; both highs and two lows resolved, the rest acknowledged",
            "note": "Fix review at ca123363. The deployed commit eab0f53b is 36 commits later and changes BETH.sol, Staking.sol, WORM.sol and both verifier contracts."
          },
          {
            "auditor": "yAudit",
            "date": "2025-11-24",
            "type": "audit",
            "scope": "Proof-of-burn and spend Circom circuits (ZK circuit security assessment)",
            "url": "https://reports.yaudit.dev/pdf/2025-11-Worm-proofofburn.pdf",
            "commit": "a39690248ed5ba70b9c1e14b543bd693ce416ccf",
            "repo": "https://github.com/worm-privacy/proof-of-burn",
            "covers_deployed": "unknown",
            "findings": "2 high, 3 medium, 3 low, 8 informational; one high (coin-lineage privacy leak) deferred",
            "note": "Reviewed commits 0e523748 and a3969024. The deployed verifier contracts changed after the November 2025 audits, and we did not tie them to a circuit commit."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 2,
          "limiting": [
            "C4",
            "C5"
          ]
        },
        "O": {
          "score": 1,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P5"
          ]
        },
        "S": {
          "score": 1,
          "limiting": [
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 17,
        "short": 6,
        "unk": 0,
        "total": 23
      }
    },
    {
      "slug": "xplace-card",
      "name": "XPlace Card",
      "type": "card",
      "website": "https://x.place",
      "primary_chain": {
        "name": "Solana",
        "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
        "basis": "XPlace Terms s1 and s5.4 say Collateral and Credit Mode run through Kamino Finance smart contracts on Solana, and the homepage FAQ says XPlace runs on Solana. Kamino's lending program KLend2g3... is an OtterSec-verified build of Kamino-Finance/klend at a08760976f. The unit is that program as used for XPlace collateral. Excluded: Rain's card collateral and any XPlace-owned program (FYEO-audited per marketing), because no address could be found; no other chain is named."
      },
      "repos": [
        {
          "url": "https://github.com/Kamino-Finance/klend",
          "role": "contracts",
          "license": "BUSL-1.1"
        }
      ],
      "contracts": [
        {
          "address": "KLend2g3cP87fffoy8q1mQqGKjrxjC8boSyAYavgmjD",
          "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
          "role": "Kamino Lending program (upgradeable; collateral and credit)",
          "verified": "verified-build"
        },
        {
          "address": "6hhBGCtmg7tPWUSgp3LG6X2rsmYWAc4tNsA6G4CnfQbM",
          "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
          "role": "Kamino upgrade multisig (Squads v4, 5-of-10, 24 h lock)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "Kamino Lending program (klend)",
          "role": "contracts",
          "public": true,
          "license": "BUSL-1.1",
          "operator": "Kamino (upgrade key held by a Squads 5-of-10 multisig)",
          "required": true,
          "repo": "https://github.com/Kamino-Finance/klend"
        },
        {
          "name": "XPlace mobile app and embedded wallet sign-in (email, Google, Apple)",
          "role": "wallet",
          "public": false,
          "license": "proprietary",
          "operator": "Pontech Group L.L.C-FZ (XPlace)",
          "required": true
        },
        {
          "name": "XPlace backend (credit mode, card funding, XP, membership)",
          "role": "backend",
          "public": false,
          "license": "proprietary",
          "operator": "Pontech Group L.L.C-FZ (XPlace)",
          "required": true
        },
        {
          "name": "XPlace smart contracts (claimed, address not published)",
          "role": "contracts",
          "public": false,
          "license": "proprietary",
          "operator": "Pontech Group L.L.C-FZ (XPlace)",
          "required": false
        },
        {
          "name": "Rain card programme (Card Partner; authorization, clearing, fiat settlement)",
          "role": "card-issuer",
          "public": false,
          "license": "proprietary",
          "operator": "Signify Holdings, Inc. (Rain)",
          "required": true
        },
        {
          "name": "Visa card network",
          "role": "card-network",
          "public": false,
          "license": "proprietary",
          "operator": "Visa",
          "required": true
        },
        {
          "name": "Sumsub identity verification",
          "role": "kyc",
          "public": false,
          "license": "proprietary",
          "operator": "Sumsub",
          "required": true
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "quote": "XPlace may freeze, restrict, or block your account, wallet interactions, or card without prior notice",
              "detail": "Terms s12.3 let XPlace freeze or block an account, wallet interactions or the card without notice; s12.4 says it need not give a reason.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/KLend2g3cP87fffoy8q1mQqGKjrxjC8boSyAYavgmjD",
              "address": "KLend2g3cP87fffoy8q1mQqGKjrxjC8boSyAYavgmjD",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 454205453,
              "detail": "klend is a BPF upgradeable program (programData 9uSbGW1y9H5Av6H5TKxQ1wnFApSq2t3oEpfF2YfjDQGA); the Kamino lending market XPlace uses was not identified, so its market-owner powers could not be read.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "XPlace can freeze or block an individual account, its wallet interactions, or the card without prior notice, and it need not say why. That meets anchor 0. The lending market behind XPlace collateral could not be identified onchain, so the market owner's powers inside Kamino were not assessed. Card blocking by Rain sits offchain.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "quote": "Card authorization, clearing, and fiat settlement are performed by the Card Partner",
              "detail": "Terms s5.1 say card settlement is done by the Card Partner (Rain, s1) through licensed financial infrastructure; XPlace does not issue cards.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A merchant is paid over Visa by Rain. Neither payer nor payee can complete a card payment by calling a contract. Kamino calls (deposit, borrow, repay) are direct, but they fund the card; they do not settle it.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "quote": "Card authorization, clearing, and fiat settlement are performed by the Card Partner",
              "detail": "The card path runs through the XPlace app and backend, Rain and Visa; no XPlace repository or self-host path exists (gh search for xplace / x.place found no XPlace-owned org).",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every card payment depends on XPlace's closed app and backend and on Rain. None is public or has a fallback. Closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "quote": "XPlace may employ IP geolocation, KYC data, and screening tools to enforce these restrictions",
              "detail": "Terms s3 list prohibited countries and s3.4 bars persons on OFAC, UN or UAE sanctions lists, enforced by IP geolocation, KYC data and screening tools.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Sanctions and geographic screening is disclosed in the Terms and runs in XPlace's closed services, not in public code. The card path cannot bypass it (C2 = 0). Disclosed in docs only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/xplace/collateral.md",
              "quote": "SOL – 65% LTV, ETH (wETH) – 70% LTV, BTC (cbBTC) – 70% LTV",
              "detail": "The Collateral page enumerates SOL, wETH, cbBTC, USDT and jitoSOL with LTVs; Credit is issued in USDC; the homepage says XPlace runs on Solana. No page states the freeze or blacklist powers of the USDC, USDT, cbBTC or wETH issuers.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens and the chain are listed in docs only, and issuer freeze powers are not stated to cardholders. 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://verify.osec.io/status/KLend2g3cP87fffoy8q1mQqGKjrxjC8boSyAYavgmjD",
              "address": "KLend2g3cP87fffoy8q1mQqGKjrxjC8boSyAYavgmjD",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 454205453,
              "detail": "OtterSec verify registry reports is_verified true, on-chain hash = executable hash b1344d19...c22d9, built from Kamino-Finance/klend commit a08760976f51a3a58c4a0c6ea27b4a0e565bca79 (last verified 2026-08-20).",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://verify.osec.io/status/KLend2g3cP87fffoy8q1mQqGKjrxjC8boSyAYavgmjD"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Kamino-Finance/klend/tree/a08760976f51a3a58c4a0c6ea27b4a0e565bca79/programs",
              "commit": "a08760976f51a3a58c4a0c6ea27b4a0e565bca79",
              "path": "programs",
              "detail": "The verified build's source tree (Anchor workspace) at the pinned commit.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The Kamino lending program is a reproducible verified build of a pinned public commit. The rest of the payment path is not: XPlace's own contracts (claimed as FYEO-audited) and Rain's card collateral program have no published address, so their bytecode cannot be matched. Some contracts verified, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Kamino-Finance/klend/tree/a08760976f51a3a58c4a0c6ea27b4a0e565bca79/programs",
              "commit": "a08760976f51a3a58c4a0c6ea27b4a0e565bca79",
              "path": "programs",
              "detail": "The only public code in the payment path is Kamino's klend program; no XPlace repository exists on GitHub (searches for xplace and x.place returned only unrelated projects).",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "Only third-party contracts are public. The XPlace app, backend, any XPlace contracts and the card integration are closed, with no API schema published. Contracts only, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "quote": "XPlace grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Platform",
              "detail": "The Platform is licensed for personal use only; no XPlace code, build or deploy instructions are published.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There is no path for a third party to run the XPlace product. Kamino's program can be built, but the card product around it cannot. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Kamino-Finance/klend/blob/a08760976f51a3a58c4a0c6ea27b4a0e565bca79/LICENSE",
              "commit": "a08760976f51a3a58c4a0c6ea27b4a0e565bca79",
              "path": "LICENSE",
              "detail": "klend is under Business Source License 1.1 (Licensor StroudGlobal S.A.), a source-available licence.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The only public repo is source-available (BUSL-1.1), and the XPlace app, backend and Rain card programme are closed. Required components are closed, so 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "quote": "Card authorization, clearing, and fiat settlement are performed by the Card Partner",
              "detail": "The card cannot run without XPlace's closed platform and Rain.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The core card product cannot run without proprietary hosted services. 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-card-privacy-policy",
              "quote": "Portions of the Sites may use Google Analytics",
              "detail": "The Card Privacy Policy discloses analytics services including Google Analytics; the Platform Privacy Policy s6 mentions analytics and application performance monitoring providers without naming them.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Analytics is disclosed in the policies. The app is closed and no trace was run. Judgment call: disclosed and presumed on by default, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "quote": "XPlace collects Biometric Data as part of identity verification through Sumsub",
              "detail": "The Privacy Policy lists government ID, proof of address, selfie and liveness biometrics, wallet addresses, transaction history and device data, each with a stated lawful basis.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "KYC and biometric data are collected beyond settlement needs. Their legal basis is disclosed, but only in a hosted policy, not in code or a versioned repo document. Documented cap, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "quote": "We use third-party infrastructure providers including cloud hosting services, database providers, and application performance monitoring tools",
              "detail": "The policy names Sumsub, the Card Partner and Kamino, but cloud, database, monitoring and analytics processors are described by category only.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Rain, Sumsub and Kamino are named; the infrastructure, monitoring and analytics vendors that see app traffic are not. None is swappable. Judgment call: between 1 (disclosed in docs) and 0 (undisclosed third parties) I take the lower, because some processors are named only by category.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/9uSbGW1y9H5Av6H5TKxQ1wnFApSq2t3oEpfF2YfjDQGA",
              "address": "9uSbGW1y9H5Av6H5TKxQ1wnFApSq2t3oEpfF2YfjDQGA",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 454205477,
              "detail": "klend programData upgrade authority = GzFgdRJXmawPhGeBsyRCDLx4jAKPsvbUqoqitzppkzkW (bytes 13-45 of the account), last deployed at slot 440486775.",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"9uSbGW1y9H5Av6H5TKxQ1wnFApSq2t3oEpfF2YfjDQGA\",{\"encoding\":\"jsonParsed\",\"dataSlice\":{\"offset\":0,\"length\":0}}]}'"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "quote": "Collateral and Credit Mode functionality is provided through Kamino Finance smart contracts operating on the Solana blockchain",
              "detail": "Terms s5.4; s10 discloses Protocol exploit, multisig compromise and liquidation risk.",
              "checked_at": "2026-10-07",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Collateral sits in Kamino lending reserves, an upgradeable program, and the user holds the obligation; this is disclosed. Card spending is funded and settled by Rain offchain, and how USDC reaches Rain could not be observed. Upgradeable escrow, disclosed, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/6hhBGCtmg7tPWUSgp3LG6X2rsmYWAc4tNsA6G4CnfQbM",
              "address": "6hhBGCtmg7tPWUSgp3LG6X2rsmYWAc4tNsA6G4CnfQbM",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 454205583,
              "detail": "Squads v4 multisig account (owner SQDS4ep6...) has config_authority = default (autonomous), threshold 5, time_lock 86400 s and 10 members, all with full permissions; its vault GzFgdRJX... is the klend upgrade authority (it signs VaultTransactionExecute tx uH9cTFjr...xun at slot 453889271).",
              "checked_at": "2026-10-07",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getAccountInfo\",\"params\":[\"6hhBGCtmg7tPWUSgp3LG6X2rsmYWAc4tNsA6G4CnfQbM\",{\"encoding\":\"base64\"}]}'  # decode: threshold u16 at byte 72, time_lock u32 at 74, member count u32 at 99"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/address/9uSbGW1y9H5Av6H5TKxQ1wnFApSq2t3oEpfF2YfjDQGA",
              "address": "9uSbGW1y9H5Av6H5TKxQ1wnFApSq2t3oEpfF2YfjDQGA",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 454205477,
              "detail": "klend programData upgrade authority = Squads vault GzFgdRJXmawPhGeBsyRCDLx4jAKPsvbUqoqitzppkzkW.",
              "checked_at": "2026-10-07"
            }
          ],
          "finding": "The program that holds XPlace collateral can be upgraded by a Kamino Squads multisig, 5 of 10, after a 24-hour time lock. The members are bare keys with no published identities, and no notice channel is named in the klend repo. That is anchor 2. Judgment call: XPlace's own claimed contracts and the Rain collateral path were not found, so this score covers only the identified program; finding either could lower it.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "assessed_by": "AI research agent (seed), 2026-10-07",
          "review": {
            "status": "pending"
          }
        }
      },
      "context": "Not scored. The Terms name Pontech Group L.L.C-FZ (UAE) as operator and Signify Holdings, Inc. (Rain) as Card Partner, \"a licensed card program manager and issuing sponsor\". The Card Terms describe the card as issued by an unnamed Issuer under licence from Visa. I found no primary source naming XPlace's own licences or regulator.",
      "notes": "Type card: Kamino's klend program is a verified build of a public repo, and XPlace's Terms make it the protocol through which Collateral and Credit Mode run. Judgment call: klend is third-party and no XPlace user position was found onchain, so the link rests on XPlace's Terms; Cash Mode (plain USDC balance) may not touch Kamino at all. XPlace's own \"smart contracts audited by FYEO\" (homepage) and Rain's Solana collateral program have no published address; Rain's integration repo SignifyHQ/collateral-contract-integration-examples has IDLs but no mainnet program id. The Kamino market XPlace uses was not identified (none of the 44 markets in api.kamino.finance is named for XPlace). Solana items carry no `check` because the nightly re-check reads EVM words only.",
      "availability": {
        "model": "blocklist",
        "countries": [
          "BY",
          "CN",
          "CU",
          "IN",
          "IR",
          "IQ",
          "IL",
          "MM",
          "NP",
          "NI",
          "KP",
          "RU",
          "SY",
          "TR",
          "UA",
          "VE",
          "VN"
        ],
        "note": "Terms and Conditions (effective 20 May 2026) s3.2 lists 17 Prohibited Countries. Use is prohibited for residents, people located there, and nationals of these countries. s3.3 adds 16 Restricted U.S. States: Arizona, Delaware, Georgia, Idaho, Louisiana, Maryland, Nevada, New Mexico, North Dakota, Ohio, Oregon, Rhode Island, South Dakota, Vermont, Washington and Wisconsin. s3.4 also bars anyone subject to comprehensive sanctions without naming further countries, and says XPlace may enforce the restrictions with IP geolocation. The terms are the platform's; the card (issued through the Card Partner, Rain) has no separate country list.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
            "detail": "s3.2 Prohibited Countries, 17 countries from Belarus to Vietnam.",
            "quote": "Use of the Platform is strictly prohibited for persons who are located in, ordinarily resident in, organized under the laws of, or nationals of any of the following countries",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
            "detail": "The s3.2 list ends with Venezuela and Vietnam, followed by XPlace's right to update it.",
            "quote": "Venezuela Vietnam XPlace may update this list at any time",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
            "detail": "s3.3 Restricted U.S. States.",
            "quote": "Arizona Delaware Georgia Idaho Louisiana Maryland Nevada New Mexico North Dakota Ohio Oregon Rhode Island South Dakota Vermont Washington Wisconsin",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "settlement": {
        "tokens": [
          {
            "symbol": "USDC",
            "class": "stablecoin",
            "backing": "fiat",
            "issuer": "Circle",
            "default": true,
            "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"
          }
        ],
        "conversion": "at_spend",
        "note": "The card spends USDC in both modes. In Cash mode a payment is settled from the user's USDC balance; in Credit mode it draws USDC credit borrowed through Kamino against deposited SOL, wETH, cbBTC, USDT or jitoSOL, which stay as collateral and are not sold. Rain (Card Partner) does authorisation, clearing and fiat settlement. How USDC reaches Rain could not be observed onchain, so the USDC mint address is not given.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/card/about-xplace-sard.md",
            "detail": "The card page says Cash-mode payments settle from the USDC balance and Credit-mode payments draw on the credit line backed by Collateral.",
            "quote": "the transaction is settled from your available USDC balance",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/xplace/credit.md",
            "detail": "The Credit page says credit is issued only in USDC.",
            "quote": "Credit is issued in USDC only",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
            "detail": "Terms s5.1 say the Card Partner performs authorisation, clearing and fiat settlement.",
            "quote": "Card authorization, clearing, and fiat settlement are performed by the Card Partner",
            "checked_at": "2026-10-12",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-12"
      },
      "audits": {
        "searched": "XPlace's site and docs (the homepage says its smart contracts were audited by FYEO; no report or program address is published, and FYEO's public listings show none), the Kamino-Finance/audits repository (read at eedea0b; only the 21 Kamino Lend reports are listed, not those for vaults, farms, Scope or limit orders), Kamino's docs security pages (audits, formal verification, fuzzing), and the klend repository. Rain's Solana collateral program is unidentified, so its audits are not listed. The deployed klend program is the verified build of release v1.25.0 (a08760976f, August 2026); the newest published klend reports cover v1.17.0 (March 2026), so v1.18 to v1.25 changes have no published report and every entry is at most partly current.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "OtterSec",
            "date": "2026-03-30",
            "type": "audit",
            "scope": "Kamino Lend klend v1.16.0 and v1.17.0 PRs: fixed-term loan rollover, throttled liquidations of expired debt, reserve config cloning and related changes.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_ottersec_1.16.0_and_1.17.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "1 high, 1 medium, 4 low, 4 informational"
          },
          {
            "auditor": "Certora",
            "date": "2026-03",
            "type": "audit",
            "scope": "Kamino Lend klend v1.17.0 release changes (manual review).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_certora_1.17.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "1 high, 7 medium, 4 low, 3 informational; 12 fixed"
          },
          {
            "auditor": "Certora",
            "date": "2026-03",
            "type": "audit",
            "scope": "Kamino Lend klend v1.16.0: throttled term-based liquidations and auto-rollover (manual review).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_certora_1.16.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "1 high, 5 medium, 5 low, 1 informational; 10 fixed"
          },
          {
            "auditor": "OtterSec",
            "date": "2026-03-16",
            "type": "audit",
            "scope": "Kamino Lend klend v1.15.0 conditional-liquidity feature (queued, ticket-based withdrawals), klend-private PRs 627, 628, 632, 662 and 704.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_ottersec_1.15.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "2 low"
          },
          {
            "auditor": "Certora",
            "date": "2026-02",
            "type": "review",
            "scope": "Kamino Lend klend v1.15.0 withdraw-ticket progress callback (manual review of a diff and PR 704).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_certora_1.15.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "No issues found"
          },
          {
            "auditor": "Certora",
            "date": "2026-02",
            "type": "review",
            "scope": "Kamino Lend klend v1.14.1 PR 736 (minimum value checks; manual review).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_min_value_1.14.1.pdf",
            "commit": "41232ce",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "No issues; 1 informational, fixed"
          },
          {
            "auditor": "Certora",
            "date": "2026-02",
            "type": "audit",
            "scope": "Kamino Lend klend v1.14.0 withdraw queue (manual review, 25 August to 17 November 2025).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_certora_1.14.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "1 critical, 1 medium, 2 low, 5 informational; critical and medium fixed"
          },
          {
            "auditor": "Offside Labs",
            "date": "2026-02",
            "type": "audit",
            "scope": "Kamino Lend klend v1.14.0 withdraw queue, 2 to 5 December 2025.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_offside_1.14.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "1 high (fixed), 1 low (acknowledged), 2 informational (fixed)"
          },
          {
            "auditor": "Offside Labs",
            "date": "2026-02",
            "type": "review",
            "scope": "Kamino Lend klend v1.13.1 emergency council changes, 10 to 11 January 2026.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_offside_1.13.1.pdf",
            "commit": "43fe383317de6d2930b7e2659b124b17bc2eec46",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "1 informational, fixed"
          },
          {
            "auditor": "OtterSec",
            "date": "2026-02-11",
            "type": "review",
            "scope": "Kamino Lend klend v1.13.1 PR 654 (flash-loan fee disable marker), 15 to 16 December 2025.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_ottersec_1.13.1.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "1 suggestion"
          },
          {
            "auditor": "Certora",
            "date": "2026-02",
            "type": "review",
            "scope": "Kamino Lend klend v1.13.1 PRs 630 and 656 (manual review, 13 to 14 November 2025).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_certora_1.13.1.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "No issues found"
          },
          {
            "auditor": "OtterSec",
            "date": "2026-02-11",
            "type": "audit",
            "scope": "Kamino Lend klend v1.13.0 borrow-order feature (18 PRs), 1 September to 18 October 2025.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_ottersec_1.13.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "2 medium, 1 low, 2 informational"
          },
          {
            "auditor": "Offside Labs",
            "date": "2026-02",
            "type": "audit",
            "scope": "Kamino Lend klend v1.13.0 borrow orders, November to December 2025.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_offside_1.13.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "1 low (fixed), 1 informational (acknowledged)"
          },
          {
            "auditor": "Certora",
            "date": "2026-02",
            "type": "audit",
            "scope": "Kamino Lend klend v1.13.0 borrow orders (manual review, August to September 2025).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_certora_1.13.0.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "2 medium, 3 low, 2 informational; 4 fixed"
          },
          {
            "auditor": "Ackee Blockchain Security",
            "date": "2026-05-18",
            "type": "audit",
            "scope": "Kamino Lend full program review, 13 August to 12 September 2025, with a fix review (revision 1.1).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_ackee_blockchain.pdf",
            "commit": "1729408",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "1 high, 3 medium, 7 low, 5 warnings, 2 informational; high fixed, some medium acknowledged"
          },
          {
            "auditor": "OtterSec",
            "date": "2025-10-06",
            "type": "formal_verification",
            "scope": "Kamino Lend: Kani-based formal verification of the healthy-to-healthy obligation invariant for several instructions (deposit, withdraw, borrow and others).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_osec_formal_verification.pdf",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "Invariant verified for the listed instructions under the stated modelling assumptions"
          },
          {
            "auditor": "Ackee Blockchain Security",
            "date": "2025-09-22",
            "type": "review",
            "scope": "Kamino Lend fuzz testing with Trident (no manual code review), January 2025 with a later revision.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_ackee_blockchain_fuzz_tests.pdf",
            "commit": "829c1f3",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "7 warnings, 1 informational"
          },
          {
            "auditor": "Certora",
            "date": "2025-05-13",
            "type": "formal_verification",
            "scope": "Kamino Lend: security assessment and Certora Prover verification (reserve solvency, share value monotonicity), November to December 2024 and February 2025.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_certora.pdf",
            "commit": "5af6cfc",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "2 medium, 1 low, 7 informational; 6 fixed"
          },
          {
            "auditor": "Sec3",
            "date": "2025-02-06",
            "type": "audit",
            "scope": "Kamino Lending program (kamino_lending), full source excluding tests.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_klend_sec3.pdf",
            "commit": "c02bcf7dfe932af27d429df4111b3a3ca05a0dd3",
            "repo": "https://github.com/Kamino-Finance/klend",
            "covers_deployed": "partly",
            "findings": "2 low, 3 informational; 4 resolved, 1 acknowledged"
          },
          {
            "auditor": "OtterSec",
            "date": "2023-09-06",
            "type": "audit",
            "scope": "Kamino Lending program, August to September 2023 (then hubbleprotocol/kamino-lending).",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_ottersec.pdf",
            "commit": "88dfca4",
            "covers_deployed": "partly",
            "findings": "3 high, 5 low, 5 informational",
            "note": "Early version of the program; substantially changed since."
          },
          {
            "auditor": "RX Security",
            "date": "2023-07-03",
            "type": "audit",
            "scope": "Kamino Lending program, initial launch version.",
            "url": "https://github.com/Kamino-Finance/audits/blob/eedea0bb339bad9fe11cb849e4b7b43697b59f70/kamino_lend_rx.pdf",
            "commit": "419de5ceb00e8b39ca0b0b6df756f754f7b4f9bb",
            "covers_deployed": "partly",
            "findings": "1 critical, 3 high, 3 medium, 3 low, 2 informational",
            "note": "Early version of the program; substantially changed since."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3",
            "O4"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2",
            "F3"
          ]
        },
        "P": {
          "score": 0,
          "limiting": [
            "P3",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S3",
            "S4",
            "S5",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 1,
        "short": 14,
        "unk": 8,
        "total": 23
      }
    },
    {
      "slug": "zcash",
      "name": "Zcash (shielded transfers)",
      "type": "transfer",
      "website": "https://z.cash",
      "primary_chain": {
        "name": "Zcash mainnet",
        "caip2": "zcash:main",
        "basis": "Zcash is its own proof-of-work chain, so the unit is Zcash mainnet as defined by the maintained node, Zebra (v6.4.2, MAINNET_ACTIVATION_HEIGHTS in zebra-chain network_upgrade.rs L104-L120, NU6.3 at height 3,428,143). Scope: shielded ZEC transfers (Ironwood pool since NU6.3; Orchard spend-only per ZIP 258) and the transparent pool. Excluded: testnet, ZSAs (NU7 draft), exchanges and bridges. zcash:main is not a registered CAIP-2 namespace (ChainAgnostic/namespaces has none for Zcash); used as the brief directs."
      },
      "repos": [
        {
          "url": "https://github.com/ZcashFoundation/zebra",
          "role": "backend",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/zcash/librustzcash",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/zcash/orchard",
          "role": "sdk",
          "license": "MIT"
        },
        {
          "url": "https://github.com/zcash/zips",
          "role": "docs",
          "license": "MIT"
        },
        {
          "url": "https://github.com/zcash/lightwalletd",
          "role": "indexer",
          "license": "MIT"
        },
        {
          "url": "https://github.com/zingolabs/zaino",
          "role": "indexer",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/zcash/zallet",
          "role": "frontend",
          "license": "Apache-2.0"
        },
        {
          "url": "https://github.com/zodl-inc/zodl-android",
          "role": "frontend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/zodl-inc/zodl-ios",
          "role": "frontend",
          "license": "MIT"
        },
        {
          "url": "https://github.com/zodl-inc/zodl-android-wallet-sdk",
          "role": "sdk",
          "license": "AGPL-3.0-only"
        },
        {
          "url": "https://github.com/zcash/zcash",
          "role": "backend",
          "license": "MIT"
        }
      ],
      "contracts": [],
      "components": [
        {
          "name": "Zcash mainnet consensus (proof-of-work miners and full nodes)",
          "role": "ledger",
          "public": true,
          "license": "Apache-2.0",
          "operator": "miners and node operators; rule changes ship as node releases (ZIP process)",
          "required": true,
          "repo": "https://github.com/ZcashFoundation/zebra"
        },
        {
          "name": "Zebra full node (zebrad), the maintained consensus node",
          "role": "backend",
          "public": true,
          "license": "Apache-2.0",
          "operator": "Zcash Foundation (code); run by users, server operators and miners",
          "required": true,
          "repo": "https://github.com/ZcashFoundation/zebra"
        },
        {
          "name": "Protocol libraries in every listed wallet (librustzcash, orchard, halo2)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "user (runs inside the wallet)",
          "required": true,
          "repo": "https://github.com/zcash/librustzcash"
        },
        {
          "name": "Zodl mobile wallet (Android and iOS; reference light wallet)",
          "role": "wallet",
          "public": true,
          "license": "MIT",
          "operator": "Znewco, Inc. (d/b/a Zodl)",
          "required": false,
          "repo": "https://github.com/zodl-inc/zodl-android"
        },
        {
          "name": "Zodl Android and iOS wallet SDKs (AGPL-3.0-only, CLA, dual-licensed)",
          "role": "sdk",
          "public": true,
          "license": "AGPL-3.0-only",
          "operator": "Znewco, Inc.",
          "required": false,
          "repo": "https://github.com/zodl-inc/zodl-android-wallet-sdk"
        },
        {
          "name": "Zallet full-node wallet (beta)",
          "role": "wallet",
          "public": true,
          "license": "Apache-2.0",
          "operator": "user",
          "required": false,
          "repo": "https://github.com/zcash/zallet"
        },
        {
          "name": "lightwalletd servers (Zodl defaults zec.rocks, zec.stardust.rest, or custom)",
          "role": "api",
          "public": true,
          "license": "MIT",
          "operator": "independent server operators",
          "required": false,
          "repo": "https://github.com/zcash/lightwalletd"
        },
        {
          "name": "Zaino indexer (lightwalletd-compatible)",
          "role": "indexer",
          "public": true,
          "license": "Apache-2.0",
          "operator": "server operators",
          "required": false,
          "repo": "https://github.com/zingolabs/zaino"
        },
        {
          "name": "zcashd (archived predecessor node and wallet)",
          "role": "backend",
          "public": true,
          "license": "MIT",
          "operator": "none (archived 2026)",
          "required": false,
          "repo": "https://github.com/zcash/zcash"
        },
        {
          "name": "Zodl store-build integrations (Crashlytics, CoinMarketCap, Flexa, NEAR swaps)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Google, CoinMarketCap, Flexa, NEAR intents operators",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0257.md#L51-L75",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "path": "zips/zip-0257.md",
              "detail": "ZIP 257 records that from Mainnet height 3363426 until NU6.2 activated at height 3364600, transactions MUST NOT contain Orchard Actions; the rule shipped as an emergency hotfix in zcashd v6.12.5 and zebra v4.5.3 after an Orchard circuit soundness bug was reported on 2026-05-29, and a first attempt 60 blocks earlier failed because some mining pools had not upgraded.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zcash/zips/contents/zips/zip-0257.md?ref=3af03aa3ad991874d86b8cf35919bc9b4671e8ba\" --jq .content | base64 -d | sed -n 51,75p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/zebrad/src/components/sync/end_of_support.rs#L15-L41",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "path": "zebrad/src/components/sync/end_of_support.rs",
              "detail": "Each Zebra release panics (\"Zebra refuses to run\") on Mainnet 84 days after its estimated release height (L86-L101), so node operators must install a newer release roughly every 12 weeks; the check is in public code and can be patched out by whoever builds the node.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "The Zcash consensus rules contain no admin key, pause, freeze, blacklist or allowlist role, and shielded addresses are not visible to anyone who could filter them. The rules can still be changed by coordinated node releases that miners and node operators adopt: in June 2026 the node teams shipped an emergency soft fork that disabled the whole Orchard pool for 1,174 blocks (about a day) without advance notice, to contain a balance-violation bug, documented after the fact in ZIP 257. That power is pool-wide, not per-address, and depends on miner adoption. Zebra releases also stop running 84 days after release, which forces operators to choose new software regularly. Judgment call: the substance is close to anchor 3 (no role that can target users), but the dashboard needs onchain evidence about a deployed contract for a 3, which a chain with no contract addresses cannot supply, and the June 2026 no-notice pool halt is recorded here, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/zebra-rpc/src/methods.rs#L262-L283",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "path": "zebra-rpc/src/methods.rs",
              "detail": "zebrad's sendrawtransaction RPC accepts any signed transaction into the local node's mempool, from where it is gossiped to peers and mined; no provider signature or API key is involved.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ZcashFoundation/zebra/contents/zebra-rpc/src/methods.rs?ref=e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291\" --jq .content | base64 -d | sed -n 262,283p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/lightwalletd/blob/d16d48124e9ad4157ebc2324b5090c6ba201470c/lightwallet-protocol/walletrpc/service.proto#L276-L279",
              "commit": "d16d48124e9ad4157ebc2324b5090c6ba201470c",
              "path": "lightwallet-protocol/walletrpc/service.proto",
              "detail": "Light wallets submit the same raw signed transaction to any lightwalletd server through SendTransaction(RawTransaction); the server only relays it to its node.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A payer builds and signs a transaction in their own wallet and can submit it to any Zcash node, their own or anyone's, or to any light-wallet server; the payee receives it by scanning the chain with their viewing key. No company sits in the path. Settlement is the consensus protocol itself, specified in the ZIPs and protocol specification. Judgment call: this is the strongest form of direct settlement, but anchor 3 is defined by direct calls to public contracts and needs onchain evidence about a deployed contract, which this chain has none of, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/LightWalletEndpointProvider.kt#L13-L28",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/LightWalletEndpointProvider.kt",
              "detail": "Zodl ships seven Mainnet lightwalletd endpoints from two operators (zec.rocks with regional hosts, zec.stardust.rest US and EU); ChooseServerVM.kt L148-L230 adds automatic selection and a custom server, and MultiEndpointTransactionSubmitter.kt L22-L47 submits each transaction to several endpoints.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zodl-inc/zodl-android/contents/ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/LightWalletEndpointProvider.kt?ref=4248d469c74a9a70c32c229ebb0600a4dd539689\" --jq .content | base64 -d | sed -n 13,28p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/lightwalletd/blob/d16d48124e9ad4157ebc2324b5090c6ba201470c/README.md#L92-L128",
              "commit": "d16d48124e9ad4157ebc2324b5090c6ba201470c",
              "path": "README.md",
              "detail": "The lightwalletd README documents production self-hosting against a local zebrad; Zaino (zingolabs/zaino, Apache-2.0) is a second implementation.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No hosted service is required. A full-node user (Zebra plus Zallet) needs only peers. A light-wallet user needs a lightwalletd-compatible server; the code is public and self-hostable, and the reference wallet ships several independent default servers, picks one automatically, broadcasts each transaction to more than one, and accepts a custom server.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0224.rst#L232-L257",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "path": "zips/zip-0224.rst",
              "detail": "Shielded actions carry encrypted notes; consensus checks proofs, nullifiers and pool balances, so validators cannot see or filter shielded senders and recipients.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/LightWalletEndpointProvider.kt#L13-L28",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/LightWalletEndpointProvider.kt",
              "detail": "GitHub code search on 2026-10-09 for country, geolocation, geoip and restricted in zodl-android, zodl-ios, zebra, zallet and lightwalletd found no country or address screening (zodl-ios hits are a language-based layout tweak in WelcomeView.swift and SplashView.swift).",
              "checked_at": "2026-10-09",
              "recheck": "gh search code --repo zodl-inc/zodl-android country --json path --jq '.[].path'; gh search code --repo ZcashFoundation/zebra geoip --json path --jq '.[].path'",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement layer is neutral: consensus has no address or country rules, and shielded parties are not visible. We found no screening in the node, the beta full-node wallet, lightwalletd, or the reference mobile wallet. A light-wallet server operator could refuse to relay a transaction, but the wallet can switch server or the user can run a node. Optional swaps run through NEAR intents operators whose screening we did not inspect. Judgment call: the substance fits 3, but 3 needs a distributed-package or trace record for the client, which we do not have, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0224.rst#L242-L256",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "path": "zips/zip-0224.rst",
              "detail": "Value moves only in ZEC across the transparent, Sprout, Sapling, Orchard and (since NU6.3) Ironwood pools, with per-pool turnstiles; there is no issued token with a freeze function and no sequencer.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zcash/zips/contents/zips/zip-0258.md?ref=3af03aa3ad991874d86b8cf35919bc9b4671e8ba\" --jq .content | base64 -d | sed -n 85,100p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The rail carries one asset, ZEC, on one proof-of-work chain, so there is no issuer freeze and no sequencer to inherit. Pool-level changes are the inherited risk: after NU6.3 the Orchard pool is spend-only (ZIP 258 L85-L100), and in June 2026 Orchard was disabled for about a day (see C1). The reference wallet does not state these assumptions to payees. Scored 2: enumerated in code, assumptions not stated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "unknown": true,
          "finding": "Not applicable as worded: Zcash has no contracts, and its rules run in node software that each operator builds or downloads. Zallet documents StageX reproducible builds and Zebra publishes release binaries, but we did not verify any binary against source.",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ZcashFoundation/zebra/tree/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/zebrad",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "path": "zebrad",
              "detail": "Node (zebra@e3eef2f3, v6.4.2), protocol libraries (librustzcash@9181ef85, orchard@616a669d), light-wallet server (lightwalletd@d16d4812) and Zaino indexer (zaino@b8db9fed), full-node wallet (zallet@522b486d), mobile wallets (zodl-android@4248d469, zodl-ios@6a7dc6b3) and their SDKs (zodl-android-wallet-sdk@afe08faf) are all public; Zebra ships Docker deploy files.",
              "checked_at": "2026-10-09",
              "recheck": "for r in ZcashFoundation/zebra zcash/librustzcash zcash/orchard zcash/lightwalletd zingolabs/zaino zcash/zallet zodl-inc/zodl-android zodl-inc/zodl-ios zodl-inc/zodl-android-wallet-sdk; do echo $r $(gh api repos/$r --jq '[.archived,.pushed_at]|@tsv'); done"
            }
          ],
          "finding": "Every layer a payment touches has public, maintained source: node, protocol libraries, light-wallet server and indexer, wallets and SDKs, plus deploy files. The only closed parts are optional store-build integrations in the mobile wallet. Judgment call: light-wallet servers are run by third parties and we cannot see which build they run, but the wallet treats them as replaceable, so we score the stack, not the operators, at 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/README.md#L23-L60",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "path": "README.md",
              "detail": "The Zebra README gives Docker and manual build steps; the lightwalletd README L92-L128 covers production setup; Zodl and Zallet READMEs cover building the wallets.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Build and run documentation exists for the node, the light-wallet server and the wallets. Reproduction not attempted, so the score is capped at 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/lightwalletd/blob/d16d48124e9ad4157ebc2324b5090c6ba201470c/lightwallet-protocol/walletrpc/service.proto#L224-L330",
              "commit": "d16d48124e9ad4157ebc2324b5090c6ba201470c",
              "path": "lightwallet-protocol/walletrpc/service.proto",
              "detail": "The light-wallet API is a versioned gRPC schema (CompactTxStreamer); compact_formats.proto defines the block format, and the node's JSON-RPC methods are documented in zebra-rpc/src/methods.rs.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zcash/lightwalletd/contents/lightwallet-protocol/walletrpc/service.proto?ref=d16d48124e9ad4157ebc2324b5090c6ba201470c\" --jq .content | base64 -d | sed -n 224,330p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Interfaces are versioned in the repos: the transaction format and consensus rules in the ZIPs, the light-wallet gRPC schema, and the node RPC. There are no contract ABIs to publish. We did not find a documented payee export format in the reference wallet. Judgment call: treating the protocol and RPC schemas as covering the ABI and API parts gives 2; no export, so not 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/orchard/blob/616a669df8c9a59c33d47064d3ce04b25d026b2e/COPYING.md",
              "commit": "616a669df8c9a59c33d47064d3ce04b25d026b2e",
              "path": "COPYING.md",
              "detail": "orchard, librustzcash, sapling-crypto and halo2 are MIT or Apache-2.0; Zebra is MIT or Apache-2.0; lightwalletd, zips and the archived zcashd are MIT; Zaino and Zallet Apache-2.0; Zodl apps MIT; the Zodl Android SDK AGPL-3.0-only.",
              "checked_at": "2026-10-09",
              "recheck": "for r in ZcashFoundation/zebra zcash/librustzcash zcash/orchard zcash/zips zcash/lightwalletd zingolabs/zaino zcash/zallet zodl-inc/zodl-android zodl-inc/zodl-ios zodl-inc/zodl-android-wallet-sdk zcash/zcash; do echo $r $(gh api repos/$r/contents --jq '[.[].name|select(test(\"^(LICEN|COPYING)\";\"i\"))]|join(\",\")'); done",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Every repository listed carries an OSI-approved licence, including the required node and protocol libraries. The Zodl Android SDK is AGPL-3.0-only, which is OSI-approved but copyleft, and is also sold under commercial terms.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android-wallet-sdk/blob/afe08faff918bf2cf4e4a1cd99913ad8bddac645/CONTRIBUTING.md#L290-L302",
              "commit": "afe08faff918bf2cf4e4a1cd99913ad8bddac645",
              "path": "CONTRIBUTING.md",
              "detail": "The Zodl Android SDK requires a signed CLA assigning or broadly licensing contributions to Znewco, Inc. to support dual licensing; its LICENSE changed from MIT to AGPL-3.0-only in commit 9ff67a5e (2026-08-24).",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zodl-inc/zodl-android-wallet-sdk/commits?path=LICENSE&per_page=5\" --jq '.[]|[.sha[0:8],.commit.author.date,.commit.message[0:60]]|@tsv'",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/orchard/blob/616a669df8c9a59c33d47064d3ce04b25d026b2e/COPYING.md#L17-L22",
              "commit": "616a669df8c9a59c33d47064d3ce04b25d026b2e",
              "path": "COPYING.md",
              "detail": "orchard notes its licence changed from the Bootstrap Open Source License to MIT or Apache-2.0 in release 0.7.0 (commit ac4b5218, 2023-12-19). librustzcash, Zebra and lightwalletd CONTRIBUTING files mention no CLA.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The required node and protocol libraries have no CLA. There have been two relicensing events: orchard moved from the Bootstrap Open Source License to MIT or Apache-2.0 in 2023, which widened rights, and the Zodl Android SDK moved from MIT to AGPL-3.0-only in August 2026 under a CLA that lets Znewco sell commercial licences. No licence-stability commitment exists. Judgment call: anchor 0 names any prior relicense event; the Zodl change concerns an optional wallet SDK and the orchard change was permissive, but under the take-the-lower-anchor rule we score 0.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/crash-android-lib/src/foss/kotlin/co/electriccoin/zcash/crash/android/internal/ListCrashReportersImpl.kt#L6-L11",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "crash-android-lib/src/foss/kotlin/co/electriccoin/zcash/crash/android/internal/ListCrashReportersImpl.kt",
              "detail": "The foss build flavour registers only the local crash reporter; Firebase, Flexa and CoinMarketCap are store-flavour integrations, and the README says the f-droid.org build omits them.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zodl-inc/zodl-android/contents/crash-android-lib/src/foss/kotlin/co/electriccoin/zcash/crash/android/internal/ListCrashReportersImpl.kt?ref=4248d469c74a9a70c32c229ebb0600a4dd539689\" --jq .content | base64 -d",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A production deployment (Zebra node, light-wallet server or Zallet, and a wallet) needs no proprietary component. The mobile wallet's store builds add optional proprietary services, and a FOSS flavour builds without them. Judgment call: the code supports 3, but with no O3 reproduction we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/app/src/main/java/co/electriccoin/zcash/app/ZcashApplication.kt#L141-L154",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "app/src/main/java/co/electriccoin/zcash/app/ZcashApplication.kt",
              "detail": "Crash reporters are enabled only when the stored preference is true, and otherwise disabled and their data deleted; the store flavour's preference (is_analytics_enabled) is a nullable boolean set only by the CrashReportOptIn screen, and the foss flavour hardcodes false.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zodl-inc/zodl-android/contents/app/src/main/java/co/electriccoin/zcash/app/ZcashApplication.kt?ref=4248d469c74a9a70c32c229ebb0600a4dd539689\" --jq .content | base64 -d | sed -n 141,154p",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/crash-android-lib/src/zcashmainnetStoreRelease/kotlin/co/electriccoin/zcash/crash/android/internal/ListCrashReportersImpl.kt#L7-L19",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "crash-android-lib/src/zcashmainnetStoreRelease/kotlin/co/electriccoin/zcash/crash/android/internal/ListCrashReportersImpl.kt",
              "detail": "The Mainnet store release registers Firebase Crashlytics alongside the local reporter.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The reference mobile wallet's store build includes Firebase Crashlytics, off by default and enabled only through an opt-in screen; the FOSS build has none. Zebra and Zallet are server software with no analytics SDK found. We ran no trace and did not inspect the iOS app in the same depth. Scored 2: present, off by default, opt-in visible in code.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/lightwalletd/blob/d16d48124e9ad4157ebc2324b5090c6ba201470c/lightwallet-protocol/walletrpc/service.proto#L224-L330",
              "commit": "d16d48124e9ad4157ebc2324b5090c6ba201470c",
              "path": "lightwallet-protocol/walletrpc/service.proto",
              "detail": "The light-wallet API carries block ranges, raw transactions, tree states and (for transparent use) addresses; it has no account, identity or contact fields.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zcash/lightwalletd/contents/lightwallet-protocol/walletrpc/service.proto?ref=d16d48124e9ad4157ebc2324b5090c6ba201470c\" --jq .content | base64 -d | grep -n \"rpc \"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A transfer needs only the signed transaction; a shielded output carries the recipient, amount and an optional memo encrypted to the recipient. No component on the required path holds an account, identity or contact data. The mobile wallet's optional swaps and merchant payments go to third parties with their own data needs. Judgment call: we score the default send flow, which is anchor 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0224.rst#L232-L257",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "path": "zips/zip-0224.rst",
              "detail": "Within a shielded pool, actions hide sender, recipient and value; moving value across the transparent turnstile reveals the amount, and wallets should warn users about this.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zcash/zips/contents/zips/zip-0224.rst?ref=3af03aa3ad991874d86b8cf35919bc9b4671e8ba\" --jq .content | base64 -d | sed -n 232,257p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0258.md#L85-L100",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "path": "zips/zip-0258.md",
              "detail": "Since NU6.3 (height 3,428,143), new shielded value goes to the Ironwood pool and Orchard is spend-only, so Orchard-to-Ironwood migrations cross a turnstile.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "A fully shielded payment reveals no payer, payee, amount or memo onchain; the fee, timing, transaction size and the number of actions are visible. Transparent addresses are fully public, as on Bitcoin, and moving between pools reveals the amount. The anonymity set depends on how many users stay shielded and on pool migrations, which we do not score. Judgment call: we score what the protocol reveals for a shielded transfer, which is anchor 3.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/LightWalletEndpointProvider.kt#L13-L28",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/LightWalletEndpointProvider.kt",
              "detail": "The light-wallet server operators are named in code and replaceable in the server picker.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zodl-inc/zodl-android/contents/ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/CMCApiProvider.kt?ref=4248d469c74a9a70c32c229ebb0600a4dd539689\" --jq .content | base64 -d | sed -n 48,60p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/CMCApiProvider.kt#L30-L60",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/CMCApiProvider.kt",
              "detail": "Exchange rates come from pro-api.coinmarketcap.com and are fetched only over Tor (comment MOB-1378), so CoinMarketCap does not see the user's IP.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "On the full-node path only the user's own node and its peers see the transaction. On the light-wallet path the chosen lightwalletd server sees the user's IP (unless Tor is on), the transactions they submit and the transactions they fetch; it is named in code and swappable. Optional features add CoinMarketCap (over Tor only), Flexa and NEAR intents. Scored 2: third parties present, named in code, swappable.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 3,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/ui-lib/src/main/java/co/electriccoin/zcash/ui/screen/chooseserver/ChooseServerVM.kt#L148-L230",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "ui-lib/src/main/java/co/electriccoin/zcash/ui/screen/chooseserver/ChooseServerVM.kt",
              "detail": "The server screen offers automatic selection, the listed servers and a custom server entry (ServerState.Custom); the server code is public as lightwalletd and Zaino.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zodl-inc/zodl-android/contents/ui-lib/src/main/java/co/electriccoin/zcash/ui/screen/chooseserver/ChooseServerVM.kt?ref=4248d469c74a9a70c32c229ebb0600a4dd539689\" --jq .content | base64 -d | sed -n 148,230p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The wallet's data endpoint (lightwalletd, which is both RPC and indexer for a light client) is configurable in the UI, and both server implementations are public. Full-node users set their own node.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0224.rst#L232-L257",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "path": "zips/zip-0224.rst",
              "detail": "A transaction spends notes the payer controls and creates notes only the recipient's keys can spend; there is no escrow or intermediary account.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zcash/zips/contents/zips/zip-0224.rst?ref=3af03aa3ad991874d86b8cf35919bc9b4671e8ba\" --jq .content | base64 -d | sed -n 232,257p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Value moves directly from notes the payer controls to notes the payee controls, in one transaction; wallets hold keys on the user's device. No one holds funds in flight. Judgment call: this is anchor 3 in substance, but 3 needs onchain evidence about a deployed contract, which this chain has none of, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/zebra-chain/src/parameters/constants.rs#L74-L99",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "path": "zebra-chain/src/parameters/constants.rs",
              "detail": "Mainnet activation heights are compiled into the node (NU6.2 at 3,364,600, NU6.3 at 3,428,143); a rule change takes effect only for nodes and miners running a release that contains it.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/ZcashFoundation/zebra/contents/zebra-chain/src/parameters/constants.rs?ref=e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291\" --jq .content | base64 -d | sed -n 74,99p"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0257.md#L51-L75",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "path": "zips/zip-0257.md",
              "detail": "The June 2026 Orchard disabling was deployed as an emergency hotfix and documented retrospectively; ZIP 258 (NU6.3) was published on 2026-06-19 ahead of its 2026-07 activation.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "No key can change the rules. Network upgrades are specified as ZIPs, compiled into node releases with fixed activation heights, and take effect only if miners and node operators run them; scheduled upgrades are announced weeks ahead in the ZIPs and release notes. The emergency soft fork of June 2026 had no advance notice, and the 84-day end-of-support halt pushes operators onto new releases. Judgment call: scheduled upgrades give notice but there is no enforced delay, and emergency changes give none; that resembles anchor 2 more than 3, and 3 would also need onchain evidence this chain cannot supply.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zcash/lightwalletd/blob/d16d48124e9ad4157ebc2324b5090c6ba201470c/lightwallet-protocol/walletrpc/service.proto#L276-L279",
              "commit": "d16d48124e9ad4157ebc2324b5090c6ba201470c",
              "path": "lightwallet-protocol/walletrpc/service.proto",
              "detail": "A wallet submits a fully signed transaction; the protocol has no allowance or delegated-spend mechanism for ZEC, so no wallet asks for one.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zcash/lightwalletd/contents/lightwallet-protocol/walletrpc/service.proto?ref=d16d48124e9ad4157ebc2324b5090c6ba201470c\" --jq .content | base64 -d | sed -n 276,279p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "There are no token approvals: each payment is a signed transaction spending exact notes, and nothing can pull funds later. Judgment call: this beats exact-amount approvals in substance, but 3 needs a distributed-package or trace record for the client, so we take 2.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/ui-lib/src/main/java/co/electriccoin/zcash/ui/screen/chooseserver/ChooseServerVM.kt#L148-L230",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "ui-lib/src/main/java/co/electriccoin/zcash/ui/screen/chooseserver/ChooseServerVM.kt",
              "detail": "If default servers disappear, the wallet accepts a custom server; Zallet with a local Zebra node needs no server at all.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zcash/zallet/contents/README.md?ref=522b486d2e4acea9fd8868ac8331e25abd6ec145\" --jq .content | base64 -d | sed -n 1,25p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Derived from S1=2 (anchor 3 in substance), C2=2 (direct in substance), C3=3 and O3=1. Funds are notes controlled by the user's keys (S1). Any node or light-wallet server can accept a payment (C2), and no hosted service is required (C3). If the reference wallet's company or the default servers disappeared, users could restore their seed in another open wallet or run Zebra plus Zallet. We did not reproduce a self-hosted setup (O3=1). Judgment call: 2, not 3, for that reason.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/CMCApiProvider.kt#L30-L60",
              "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
              "path": "ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/CMCApiProvider.kt",
              "detail": "The store build sends a CoinMarketCap API key from the app in the X-CMC_PRO_API_KEY header; it authorises only price quotes.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/zodl-inc/zodl-android/contents/ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/CMCApiProvider.kt?ref=4248d469c74a9a70c32c229ebb0600a4dd539689\" --jq .content | base64 -d | sed -n 30,46p",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Spending keys stay on the user's device; the protocol has no API keys or webhooks. The mobile wallet ships a CoinMarketCap API key in its store build, a minor issue since it grants only price-quote quota. Judgment call: 2 for the shipped key.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "finding": "We found no audit report pinned to a commit in the node, protocol-library or wallet repos, and could not load zodl.com (HTTP 403 to automated requests). Zebra's SECURITY.md (L107) says the Zcash Foundation runs no bug bounty. ZIP 257 records that the critical Orchard bug of May 2026 was found during a commissioned AI-assisted audit, but that is not an audit report. External audit reports exist by reputation only, which we do not score.",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "global",
        "note": "The protocol has no country or address rules, and the node (Zebra), the beta full-node wallet (Zallet), the light-wallet server (lightwalletd) and the reference mobile wallet (Zodl Android and iOS) contain no country or IP-geolocation gate in GitHub code search on 2026-10-09. Zodl's own website (zodl.com) refused automated requests, so we could not read any terms there; app-store distribution and optional swap or merchant integrations may have their own regional limits, which we did not evidence. Legality of use varies by jurisdiction; that is not an availability restriction by the protocol.",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/zodl-inc/zodl-android/blob/4248d469c74a9a70c32c229ebb0600a4dd539689/ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/LightWalletEndpointProvider.kt#L13-L28",
            "commit": "4248d469c74a9a70c32c229ebb0600a4dd539689",
            "path": "ui-lib/src/main/java/co/electriccoin/zcash/ui/common/provider/LightWalletEndpointProvider.kt",
            "detail": "The wallet's default servers span North America, South America, Europe and Asia-Pacific, and nothing in the wallet selects or blocks by country.",
            "checked_at": "2026-10-09",
            "recheck": "gh search code --repo zodl-inc/zodl-android country --json path --jq '.[].path'",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/zebra-rpc/src/methods.rs#L262-L283",
            "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
            "path": "zebra-rpc/src/methods.rs",
            "detail": "The node accepts any valid transaction; code search of ZcashFoundation/zebra for country and geoip returns nothing.",
            "checked_at": "2026-10-09"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: Zcash mainnet shielded transfers. Pins: zebra@e3eef2f3 (v6.4.2), zips@3af03aa3, lightwalletd@d16d4812, orchard@616a669d, librustzcash@9181ef85, zallet@522b486d (v0.1.0-beta.3 line), zodl-android@4248d469, zodl-ios@6a7dc6b3, zodl-android-wallet-sdk@afe08faf, zcashd@558f6865 (archived). The chain has no contracts, so cells whose top anchor needs onchain contract evidence (C1, C2, S1, S2) are capped at 2 with the reason in each finding, and O1 is unknown. Events of 2026 recorded from primary sources: Orchard disabled by emergency soft fork (ZIP 257), NU6.2 fix, NU6.3 Ironwood pool (ZIP 258), zcashd archived, Zashi renamed Zodl under Znewco, Inc. No transactions, node runs, builds, traces or self-host attempts were made.",
      "audits": {
        "searched": "Audit folders and security docs of the zebra, librustzcash, orchard, halo2, zcash, lightwalletd, zaino, zallet and zodl repos (none hold reports; Zebra's book describes its audit process), Least Authority's published Zcash reports, NCC Group's public Zcash reports (nccgroup.com refuses scripted requests, so those entries are marked blocked_to_bots and were not read), the Trail of Bits publications list, QEDIT's and zkSecurity's report sites, ECC blog posts on audits, and the ZecSec list (third-party wallets, not listed). Not logged: Kudelski's 2019 Sapling report (its blog link now redirects away), Least Authority's 2026 AI-assisted audit (reports sent privately, only a summary published), Zaino's internal design review, and audits of ZSA, FROST, payment URI and hardware-wallet code outside this payment path. No published audit of the Zodl wallet or its SDKs was found.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "zkSecurity",
            "date": "2026-07-14",
            "type": "audit",
            "scope": "Orchard crate 0.14.0 (Action circuit and verifier-facing code) and halo2 gadgets, proofs and Poseidon at halo2_gadgets-0.5.0, with a Lean formal verification of the Action circuit; commissioned by the Tachyon Foundation after the 2026 Orchard bug.",
            "url": "https://reports.zksecurity.xyz/reports/zcash-orchard/",
            "repo": "https://github.com/zcash/orchard",
            "covers_deployed": "partly",
            "findings": "1 medium, 2 low, 1 informational; none affecting the deployed Orchard protocol, per the report",
            "note": "Zebra v6.4.2 (the assessed node) uses halo2_gadgets 0.5.0, the audited tag, but orchard 0.15.3, newer than the audited 0.14.0."
          },
          {
            "auditor": "Least Authority",
            "date": "2025-11-03",
            "type": "audit",
            "scope": "Zebra changes for the NU6.1 network upgrade (milestone 43).",
            "url": "https://leastauthority.com/zcg-zebra-nu6-1-network-upgrade-final-audit-report/",
            "commit": "e422d2f4e5134ce2233282405a8578d3077c160f",
            "repo": "https://github.com/ZcashFoundation/zebra",
            "covers_deployed": "partly",
            "findings": "No issues; 4 suggestions",
            "note": "The commit is the verification revision; six revisions were reviewed initially. Covers the NU6.1 diff only."
          },
          {
            "auditor": "Least Authority",
            "date": "2024-11-08",
            "type": "audit",
            "scope": "Zebra changes for the NU6 network upgrade (PRs 8694, 8727, 8729, 8732, 8733, 8742, 8747).",
            "url": "https://leastauthority.com/zcg-zebra-nu6-updates-final-audit-report/",
            "commit": "c32c4f6fec158ad412b981e36fa148e4447ee70d",
            "repo": "https://github.com/ZcashFoundation/zebra",
            "covers_deployed": "partly",
            "findings": "No issues; 2 suggestions",
            "note": "Verification at 46c6b6eb. Covers the NU6 diff only."
          },
          {
            "auditor": "Least Authority",
            "date": "2024-10-21",
            "type": "audit",
            "scope": "zcashd 5.10.0 changes for the NU6 network upgrade.",
            "url": "https://leastauthority.com/zcg-zcashd-nu6-updates-final-audit-report/",
            "commit": "3b9272462a264cf9d0400fba3e4fa84584cde3b1",
            "repo": "https://github.com/zcash/zcash",
            "covers_deployed": "no",
            "findings": "No issues; 2 suggestions",
            "note": "zcashd is now archived; Zebra is the assessed node."
          },
          {
            "auditor": "NCC Group",
            "date": "2023-06-27",
            "type": "audit",
            "scope": "Zebra node at the audit-v1.0.0-rc.0 branch, focusing on zebra-chain, zebra-consensus, zebra-network, zebra-state, zebra-rpc, zebra-script and related crates.",
            "url": "https://nccgroup.com/media/bw3nq0vm/_ncc_group_zcashfoundation_e005955_report_2023-06-27_v10.pdf",
            "repo": "https://github.com/ZcashFoundation/zebra",
            "covers_deployed": "partly",
            "blocked_to_bots": true,
            "note": "Published by NCC Group at this address (linked from its public report page); nccgroup.com returns HTTP 403 to scripted requests, so we did not read the report and give no findings. Zebra 1.0 rc0 is many releases behind the assessed v6.4.2."
          },
          {
            "auditor": "NCC Group",
            "date": "2021-11",
            "type": "review",
            "scope": "NU5 cryptography review - protocol spec and ZIPs 216, 224, 225, 244, 252, plus Pallas/Vesta curves, RedPallas, the Orchard crate (excluding the circuit) and note encryption.",
            "url": "https://fox-it.com/media/hzlftzlu/_ncc_group_zcash_nu5_publicreportfinal.pdf",
            "repo": "https://github.com/zcash/orchard",
            "covers_deployed": "partly",
            "blocked_to_bots": true,
            "note": "Hosted on fox-it.com, NCC Group's own site; it returns HTTP 403 to scripted requests, so we did not read it and scope comes from NCC's summary page. Orchard code has changed since, including the 2026 soundness fix."
          },
          {
            "auditor": "QEDIT",
            "date": "2021-09",
            "type": "audit",
            "scope": "NU5 - Halo 2 proving system, Orchard protocol, primitives and Action circuit, key derivation, Pasta field and curve arithmetic, and NU5 librustzcash changes.",
            "url": "https://hackmd.io/@qedit/zcash-nu5-audit",
            "commit": "f82d00e40d982a0e49860afdeacc156b872268aa",
            "repo": "https://github.com/zcash/orchard",
            "covers_deployed": "partly",
            "note": "The commit is the Orchard one; halo2 was reviewed at 7774dd82 and pasta_curves at b016b972. Orchard and halo2 have changed since, including the 2026 circuit fix."
          },
          {
            "auditor": "NCC Group",
            "date": "2020-09",
            "type": "review",
            "scope": "NU4 (Canopy) - the six core ZIPs and their implementation in zcashd.",
            "url": "https://www.nccgroup.com/research/public-report-electric-coin-company-nu4-cryptographic-specification-and-implementation-review/",
            "repo": "https://github.com/zcash/zcash",
            "covers_deployed": "no",
            "blocked_to_bots": true,
            "note": "Public report page on nccgroup.com, which links the PDF and returns HTTP 403 to scripted requests; not read. The implementation reviewed was zcashd, now archived."
          },
          {
            "auditor": "Trail of Bits",
            "date": "2020-04-29",
            "type": "audit",
            "scope": "zcashd implementation of ZIP 221 (FlyClient Merkle mountain range) and ZIP 213 (shielded coinbase), at commits 084303d, 659ac40 and 35bff6a.",
            "url": "https://github.com/trailofbits/publications/blob/3556a402600312ccea4d5b64a30fa9dc86546b31/reviews/Zcash2.pdf",
            "repo": "https://github.com/zcash/zcash",
            "covers_deployed": "no",
            "findings": "3 informational (build system, sanitizer and cppcheck errors, lack of fuzzing)",
            "note": "zcashd code, now archived."
          },
          {
            "auditor": "NCC Group",
            "date": "2020-01",
            "type": "review",
            "scope": "NU3 specification and the zcashd Blossom implementation.",
            "url": "https://nccgroup.com/au/research-blog/public-report-electric-coin-company-nu3-specification-and-blossom-implementation-audit",
            "repo": "https://github.com/zcash/zcash",
            "covers_deployed": "no",
            "blocked_to_bots": true,
            "note": "Public report page on nccgroup.com (linked from ECC's blog), which returns HTTP 403 to scripted requests; not read."
          },
          {
            "auditor": "Trail of Bits",
            "date": "2019-12-04",
            "type": "review",
            "scope": "Specification review of ZIP 213 (shielded coinbase) and ZIP 221 (FlyClient), with the Sapling spec as background.",
            "url": "https://github.com/trailofbits/publications/blob/3556a402600312ccea4d5b64a30fa9dc86546b31/reviews/Zcash.pdf",
            "covers_deployed": "partly",
            "findings": "No significant security findings; privacy observations on the two ZIPs",
            "note": "A specification review; both ZIPs remain consensus rules that Zebra implements."
          },
          {
            "auditor": "NCC Group",
            "date": "2019-01-30",
            "type": "review",
            "scope": "Overwinter consensus code and the Sapling cryptographic primitives.",
            "url": "https://nccgroup.com/media/v1kkxeae/_ncc_group_zcash2018_public_report_2019-01-30_v13.pdf",
            "covers_deployed": "partly",
            "blocked_to_bots": true,
            "note": "Published by NCC Group at this address; nccgroup.com returns HTTP 403 to scripted requests, so we did not read it. Sapling primitives remain in use through sapling-crypto; the Overwinter code reviewed was zcashd."
          },
          {
            "auditor": "Least Authority",
            "date": "2019-01-30",
            "type": "audit",
            "scope": "Second Sapling implementation and RPC interface changes in zcashd.",
            "url": "https://leastauthority.com/static/publications/LeastAuthority-Zcash-Sapling-Implementation-RPC-Interface-Updated-Audit-Report.pdf",
            "commit": "78c228fc4dc6dfd289909b9c0d3e8e214b312d14",
            "repo": "https://github.com/zcash/zcash",
            "covers_deployed": "no",
            "findings": "5 issues (including DNS rebinding on the RPC server), 1 suggestion",
            "note": "Updated (not final) report; zcashd is now archived."
          },
          {
            "auditor": "Least Authority",
            "date": "2018-08-17",
            "type": "review",
            "scope": "Zcash protocol specification 2018.0-beta-20 (Overwinter+Sapling).",
            "url": "https://leastauthority.com/static/publications/LeastAuthority-Zcash-Overwinter+Sapling-Specification-Final-Audit-Report.pdf",
            "covers_deployed": "partly",
            "findings": "2 issues, 2 suggestions, 6 comments",
            "note": "A specification review; the spec has been revised many times since, but Sapling rules remain in force."
          },
          {
            "auditor": "Least Authority",
            "date": "2018-05-29",
            "type": "audit",
            "scope": "zcashd 1.0.15 (Magic Bean) with libsnark, librustzcash, zcash-seeder and zcash-gitian, plus the Overwinter ZIPs 143 and 200-203.",
            "url": "https://leastauthority.com/wp-content/uploads/2019/08/LeastAuthority-Zcash-Implementation-Analysis-and-Overwinter-Specification.pdf",
            "repo": "https://github.com/zcash/zcash",
            "covers_deployed": "no",
            "findings": "6 issues (A to F)",
            "note": "Pre-Sapling zcashd code, long superseded."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 2,
          "limiting": [
            "C1",
            "C2",
            "C4",
            "C5"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O1"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F2"
          ]
        },
        "P": {
          "score": 2,
          "limiting": [
            "P1",
            "P4"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 19,
        "short": 2,
        "unk": 2,
        "total": 23
      }
    },
    {
      "slug": "zerc20",
      "name": "zERC20 (zBNB on BNB Chain)",
      "type": "transfer",
      "website": "https://zerc20.io",
      "primary_chain": {
        "name": "BNB Chain",
        "chain_id": 56,
        "basis": "zERC20 is deployed on Ethereum, Arbitrum, Base, BNB Chain, Polygon and Kaia (docs Contract Addresses page). We read the token's own transfer counter index() on each chain on 2026-10-09: zBNB on BNB Chain 0x4388…5c54 had 17356 indexed transfers, against 451/250/111 for zETH and 193/419/394 for zUSDC on Ethereum/Base/Arbitrum. Unit: the zBNB token proxy, its Verifier, the shared Blocklist, the zBNB Hub and LiquidityManager on BNB Chain. Excluded: zETH, zUSDC and zJPYC deployments (same code, Base-hosted hubs) and the testnets."
      },
      "repos": [
        {
          "url": "https://github.com/kbizikav/zERC20",
          "role": "contracts",
          "license": "BUSL-1.1"
        },
        {
          "url": "https://github.com/zerc20io/.github",
          "role": "docs",
          "license": "none"
        }
      ],
      "contracts": [
        {
          "address": "0x4388D5618B9e13Bd580209CDf37a202778C75c54",
          "chain_id": 56,
          "role": "zBNB token (ERC1967 proxy, UUPS)",
          "verified": "sourcify"
        },
        {
          "address": "0x857afA597B87513df9B2317A60677A617a6Ac748",
          "chain_id": 56,
          "role": "zERC20 implementation",
          "verified": "sourcify"
        },
        {
          "address": "0xb05977Af4aA54117910ed72141F674531894774A",
          "chain_id": 56,
          "role": "zBNB Verifier (ERC1967 proxy, UUPS)",
          "verified": "sourcify"
        },
        {
          "address": "0x6b4AafEb7746e13aAebd750418f6E9CfED6EE1c8",
          "chain_id": 56,
          "role": "Verifier implementation (not on Sourcify for chain 56)",
          "verified": "none"
        },
        {
          "address": "0x847b6E2dBB28A3a163C6e0fcA9B0222b9C1E4Df9",
          "chain_id": 56,
          "role": "Blocklist (shared, Ownable, not upgradeable)",
          "verified": "sourcify"
        },
        {
          "address": "0x35eE54CEDb9aba3b785C493C0B50643E65471c7A",
          "chain_id": 56,
          "role": "zBNB Hub (ERC1967 proxy)",
          "verified": "sourcify"
        },
        {
          "address": "0x39Cc069dF606c7bc8c79b0ADd0696BCaf548eFD9",
          "chain_id": 56,
          "role": "zBNB LiquidityManager (ERC1967 proxy)",
          "verified": "sourcify"
        },
        {
          "address": "0x43010855B94e65e77679FE81af2047719F67B1fa",
          "chain_id": 56,
          "role": "Owner Safe of token, Blocklist, LiquidityManager (3-of-4)",
          "verified": "sourcify"
        },
        {
          "address": "0xb6d8B261948B097069eF926475cbB6dd698DafCa",
          "chain_id": 56,
          "role": "Owner Safe of Verifier and Hub (3-of-4)",
          "verified": "none"
        }
      ],
      "components": [
        {
          "name": "zBNB token (zERC20 proxy and implementation)",
          "role": "contracts",
          "public": true,
          "license": "BUSL-1.1",
          "operator": "zERC20 owner Safe 0x4301…B1fa (3-of-4)",
          "required": true,
          "repo": "https://github.com/kbizikav/zERC20"
        },
        {
          "name": "zBNB Verifier (root proofs, teleport, pause)",
          "role": "contracts",
          "public": true,
          "license": "BUSL-1.1",
          "operator": "zERC20 owner Safe 0xb6d8…DafCa (3-of-4)",
          "required": true,
          "repo": "https://github.com/kbizikav/zERC20"
        },
        {
          "name": "Blocklist (OFAC address list checked on every transfer)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "zERC20 owner Safe 0x4301…B1fa (3-of-4)",
          "required": true,
          "repo": "https://github.com/kbizikav/zERC20"
        },
        {
          "name": "Allowlisted root prover (Decider prover and cross-chain job)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "zERC20 (addresses allowlisted by the Verifier owner)",
          "required": true
        },
        {
          "name": "zERC20 indexer (v1.mainnet.api.zerc20.io/indexer)",
          "role": "indexer",
          "public": false,
          "license": "proprietary",
          "operator": "zERC20",
          "required": true
        },
        {
          "name": "@zerc20/client-sdk (proof generation, burn-address derivation)",
          "role": "sdk",
          "public": true,
          "license": "MIT",
          "operator": "user",
          "required": true
        },
        {
          "name": "BNB Chain and a JSON-RPC endpoint",
          "role": "ledger",
          "public": true,
          "license": "LGPL-3.0",
          "operator": "BNB Chain validators; RPC chosen by the integrator",
          "required": true,
          "repo": "https://github.com/bnb-chain/bsc"
        },
        {
          "name": "zBNB Hub and LayerZero messaging (global roots, cross-chain)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "zERC20 owner Safe 0xb6d8…DafCa; LayerZero DVNs and executors",
          "required": false
        },
        {
          "name": "LiquidityManager (wrap BNB into zBNB and unwrap)",
          "role": "contracts",
          "public": true,
          "license": "MIT",
          "operator": "zERC20 owner Safe 0x4301…B1fa (admin role)",
          "required": false
        },
        {
          "name": "ICP stealth storage canisters (encrypted announcements and invoices)",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "zERC20 on the Internet Computer",
          "required": false
        },
        {
          "name": "Relay node (gasless redeem, swap to gas)",
          "role": "relayer",
          "public": false,
          "license": "proprietary",
          "operator": "zERC20",
          "required": false
        },
        {
          "name": "zERC20 app (app.zerc20.io)",
          "role": "frontend",
          "public": false,
          "license": "proprietary",
          "operator": "zERC20",
          "required": false
        },
        {
          "name": "Alchemy and Reown/WalletConnect services used by the app",
          "role": "other",
          "public": false,
          "license": "proprietary",
          "operator": "Alchemy; Reown",
          "required": false
        }
      ],
      "scores": {
        "C1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/kbizikav/zERC20/blob/b890773cf9d2ce0499181cc25989530862695980/contracts/src/zERC20.sol#L187-L196",
              "commit": "b890773cf9d2ce0499181cc25989530862695980",
              "path": "contracts/src/zERC20.sol",
              "detail": "_update() reverts with AddressIsBlocked if from or to is on BLOCKLIST, so every transfer, mint, burn and teleport of a listed address fails. This file is identical, apart from a trailing newline, to the Sourcify source of the deployed implementation 0x857a…c748.",
              "checked_at": "2026-10-09",
              "recheck": "gh api \"repos/kbizikav/zERC20/contents/contracts/src/zERC20.sol?ref=b890773cf9d2ce0499181cc25989530862695980\" --jq .content | base64 -d | sed -n 187,196p",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0x847b6E2dBB28A3a163C6e0fcA9B0222b9C1E4Df9",
              "address": "0x847b6E2dBB28A3a163C6e0fcA9B0222b9C1E4Df9",
              "block_number": 126599703,
              "detail": "The Blocklist (Sourcify exact_match) has onlyOwner blockAddress, unblockAddress and blockAddresses with no delay; owner() is the Safe 0x4301…B1fa at block 126599703.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x847b6E2dBB28A3a163C6e0fcA9B0222b9C1E4Df9 \"owner()(address)\" --rpc-url https://bsc-rpc.publicnode.com",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x00000000000000000000000043010855b94e65e77679fe81af2047719f67b1fa"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0x43010855B94e65e77679FE81af2047719F67B1fa",
              "address": "0x43010855B94e65e77679FE81af2047719F67B1fa",
              "block_number": 126599703,
              "detail": "Safe 1.4.1 with threshold 3 and four owners (0x6893…2647, 0x5C04…4Bb6, 0x1eB7…794D, 0x4E3a…6830, all EOAs); getModulesPaginated returns no modules and the guard slot is zero. The Verifier owner Safe 0xb6d8…DafCa has the same four owners, threshold 3, no modules and no guard.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x43010855B94e65e77679FE81af2047719F67B1fa \"getThreshold()(uint256)\" --rpc-url https://bsc-rpc.publicnode.com",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000003"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x6b4AafEb7746e13aAebd750418f6E9CfED6EE1c8",
              "address": "0xb05977Af4aA54117910ed72141F674531894774A",
              "block_number": 126599703,
              "detail": "The zBNB Verifier's owner is the Safe 0xb6d8…DafCa and paused() is false. Its implementation 0x6b4a…E1c8 has the same code hash on BNB Chain as on Base, where Sourcify has an exact match. In that source, activateEmergency() lets the owner pause proveTransferRoot, teleport, singleTeleport and relayTransferRoot.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x5c975abb",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-users/faq",
              "quote": "The Blocklist contract is managed by a designated owner (multisig)",
              "detail": "The FAQ says the Blocklist follows the OFAC list and that a blocked address cannot send, receive, wrap, unwrap or teleport. The signers are not named.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The settlement contracts carry two stop powers. The Blocklist owner, a 3-of-4 Safe with undisclosed EOA signers, can add any address at once, with no timelock or notice. The token then refuses every transfer to or from that address, including funds already sitting at a burn address meant for that recipient. The Verifier owner, a second 3-of-4 Safe with the same signers, can pause all proofs and teleports with activateEmergency. Neither Safe has a module or a guard. Scored 0 because the role can target individual addresses with no notice. The docs say the list follows OFAC; that is a policy statement, not a constraint in code.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C2": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/kbizikav/zERC20/blob/b890773cf9d2ce0499181cc25989530862695980/contracts/src/Verifier.sol#L360-L372",
              "commit": "b890773cf9d2ce0499181cc25989530862695980",
              "path": "contracts/src/Verifier.sol",
              "detail": "proveTransferRoot() is gated by onlyAllowedProver, which requires msg.sender to be in an owner-managed allowlist (setAllowedProver L775-L780). Teleports verify against roots recorded only by this function or relayed from the Hub.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x6b4AafEb7746e13aAebd750418f6E9CfED6EE1c8",
              "address": "0xb05977Af4aA54117910ed72141F674531894774A",
              "block_number": 126599703,
              "detail": "The deployed Verifier implementation (exact match on Base, same code hash on BNB Chain) keeps the onlyAllowedProver gate on proveTransferRoot. latestProvedIndex() equalled the token's index() (17356) at block 126599703, so roots were being proved at the time.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xb05977Af4aA54117910ed72141F674531894774A \"latestProvedIndex()(uint64)\" --rpc-url https://bsc-rpc.publicnode.com"
            }
          ],
          "finding": "The payer's half is direct: the sender transfers zBNB to a burn address with any wallet. The payee's half is not. teleport and singleTeleport are open to anyone with a valid proof, but they verify against transfer roots, and only addresses the Verifier owner has allowlisted can post those roots. A payment that has not been included in a proved root cannot be redeemed until the provider's prover posts it. Judgment call: we score the private flow, so 0, because settlement depends on the provider's prover. A plain public zBNB transfer settles directly, but it is not private.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C3": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/kbizikav/zERC20/blob/b890773cf9d2ce0499181cc25989530862695980/contracts/src/Verifier.sol#L360-L372",
              "commit": "b890773cf9d2ce0499181cc25989530862695980",
              "path": "contracts/src/Verifier.sol",
              "detail": "Root proving is restricted to allowlisted provers, so the provider can stop new payments from becoming redeemable.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-developers/indexer-api",
              "quote": "The indexer is the public read API for zERC20 transfer history",
              "detail": "Recipients get Merkle proofs for their burn events from the indexer; the app bundle hardcodes https://v1.mainnet.api.zerc20.io/indexer/zbnb (archived bundle strings).",
              "checked_at": "2026-10-09",
              "archive": "data/archive/zerc20-app-bundle.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-users/getting-started-1",
              "quote": "git clone https://github.com/zerc20io/zERC20.git",
              "detail": "The docs point to github.com/zerc20io/zERC20 for the CLI, indexer and prover code, but that repository returned 404 on 2026-10-09. The org has one public repo, its profile.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Two provider services sit in the required path. The root prover is single-vendor by contract design: only allowlisted addresses can prove roots. The hosted indexer supplies the Merkle proofs recipients need. The docs invite users to run their own indexer, but the official repository is not public. A snapshot of the monorepo, BUSL-1.1, exists under a personal GitHub account; it is not linked from the org, and running a prover from it would not help, because the contract allowlist still applies. The relay node and ICP canisters are optional. Scored 0: required, closed and single-vendor.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C4": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/kbizikav/zERC20/blob/b890773cf9d2ce0499181cc25989530862695980/contracts/src/zERC20.sol#L187-L196",
              "commit": "b890773cf9d2ce0499181cc25989530862695980",
              "path": "contracts/src/zERC20.sol",
              "detail": "Address filtering sits in the token's _update(), which is the settlement layer.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-users/faq",
              "quote": "you will not be able to send, receive, wrap, unwrap, or teleport any zERC20 tokens",
              "detail": "The FAQ and contract spec disclose the OFAC Blocklist and its effect; the app also pre-checks recipients against the Blocklist before sending (docs Private Transfer page).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Filtering is built into the settlement contracts. The token checks every sender and recipient against an owner-maintained Blocklist, so no direct path avoids it. The filter is disclosed in the docs, and the list source is named as OFAC, but its contents are set by the owner Safe. The terms describe these parameters as operating \"without human intervention or discretion by the Operator\", which the owner-only blockAddress function contradicts. Judgment call: anchors 2 and 3 require a neutral settlement layer. The filtering is disclosed, so not 0. We take 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "C5": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0x04033cfaEcBAa4c133c225314Bad1bF7930453Bd",
              "address": "0x39Cc069dF606c7bc8c79b0ADd0696BCaf548eFD9",
              "block_number": 126599703,
              "detail": "underlyingToken() of the zBNB LiquidityManager returns the native-token sentinel 0xEeee…EEeE (native BNB), and the token's verifier() and minter() point at the listed Verifier and LiquidityManager.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x39Cc069dF606c7bc8c79b0ADd0696BCaf548eFD9 \"underlyingToken()(address)\" --rpc-url https://bsc-rpc.publicnode.com"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/reference/addresses",
              "quote": "zBNB wrap/unwrap is only available on BNB Chain",
              "detail": "The addresses page enumerates every token, chain and contract, and says it is derived from config/deployed JSON files.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Tokens and chains are enumerated onchain and in the docs. zBNB wraps native BNB, which has no issuer freeze. The freeze power that matters is zERC20's own Blocklist (C1), which the docs disclose. The docs do not state BNB Chain's validator-set assumptions or LayerZero's DVN trust for cross-chain roots. Scored 2: enumerated in code, chain and messaging assumptions not stated.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0x857afA597B87513df9B2317A60677A617a6Ac748",
              "address": "0x4388D5618B9e13Bd580209CDf37a202778C75c54",
              "block_number": 126599703,
              "detail": "The token proxy's implementation slot reads 0x857a…c748. On chain 56 Sourcify returns exact_match for the zERC20 implementation, the LiquidityManager implementation 0x0403…53bd, the Blocklist and the Hub proxy; match (partial) for the token, Verifier and LiquidityManager proxies and the Hub implementation; and no record for the Verifier implementation 0x6b4a…E1c8.",
              "checked_at": "2026-10-09",
              "recheck": "for a in 0x857afA597B87513df9B2317A60677A617a6Ac748 0x6b4AafEb7746e13aAebd750418f6E9CfED6EE1c8 0x847b6E2dBB28A3a163C6e0fcA9B0222b9C1E4Df9; do curl -s --max-time 30 https://sourcify.dev/server/v2/contract/56/$a | jq -r .match; done",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x000000000000000000000000857afa597b87513df9b2317a60677a617a6ac748"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x6b4AafEb7746e13aAebd750418f6E9CfED6EE1c8",
              "address": "0xb05977Af4aA54117910ed72141F674531894774A",
              "block_number": 126599703,
              "detail": "The Verifier proxy's implementation slot reads 0x6b4a…E1c8, whose runtime code hash (0x452b52…d697) equals that of the exact-matched contract at the same address on Base.",
              "checked_at": "2026-10-09",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x0000000000000000000000006b4aafeb7746e13aaebd750418f6e9cfed6ee1c8"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Most of the zBNB contracts are verified on Sourcify, but the Verifier implementation, which every redeem calls, is not verified on BNB Chain. Its bytecode matches a verified deployment on Base. BscScan blocked automated access, and we did not bypass it. The official repository is not public, so there is no build script from a provider-published commit. Judgment call: 1 rather than 2, because one settlement contract is unverified on this chain.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/zerc20io/.github/blob/3c46f938068bf668b70ee98783e5f5eeeb103317/profile/README.md#L1-L51",
              "commit": "3c46f938068bf668b70ee98783e5f5eeeb103317",
              "path": "profile/README.md",
              "detail": "The zerc20io org has one public repository, its profile README, which links the app, docs and website and no source repository.",
              "checked_at": "2026-10-09",
              "recheck": "gh api orgs/zerc20io/repos --jq '.[].name'",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/kbizikav/zERC20/tree/b890773cf9d2ce0499181cc25989530862695980/contracts",
              "commit": "b890773cf9d2ce0499181cc25989530862695980",
              "path": "contracts",
              "detail": "A personal-account repository holds a BUSL-1.1 snapshot (2026-04-20) of the monorepo, with contracts, cli, sdk, frontend, indexer, decider-prover, relay and zstorage. Its zERC20.sol and Blocklist.sol match the deployed source; its Verifier.sol is an older version.",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Officially, only the contracts (as Sourcify source) and the compiled MIT SDK on npm are public. The docs' repository link returns 404. A full-stack snapshot exists under an unaffiliated personal account; we cite it only where it matches deployed bytecode and do not treat it as the provider's published stack. Judgment call: 1 (contracts and SDK only).",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O3": {
          "score": 0,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-users/getting-started-1",
              "quote": "git clone https://github.com/zerc20io/zERC20.git",
              "detail": "The CLI and self-host instructions start by cloning github.com/zerc20io/zERC20, which returned HTTP 404 on 2026-10-09.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The documented path to a working deployment starts from a repository that is not public, so a stranger cannot follow it. We made no reproduction attempt. Even with code, a self-hosted prover could not post roots to the deployed Verifier without being allowlisted. Scored 0, because no published path exists.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "O4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-developers/indexer-api",
              "quote": "The indexer is the public read API for zERC20 transfer history",
              "detail": "The indexer API, contract spec and events are documented on the hosted docs site; the npm SDK ships contract ABIs (BlocklistArtifact and others).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "ABIs ship in the npm package, and the API and events are described on GitBook, but none of it is versioned in a public provider repository. We found no payee export function. Scored 1: documented only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F1": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/kbizikav/zERC20/blob/b890773cf9d2ce0499181cc25989530862695980/LICENSE",
              "commit": "b890773cf9d2ce0499181cc25989530862695980",
              "path": "LICENSE",
              "detail": "Business Source License 1.1, Licensor zERC20, no Additional Use Grant, Change Date 2030-04-08, Change License GPL-2.0-or-later. The deployed zERC20.sol and Verifier.sol carry SPDX BUSL-1.1 in their Sourcify source; Blocklist, Hub and LiquidityManager are MIT.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s --max-time 30 https://sourcify.dev/server/v2/contract/56/0x857afA597B87513df9B2317A60677A617a6Ac748?fields=sources | jq -r '.sources[\"src/zERC20.sol\"].content' | head -1",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The token and Verifier source is BUSL-1.1 with no additional use grant, so production use of a fork needs a commercial licence until 2030. The required root prover and indexer are not public. Scored 0: required components are closed, and the core contracts are source-available only.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F2": {
          "unknown": true,
          "finding": "The official repository is not public, so its CLA, contributing rules and licence history cannot be checked. The snapshot's LICENSE sets a 2030 change date to GPL-2.0-or-later.",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "F3": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/kbizikav/zERC20/blob/b890773cf9d2ce0499181cc25989530862695980/contracts/src/Verifier.sol#L773-L787",
              "commit": "b890773cf9d2ce0499181cc25989530862695980",
              "path": "contracts/src/Verifier.sol",
              "detail": "The prover allowlist is set by the owner; no open alternative can post roots to the deployed Verifier.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-developers/architecture",
              "quote": "Run your own indexer instance to avoid sender-recipient linkage leaks",
              "detail": "The architecture page lists the indexer, Decider prover, cross-chain job and relay node as off-chain services.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Using the deployed protocol requires the provider's root prover, a hosted-only service by contract design, and the indexer code is not officially public. The docs describe both services. Scored 1: production needs a hosted service with no open alternative, documented.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P1": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.zerc20.io/",
              "quote": "features:{analytics:!1,email:!1,socials:!1,send:!1,swaps:!1,onramp:!1,legalCheckbox:!0}",
              "detail": "The production bundle passes analytics:false to Reown AppKit, and a grep finds no analytics, error-reporting or fingerprinting SDK. The npm SDK (0.7.5) has no such dependency.",
              "checked_at": "2026-10-09",
              "archive": "data/archive/zerc20-app-bundle.txt"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@zerc20/client-sdk/0.7.5",
              "quote": "grep for sentry|posthog|mixpanel|amplitude|gtag|analytics: no matches.",
              "detail": "Search of the SDK's dist files for analytics libraries.",
              "checked_at": "2026-10-09",
              "archive": "data/archive/zerc20-client-sdk-0.7.5.txt",
              "package": {
                "name": "@zerc20/client-sdk",
                "version": "0.7.5",
                "integrity": "sha512-gUaALG+nFrQwhpnAEvcCGysygk2ikhQtXBDZNRy8xOKpWnIA5TVRh6x2D0eI6rP0WJ5nZAj/G9/zievWhzHj3g=="
              }
            }
          ],
          "finding": "Neither the served app bundle nor the SDK package contains analytics; the app explicitly disables Reown's analytics. The app source is not public, and the SDK is published only as compiled npm output, so this rests on documented-tier reads of build artefacts. No trace was run. Judgment call: the substance fits 2 or 3, but without verified or trace evidence the documented cap applies, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P2": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-developers/architecture",
              "quote": "Observes sender/burn-address/value; learns recipient on query",
              "detail": "The trust model says the indexer operator sees sender, burn address and value, and learns the recipient when the recipient queries it.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "Onchain, the flow needs only addresses and amounts, and burn-address secrets are delivered encrypted through ICP canisters. The required hosted indexer, however, learns which recipient is querying which burn events, and with them the IP address and timing. That is collection beyond settlement needs, disclosed only in docs. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P3": {
          "score": 2,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0x857afA597B87513df9B2317A60677A617a6Ac748",
              "address": "0x4388D5618B9e13Bd580209CDf37a202778C75c54",
              "block_number": 126599703,
              "detail": "Every balance change emits IndexedTransfer(index, from, to, value) in plaintext, and a redeem emits Teleport(to, value); the burn address is trim160(poseidon(recipient, secret)), so it does not reveal the recipient.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x4388D5618B9e13Bd580209CDf37a202778C75c54 \"index()(uint256)\" --rpc-url https://bsc-rpc.publicnode.com"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/overview/how-it-works",
              "quote": "Transfer and withdrawal amounts are visible on-chain",
              "detail": "The docs state that amounts are public and suggest batching or partial withdrawals to reduce correlation.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "The chain shows the sender paying an unknown burn address, and later a recipient minting via teleport, with no onchain link between the two. Amounts are plaintext and not fixed denominations, so unusual amounts and timing can link a payment to its redeem; the docs say so. Judgment call: 2 (minimal linkage, documented) rather than 3, because plaintext arbitrary amounts are revealed by the protocol itself. Anonymity-set size (17356 indexed zBNB transfers) is behavioural and not scored.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P4": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.zerc20.io/",
              "quote": "https://v1.mainnet.api.zerc20.io/indexer/zbnb",
              "detail": "The app hardcodes the zERC20 indexer and relayer, Alchemy RPC URLs with an embedded key, a thirdweb BNB RPC, ICP API hosts and WalletConnect/Reown hosts.",
              "checked_at": "2026-10-09",
              "archive": "data/archive/zerc20-app-bundle.txt"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-developers/architecture",
              "quote": "Observes sender/burn-address/value; learns recipient on query",
              "detail": "The docs disclose what the indexer operator sees.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "In the app flow, the provider's indexer, Alchemy (or thirdweb) RPCs and ICP boundary nodes see payment requests, and WalletConnect relays see wallet sessions. The SDK leaves every endpoint to the integrator, but the indexer it needs is the provider's unless you build your own. Disclosed in docs; the app's choices are not swappable. Scored 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "P5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@zerc20/client-sdk/0.7.5",
              "quote": "The `DEFAULT_*` values are internal tuning defaults, overridable via optional parameters.",
              "detail": "The SDK hardcodes no service URL (only explorer links); indexer, decider, relay, ICP and RPC endpoints are passed in by the integrator.",
              "checked_at": "2026-10-09",
              "archive": "data/archive/zerc20-client-sdk-0.7.5.txt"
            }
          ],
          "finding": "In the SDK, endpoints are configurable in code. The app hardcodes them. The indexer code is not officially public. Judgment call: the SDK would support 2, but the evidence is a compiled npm package (documented tier), so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S1": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0x4388D5618B9e13Bd580209CDf37a202778C75c54",
              "address": "0x4388D5618B9e13Bd580209CDf37a202778C75c54",
              "block_number": 126599703,
              "detail": "The zBNB token is an ERC1967 UUPS proxy whose owner is the Safe 0x4301…B1fa; _authorizeUpgrade is onlyOwner, and setVerifier and setMinter (onlyOwner) choose which contracts can mint.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x4388D5618B9e13Bd580209CDf37a202778C75c54 \"owner()(address)\" --rpc-url https://bsc-rpc.publicnode.com",
              "check": {
                "call": "0x8da5cb5b",
                "expect": "0x00000000000000000000000043010855b94e65e77679fe81af2047719f67b1fa"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-developers/architecture",
              "quote": "Can upgrade contracts, rotate verifiers",
              "detail": "The trust model discloses the owner's upgrade and verifier powers.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "In flight, value sits as a zBNB balance at a keyless burn address until the recipient teleports an equal amount. No provider wallet holds it, but the token and Verifier are upgradeable by 3-of-4 Safes with no timelock. The owner can also swap the Verifier or minter, which could redirect or invalidate pending balances. The BNB backing sits in an upgradeable LiquidityManager administered by the same Safe. Disclosed in docs. Scored 1: upgradeable escrow, disclosed.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S2": {
          "score": 1,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0x43010855B94e65e77679FE81af2047719F67B1fa",
              "address": "0x43010855B94e65e77679FE81af2047719F67B1fa",
              "block_number": 126599703,
              "detail": "The upgrade owner of the token, Blocklist and LiquidityManager is this Safe (3-of-4, EOA signers), with no modules and the guard slot at zero. No timelock contract sits in front of it.",
              "checked_at": "2026-10-09",
              "recheck": "cast storage 0x43010855B94e65e77679FE81af2047719F67B1fa 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8 --rpc-url https://bsc-rpc.publicnode.com",
              "check": {
                "slot": "0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://app.safe.global/home?safe=bnb:0xb6d8B261948B097069eF926475cbB6dd698DafCa",
              "address": "0xb6d8B261948B097069eF926475cbB6dd698DafCa",
              "block_number": 126599703,
              "detail": "The Verifier and Hub owner Safe has threshold 3 and the same four EOA owners, with no modules and no guard.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0xe75235b8",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000003"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "finding": "All core contracts are UUPS proxies upgradeable at once by two 3-of-4 Safes that share the same undisclosed EOA signers. There is no timelock and no notice channel. Neither Safe has a module or a guard. Scored 1: multisig admin, no timelock.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S3": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://registry.npmjs.org/@zerc20/client-sdk/0.7.5",
              "quote": "args: [managerAddress, normalizedAmount],",
              "detail": "SDK wrap and unwrap approve exactly the amount being wrapped or unwrapped to the LiquidityManager, and only when the current allowance is short. zBNB wraps native BNB, which needs no approval, and a private send is a plain transfer.",
              "checked_at": "2026-10-09",
              "archive": "data/archive/zerc20-client-sdk-0.7.5.txt",
              "package": {
                "name": "@zerc20/client-sdk",
                "version": "0.7.5",
                "integrity": "sha512-gUaALG+nFrQwhpnAEvcCGysygk2ikhQtXBDZNRy8xOKpWnIA5TVRh6x2D0eI6rP0WJ5nZAj/G9/zievWhzHj3g=="
              }
            }
          ],
          "finding": "The SDK requests exact-amount approvals, and the zBNB payment path needs none. Gasless redeem uses a signed fee authorization rather than an allowance. Judgment call: the code fits 3, but it is read from a compiled npm package, not a public repository, so the documented cap gives 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S4": {
          "score": 0,
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x6b4AafEb7746e13aAebd750418f6E9CfED6EE1c8",
              "address": "0xb05977Af4aA54117910ed72141F674531894774A",
              "block_number": 126599703,
              "detail": "Teleports verify only against roots posted by allowlisted provers (C2), and the Verifier owner can pause (C1).",
              "checked_at": "2026-10-09"
            }
          ],
          "finding": "Derived from S1=1, C2=0, C3=0 and O3=0. If the provider disappears, no new roots are proved. Payments sent to burn addresses after the last proved root cannot be redeemed, and earlier unredeemed ones need indexer data that only the provider serves. Holders of plain zBNB can still unwrap through the LiquidityManager. Scored 0: payees' access depends on provider liveness.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S5": {
          "score": 1,
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.zerc20.io/",
              "quote": "RPC endpoints with an embedded Alchemy key",
              "detail": "The served app bundle embeds one Alchemy key in six RPC URLs. Burn secrets and recipient keys are derived client-side, and gasless redeem uses an EIP-712 fee authorization signed by the recipient.",
              "checked_at": "2026-10-09",
              "archive": "data/archive/zerc20-app-bundle.txt"
            }
          ],
          "finding": "The only secret seen in the client is an RPC provider key, which grants RPC quota. There are no webhooks or merchant API keys. Burn-address secrets stay with the user or are sent encrypted through ICP. Judgment call: this is a minor issue (2 in substance), but the evidence is a documented-tier read of a built bundle, so 1.",
          "provider_response": null,
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "S6": {
          "unknown": true,
          "finding": "The docs and website name no audit or bug bounty. The personal-account snapshot contains audit/zksecurity-audit.pdf, but we could not extract its text to confirm scope or an audited commit, and the official repository is not public.",
          "assessed_by": "AI research agent (seed), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "availability": {
        "model": "blocklist",
        "countries": [
          "KP",
          "IR",
          "SY"
        ],
        "note": "The terms define Restricted Countries as jurisdictions under OFAC, EU or UN sanctions \"including but not limited to\" North Korea, Iran and Syria; only those three are named, so only they are listed. The terms are governed by Swiss law. At protocol level, the token contracts have no country check but enforce an owner-maintained address Blocklist (C1, C4). The production app bundle has no IP or country gate (archived grep), and it pre-checks recipients against the onchain Blocklist.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://zerc20.io/terms-and-conditions",
            "quote": "(e.g., North Korea, Iran, Syria)",
            "detail": "The Terms and Conditions define Restricted Countries and require users to warrant they are not residents of them.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://app.zerc20.io/",
            "quote": "grep -iE 'geoblock|ipapi|ip-api|ipinfo|geolocation|restricted countr' over the bundle: no matches.",
            "detail": "No country gate was found in the served app bundle.",
            "checked_at": "2026-10-09",
            "archive": "data/archive/zerc20-app-bundle.txt"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "notes": "Unit: zBNB on BNB Chain (most indexed transfers of any zERC20 deployment on 2026-10-09). All BNB Chain reads are at block 126599703 via bsc-rpc.publicnode.com, which serves only very recent state. The docs' source link (github.com/zerc20io/zERC20) returned 404. We cite a BUSL-1.1 snapshot at github.com/kbizikav/zERC20 (commit b890773c, 2026-04-20; author Akira Taniguchi). The org does not link it, so we use it only where its files match deployed Sourcify source (zERC20.sol, Blocklist.sol) or show the same gate (Verifier prover allowlist). The SDK and the served app bundle were read as build artefacts (archived) and never installed or run. The Verifier implementation is unverified on BNB Chain but byte-identical to a Sourcify exact match on Base. No transactions or traces.",
      "audits": {
        "searched": "zerc20.io and its docs (no audit named), the audit/ folder of the snapshot repository github.com/kbizikav/zERC20, and zkSecurity's public report index, which publishes the same audit for INTMAX. Audited contract sources were compared with the snapshot commit b890773c that this file matches to the deployed contracts.",
        "checked_at": "2026-10-13",
        "reports": [
          {
            "auditor": "zkSecurity",
            "date": "2025-12-08",
            "type": "audit",
            "scope": "zERC20 proof-of-burn R1CS circuits (withdraw, root transition, burn address, Merkle and Poseidon gadgets) and the Solidity contracts (zERC20, Verifier, Hub)",
            "url": "https://reports.zksecurity.xyz/reports/intmax-zerc20-1/",
            "commit": "69537e9569600a8725f69465a6758e6f45649337",
            "repo": "https://github.com/kbizikav/zERC20",
            "covers_deployed": "partly",
            "findings": "3 low, 3 informational",
            "note": "Audited the zk-audit-target release. zERC20.sol, Verifier.sol, Hub.sol, Blocklist.sol and LiquidityManager.sol all differ between the audited commit and b890773c, so the deployed contracts include unaudited changes. The same report is at audit/zksecurity-audit.pdf in the snapshot repository."
          }
        ]
      },
      "rollup": {
        "C": {
          "score": 0,
          "limiting": [
            "C1",
            "C2",
            "C3"
          ]
        },
        "O": {
          "score": 0,
          "limiting": [
            "O3"
          ]
        },
        "F": {
          "score": 0,
          "limiting": [
            "F1",
            "F2"
          ]
        },
        "P": {
          "score": 1,
          "limiting": [
            "P1",
            "P2",
            "P4",
            "P5"
          ]
        },
        "S": {
          "score": 0,
          "limiting": [
            "S4",
            "S6"
          ]
        }
      },
      "tally": {
        "holds": 2,
        "short": 19,
        "unk": 2,
        "total": 23
      }
    }
  ],
  "operational_criteria": {
    "groups": [
      {
        "id": "B1",
        "name": "Assurance and certifications"
      },
      {
        "id": "B2",
        "name": "Vulnerability and patch management"
      },
      {
        "id": "B3",
        "name": "Incident reporting and continuity"
      },
      {
        "id": "B4",
        "name": "Identity and access (operator side)"
      },
      {
        "id": "B5",
        "name": "API and integration"
      },
      {
        "id": "B6",
        "name": "Data protection and privacy governance"
      },
      {
        "id": "B7",
        "name": "Logging and monitoring"
      },
      {
        "id": "B8",
        "name": "Hosting and network"
      },
      {
        "id": "B9",
        "name": "Engineering practice in public repositories"
      },
      {
        "id": "B10",
        "name": "Architecture documentation"
      },
      {
        "id": "B11",
        "name": "Commercial and financial"
      },
      {
        "id": "B12",
        "name": "AI components"
      }
    ],
    "controls": [
      {
        "id": "B1.1",
        "group": "B1",
        "title": "ISO 27001, developer organisation",
        "question": "Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?",
        "applies": "operator",
        "evidence": "Certificate number checked in the certifier's public directory (documented, primary); the provider's statement alone is attested."
      },
      {
        "id": "B1.2",
        "group": "B1",
        "title": "ISO 27001, hosting and support organisation",
        "question": "Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?",
        "applies": "operator",
        "evidence": "Certifier directory entry with scope (documented); provider statement is attested."
      },
      {
        "id": "B1.3",
        "group": "B1",
        "title": "SOC 2 Type II or ISAE 3000/3402 reports",
        "question": "Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?",
        "applies": "operator",
        "evidence": "A report seen by the assessor (documented); a statement that one is available under NDA (attested)."
      },
      {
        "id": "B1.4",
        "group": "B1",
        "title": "Independent source-code security review before go-live",
        "question": "Was the application reviewed by an independent party before launch, and is the report linked?",
        "applies": "operator",
        "evidence": "Report with scope and date (documented). For protocols this is CROPS S6; link it."
      },
      {
        "id": "B1.5",
        "group": "B1",
        "title": "Penetration testing",
        "question": "Is the service penetration-tested before go-live and at least every three years, with results available?",
        "applies": "operator",
        "evidence": "Report or attestation letter with date (documented or attested)."
      },
      {
        "id": "B1.6",
        "group": "B1",
        "title": "Vulnerability scanning cadence",
        "question": "Are the platform and the application scanned for vulnerabilities at least every six months?",
        "applies": "operator",
        "evidence": "Security page or attestation stating cadence and tool (documented or attested)."
      },
      {
        "id": "B2.1",
        "group": "B2",
        "title": "Security contact and disclosure policy",
        "question": "Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?",
        "applies": "any",
        "auto": true,
        "evidence": "SECURITY.md or .well-known/security.txt in the repository (verified); a disclosure page (documented)."
      },
      {
        "id": "B2.2",
        "group": "B2",
        "title": "Patch service levels",
        "question": "Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?",
        "applies": "operator",
        "evidence": "Terms, security page or contract template (documented)."
      },
      {
        "id": "B2.3",
        "group": "B2",
        "title": "Dependency and vulnerability scanning in CI",
        "question": "Do the public repositories run dependency or code scanning automatically?",
        "applies": "any",
        "auto": true,
        "evidence": "Dependabot, CodeQL, Snyk or equivalent configuration in the repository (verified)."
      },
      {
        "id": "B3.1",
        "group": "B3",
        "title": "Incident reporting commitment",
        "question": "Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?",
        "applies": "operator",
        "evidence": "Terms, DPA or security page (documented)."
      },
      {
        "id": "B3.2",
        "group": "B3",
        "title": "Backups and restore testing",
        "question": "Are customer records backed up daily and restores tested on a schedule?",
        "applies": "custodial",
        "evidence": "Security page or attestation (documented or attested)."
      },
      {
        "id": "B3.3",
        "group": "B3",
        "title": "Recovery plan",
        "question": "Is there an approved and tested recovery plan for the service?",
        "applies": "custodial",
        "evidence": "Security page or attestation (documented or attested). For non-custodial rails see CROPS S4."
      },
      {
        "id": "B3.4",
        "group": "B3",
        "title": "Status page and post-mortems",
        "question": "Does the provider publish service status and post-mortems for incidents?",
        "applies": "operator",
        "evidence": "Status page URL and at least one post-mortem (documented)."
      },
      {
        "id": "B4.1",
        "group": "B4",
        "title": "MFA for end users",
        "question": "Can or must end users protect accounts with multi-factor authentication?",
        "applies": "custodial",
        "evidence": "Help or security page (documented)."
      },
      {
        "id": "B4.2",
        "group": "B4",
        "title": "MFA and separate accounts for privileged access",
        "question": "Is privileged access protected by MFA and kept on separate accounts?",
        "applies": "operator",
        "evidence": "Security page or attestation (documented or attested)."
      },
      {
        "id": "B4.3",
        "group": "B4",
        "title": "Periodic access reviews",
        "question": "Are user access rights reviewed at least annually and privileged accounts at least six-monthly?",
        "applies": "operator",
        "evidence": "Attestation or audit report (attested or documented)."
      },
      {
        "id": "B4.4",
        "group": "B4",
        "title": "Segregation of duties and joiner-mover-leaver controls",
        "question": "Is there a documented segregation-of-duties model and a joiner-mover-leaver process?",
        "applies": "operator",
        "evidence": "Attestation or audit report (attested or documented)."
      },
      {
        "id": "B4.5",
        "group": "B4",
        "title": "Session timeout",
        "question": "Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?",
        "applies": "custodial",
        "evidence": "Help page or observed behaviour with steps (documented)."
      },
      {
        "id": "B5.1",
        "group": "B5",
        "title": "API authentication, browser to server",
        "question": "Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?",
        "applies": "operator",
        "evidence": "API reference or SDK source (verified from a repo, documented from docs)."
      },
      {
        "id": "B5.2",
        "group": "B5",
        "title": "API authentication, server to server",
        "question": "Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?",
        "applies": "operator",
        "evidence": "API reference or SDK source. Cross-reference CROPS S5."
      },
      {
        "id": "B5.3",
        "group": "B5",
        "title": "Token expiry",
        "question": "Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?",
        "applies": "operator",
        "evidence": "API reference (documented) or SDK source (verified)."
      },
      {
        "id": "B5.4",
        "group": "B5",
        "title": "Export controls",
        "question": "If an API exports data, does it limit volumes and log exports?",
        "applies": "operator",
        "evidence": "API reference (documented). Cross-reference CROPS O4."
      },
      {
        "id": "B6.1",
        "group": "B6",
        "title": "Data classification and encryption",
        "question": "Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?",
        "applies": "operator",
        "evidence": "Security page (documented); TLS observed with a dated scan (documented)."
      },
      {
        "id": "B6.2",
        "group": "B6",
        "title": "Production data kept out of test environments",
        "question": "Does the provider state that production or real personal data is not used in development and testing?",
        "applies": "operator",
        "evidence": "Security page or attestation."
      },
      {
        "id": "B6.3",
        "group": "B6",
        "title": "Data retention and deletion on termination",
        "question": "What is retained, for how long, and is customer data removed on termination?",
        "applies": "operator",
        "evidence": "Privacy policy or terms with a quote (documented). Cross-reference CROPS P2."
      },
      {
        "id": "B6.4",
        "group": "B6",
        "title": "Data protection impact assessment and roles",
        "question": "For systems holding personal data, has a DPIA been completed and are controller and processor defined?",
        "applies": "operator",
        "evidence": "Privacy policy or DPA naming controller and processor (documented); DPIA availability (attested)."
      },
      {
        "id": "B6.5",
        "group": "B6",
        "title": "Data processing or sharing agreement available",
        "question": "Can a customer obtain a data processing agreement or equivalent?",
        "applies": "operator",
        "evidence": "Published DPA (documented) or statement of availability (attested)."
      },
      {
        "id": "B7.1",
        "group": "B7",
        "title": "Audit logging",
        "question": "Are account changes, logins and activity on important records logged and retained?",
        "applies": "operator",
        "evidence": "Security page or attestation."
      },
      {
        "id": "B7.2",
        "group": "B7",
        "title": "Central monitoring and endpoint detection",
        "question": "Are logs sent to a managed SIEM and is endpoint detection running on all platforms?",
        "applies": "operator",
        "evidence": "Attestation or audit report."
      },
      {
        "id": "B8.1",
        "group": "B8",
        "title": "Hardened hosting",
        "question": "Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?",
        "applies": "operator",
        "evidence": "Attestation or audit report; a dated external scan for open ports (documented)."
      },
      {
        "id": "B8.2",
        "group": "B8",
        "title": "Deployment configuration and infrastructure as code",
        "question": "Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?",
        "applies": "any",
        "auto": true,
        "evidence": "Dockerfile, compose, Terraform, Helm or equivalent in the repository (verified)."
      },
      {
        "id": "B9.1",
        "group": "B9",
        "title": "Default branch protected",
        "question": "Does the default branch require reviews and passing checks, with no direct pushes?",
        "applies": "any",
        "auto": true,
        "evidence": "GitHub branch rules API for the default branch (verified)."
      },
      {
        "id": "B9.2",
        "group": "B9",
        "title": "CI runs on pull requests",
        "question": "Does every pull request trigger automated checks?",
        "applies": "any",
        "auto": true,
        "evidence": "Workflow files with a pull_request trigger (verified)."
      },
      {
        "id": "B9.3",
        "group": "B9",
        "title": "Tests run in CI",
        "question": "Do the CI workflows run the test suite?",
        "applies": "any",
        "auto": true,
        "evidence": "Workflow steps invoking tests (verified)."
      },
      {
        "id": "B9.4",
        "group": "B9",
        "title": "Coverage reported",
        "question": "Is test coverage measured and reported (the partner expects 85%)?",
        "applies": "any",
        "auto": true,
        "evidence": "Coverage tooling configuration or badge in the repository (verified); the percentage itself only from a CI artifact or coverage service page (documented)."
      },
      {
        "id": "B9.5",
        "group": "B9",
        "title": "Versioned releases",
        "question": "Are releases tagged with immutable semantic versions?",
        "applies": "any",
        "auto": true,
        "evidence": "Tags and releases from the GitHub API (verified)."
      },
      {
        "id": "B9.6",
        "group": "B9",
        "title": "Signed tags or commits",
        "question": "Are release tags or recent commits cryptographically signed?",
        "applies": "any",
        "auto": true,
        "evidence": "Verification status on the latest tag and recent commits from the GitHub API (verified)."
      },
      {
        "id": "B9.7",
        "group": "B9",
        "title": "Changelog",
        "question": "Is a changelog maintained with the code?",
        "applies": "any",
        "auto": true,
        "evidence": "CHANGELOG file or GitHub release notes (verified)."
      },
      {
        "id": "B9.8",
        "group": "B9",
        "title": "Contribution and branching model documented",
        "question": "Does the README or contribution guide state how changes are proposed, reviewed and released?",
        "applies": "any",
        "auto": true,
        "evidence": "CONTRIBUTING file or a contribution section in the README (verified)."
      },
      {
        "id": "B10.1",
        "group": "B10",
        "title": "Architecture documentation",
        "question": "Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?",
        "applies": "any",
        "evidence": "Document in the repository (verified) or on a docs site (documented); say which of the three views it covers."
      },
      {
        "id": "B11.1",
        "group": "B11",
        "title": "Contracting entity",
        "question": "Which legal entity would an institution contract with, and in which jurisdiction?",
        "applies": "operator",
        "evidence": "Terms naming the entity (documented) and a company-register entry (documented, primary). Cross-reference maturity.entity."
      },
      {
        "id": "B11.2",
        "group": "B11",
        "title": "Funding of ongoing operation",
        "question": "How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?",
        "applies": "any",
        "evidence": "Annual report, treasury page, onchain fee switch (verified) or foundation statement (documented)."
      },
      {
        "id": "B11.3",
        "group": "B11",
        "title": "Termination terms",
        "question": "What happens to customer funds and data on termination by either side?",
        "applies": "operator",
        "evidence": "Terms with a quote (documented)."
      },
      {
        "id": "B12.1",
        "group": "B12",
        "title": "AI in the payment path",
        "question": "Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?",
        "applies": "any",
        "evidence": "Code (verified) or policy and docs (documented). If none is found, record absent with the search performed."
      },
      {
        "id": "B12.2",
        "group": "B12",
        "title": "AI controls documented",
        "question": "If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?",
        "applies": "any",
        "evidence": "Published AI governance documentation (documented) or attestation. Not applicable when B12.1 is absent."
      }
    ]
  },
  "operational": {
    "aleo": {
      "slug": "aleo",
      "fees": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": [
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Base fee = size cost + finalize cost; sample 2,308 microcredits (0.002308 credits) for a transfer_private",
            "basis": "Consensus cost in snarkVM, 1 microcredit per byte (quadratic above 5,000 bytes) plus finalize cost; paid via credits.aleo fee_private (hidden payer) or fee_public. Fees go to validators in the block reward. Changes need a consensus version.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Optional priority fee, any amount; 0 in the samples read",
            "basis": "Second public input of fee_private and fee_public in credits.aleo; added to the base fee and orders the mempool.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
            "checked_at": "2026-10-09",
            "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/process/src/cost.rs#L576-L583",
            "path": "synthesizer/process/src/cost.rs",
            "detail": "execution_storage_cost charges size_in_bytes microcredits, or size^2 / EXECUTION_STORAGE_FEE_SCALING_FACTOR (5000) above EXECUTION_STORAGE_PENALTY_THRESHOLD (5000 bytes, console/network/src/lib.rs L148-L151); execution_cost_v3 (L510-L528) adds the finalize cost.",
            "recheck": "gh api \"repos/ProvableHQ/snarkVM/contents/synthesizer/process/src/cost.rs?ref=29343ebbb7970e4240b4444346aeb26e31009bd7\" --jq .content | base64 -d | sed -n 576,583p"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
            "checked_at": "2026-10-09",
            "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/synthesizer/program/src/resources/credits.aleo#L988-L1046",
            "path": "synthesizer/program/src/resources/credits.aleo",
            "detail": "fee_private consumes a private record and returns change to the same owner; fee_public debits the signer's public account mapping. Both take a base amount and a priority fee and add them.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
            "checked_at": "2026-10-09",
            "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/ledger/block/src/helpers/target.rs#L54-L69",
            "path": "ledger/block/src/helpers/target.rs",
            "detail": "The staking block reward is 5% annual issuance per block plus one third of the coinbase reward plus transaction fees, so fees go to validators and their delegators; none goes to a foundation or developer.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://api.explorer.provable.com/v1/mainnet/transaction/at1k0dy4mpj3vercaeq2a0rmvhga5v0h0shw5e2d85g4sr80ufazvqs6vwxx9",
            "block_number": 22664958,
            "detail": "A credits.aleo/transfer_private transaction in block 22,664,958 (2026-10-09 12:36:36 UTC) pays fee_public with base 2308u64 and priority 0u64. transfer_public transactions in nearby blocks paid 56,166 microcredits (finalize cost). Read through Provable's explorer API; any snarkOS client returns the same transaction.",
            "checked_at": "2026-10-09",
            "recheck": "curl -s https://api.explorer.provable.com/v1/mainnet/transaction/at1k0dy4mpj3vercaeq2a0rmvhga5v0h0shw5e2d85g4sr80ufazvqs6vwxx9 | jq '.fee.transition.inputs[0:2]'"
          }
        ],
        "note": "No protocol or provider fee. The sampled private transfer paid its fee publicly, which reveals the payer; fee_private hides it. Provable's delegated proving and wallets may charge for optional services (the Shield terms mention a Feemaster API); those are outside the rail.",
        "checked_at": "2026-10-09"
      },
      "custody_model": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "Agrees with the S1 finding (anchor 3 in substance, capped at 2 for want of schema-compatible onchain evidence). transfer_private consumes the payer's record and creates a record owned by the payee in one transition; nobody holds funds in flight. Delegated proving through Provable is optional and receives an authorization, not keys.",
        "checked_at": "2026-10-09"
      },
      "licences": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "No operating entity runs the rail. Aleo mainnet is run by a committee of bonded validators and credits.aleo has no admin; Provable and the Aleo Network Foundation maintain software, run optional hosted services and fund grants, but do not transmit or hold users' funds.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "cashout": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "Native-asset rail. The payee receives Aleo credits as a record it owns; converting credits (or stablecoins issued on Aleo, out of scope) to local currency is outside the protocol.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "maturity": {
        "first_deployment": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "date": "2024-09-04",
            "block": 0,
            "what": "Aleo mainnet genesis with credits.aleo built in (consensus V1 at height 0). Current rules are consensus V21, active since height 22,437,000 on 2026-10-01."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/console/network/src/consensus_heights.rs#L165-L188",
              "path": "console/network/src/consensus_heights.rs",
              "detail": "MAINNET_V0_CONSENSUS_VERSION_HEIGHTS starts V1 at height 0 and lists V2 to V21 activation heights; V22 is unset (u32::MAX)."
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.explorer.provable.com/v1/mainnet/block/0",
              "block_number": 0,
              "detail": "Genesis header metadata timestamp 1725462000 = 2024-09-04T15:00:00Z; block 1 is 1725479626 (2024-09-04T19:53:46Z). Read through Provable's explorer API; any snarkOS client returns the same block.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://api.explorer.provable.com/v1/mainnet/block/0 | jq '.header.metadata.timestamp'  (then date -u -r <ts>)"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "entity": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "legal_name": "Provable Inc.",
            "jurisdiction": "US-DE"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://provable.com/termsofuse",
              "detail": "Provable's terms identify the company as a Delaware corporation. Provable maintains snarkVM, snarkOS, the SDK and Leo (ProvableHQ GitHub organisation) and runs the explorer API and parameter hosts.",
              "quote": "provided by Provable Inc., a Delaware corporation",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://aleo.org/grants/",
              "detail": "The Aleo Network Foundation runs aleo.org and the ecosystem grants programme.",
              "quote": "The Aleo Network Foundation (ANF) Grants Program provides up to $100K in funding",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Judgment call. Provable Inc. is recorded because it maintains the node and VM that define the unit. The Aleo Network Foundation's legal form and jurisdiction were not found on the pages read (aleo.org footer, FAQ, grants, privacy); its contributor-terms PDF was not parsed. The Delaware company register search is behind a CAPTCHA and was not used, so no register_url.",
          "checked_at": "2026-10-09"
        },
        "incidents": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/security-advisories",
              "detail": "No published security advisories in ProvableHQ/snarkVM, snarkOS, sdk or leo (empty lists on 2026-10-09).",
              "checked_at": "2026-10-09",
              "recheck": "for r in snarkVM snarkOS sdk leo; do gh api repos/ProvableHQ/$r/security-advisories --jq length; done"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/search/issues?q=repo:ProvableHQ/snarkOS+halt",
              "detail": "Issue search in snarkOS for halt returns devnet, isonet and prerelease reports (e.g. 3242, 3356, 4410) but no mainnet incident; the aleo.org blog index has no post-mortem.",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "Empty list with the search recorded. No post-mortem, advisory or mainnet halt report was found in the primary sources read; this is absence of disclosure, not proof that nothing happened.",
          "checked_at": "2026-10-09"
        },
        "changes": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2024-12-09",
              "summary": "Consensus V2 (height 2,800,000) updates the block reward and execution cost algorithms.",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/console/network/src/consensus_heights.rs#L29-L30"
            },
            {
              "date": "2025-07-22",
              "summary": "Consensus V8 (height 9,430,000) updates inclusion and record commitment versions and introduces sender ciphertexts.",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/console/network/src/consensus_heights.rs#L41-L42"
            },
            {
              "date": "2025-08-18",
              "summary": "Consensus V9 (height 10,272,000) adds program upgradability.",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/console/network/src/consensus_heights.rs#L43-L44"
            },
            {
              "date": "2025-09-16",
              "summary": "Consensus V10 (height 11,205,000) lowers fees and cuts the per-transaction compute spend limit from 100 to 4 credits.",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/console/network/src/consensus_heights.rs#L45-L46"
            },
            {
              "date": "2026-08-04",
              "summary": "Consensus V18 (height 20,794,000) enables native credits record translation and block-wide deployment limits.",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/console/network/src/consensus_heights.rs#L69-L71"
            },
            {
              "date": "2026-10-01",
              "summary": "Consensus V21 (height 22,437,000) activates Varuna V3, the current proof system version.",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/console/network/src/consensus_heights.rs#L79-L80"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/console/network/src/consensus_heights.rs#L22-L81",
              "path": "console/network/src/consensus_heights.rs",
              "detail": "The ConsensusVersion enum documents what each version changes; mainnet heights are at L165-L188. Dates are the activation-block timestamps read from api.explorer.provable.com/v1/mainnet/block/<height>."
            }
          ],
          "note": "20 consensus upgrades in about 25 months; only the six that touch fees, records or proofs are listed. Each ships in a snarkVM/snarkOS release with a fixed activation height and takes effect when the 23 validators run it.",
          "checked_at": "2026-10-09"
        }
      },
      "volume": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_observable",
        "reason": "Private transfers (transfer_private, fee_private) hide sender, recipient and amount in encrypted records; only public transfers and public fees reveal amounts. Aleo has no EVM contract address or event log, and the volume script reads EVM logs only, so even the public share cannot be computed with it."
      },
      "facts": {
        "B2.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": true,
                "detail": "security policy file: SECURITY.md"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/contents/?ref=staging",
              "detail": "ProvableHQ/snarkOS: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/contents/?ref=staging",
              "detail": "ProvableHQ/snarkVM: security policy file: SECURITY.md",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/contents/?ref=mainnet",
              "detail": "ProvableHQ/sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/contents/?ref=master",
              "detail": "ProvableHQ/leo: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": true,
                "detail": "dependabot config present"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/contents/?ref=staging",
              "detail": "ProvableHQ/snarkOS: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/contents/?ref=staging",
              "detail": "ProvableHQ/snarkVM: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/contents/?ref=mainnet",
              "detail": "ProvableHQ/sdk: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/contents/?ref=master",
              "detail": "ProvableHQ/leo: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/contents/?ref=staging",
              "detail": "ProvableHQ/snarkOS: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/contents/?ref=staging",
              "detail": "ProvableHQ/snarkVM: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/contents/?ref=mainnet",
              "detail": "ProvableHQ/sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/contents/?ref=master",
              "detail": "ProvableHQ/leo: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": false,
                "detail": "rules: deletion"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": false,
                "detail": "rules: deletion"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/rules/branches/staging",
              "detail": "ProvableHQ/snarkOS: rules: deletion",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/rules/branches/staging",
              "detail": "ProvableHQ/snarkVM: rules: deletion",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/rules/branches/mainnet",
              "detail": "ProvableHQ/sdk: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/rules/branches/master",
              "detail": "ProvableHQ/leo: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": true,
                "detail": "5 workflow file(s)"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": true,
                "detail": "5 workflow file(s)"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": true,
                "detail": "4 workflow file(s)"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": true,
                "detail": "7 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/contents/?ref=staging",
              "detail": "ProvableHQ/snarkOS: 5 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/contents/?ref=staging",
              "detail": "ProvableHQ/snarkVM: 5 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/contents/?ref=mainnet",
              "detail": "ProvableHQ/sdk: 4 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/contents/?ref=master",
              "detail": "ProvableHQ/leo: 7 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/contents/?ref=staging",
              "detail": "ProvableHQ/snarkOS: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/contents/?ref=staging",
              "detail": "ProvableHQ/snarkVM: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/contents/?ref=mainnet",
              "detail": "ProvableHQ/sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/contents/?ref=master",
              "detail": "ProvableHQ/leo: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": true,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/contents/?ref=staging",
              "detail": "ProvableHQ/snarkOS: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/contents/?ref=staging",
              "detail": "ProvableHQ/snarkVM: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/contents/?ref=mainnet",
              "detail": "ProvableHQ/sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/contents/?ref=master",
              "detail": "ProvableHQ/leo: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": true,
                "detail": "latest tags: v4.12.0, v4.11.0, v4.10.1"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": true,
                "detail": "latest tags: v4.12.0, v4.11.0, v4.10.0"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": true,
                "detail": "latest tags: v0.12.1, v0.12.0, v0.11.11"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": true,
                "detail": "latest tags: v4.0.2, v4.0.1, v4.0.0"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/tags",
              "detail": "ProvableHQ/snarkOS: latest tags: v4.12.0, v4.11.0, v4.10.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/tags",
              "detail": "ProvableHQ/snarkVM: latest tags: v4.12.0, v4.11.0, v4.10.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/tags",
              "detail": "ProvableHQ/sdk: latest tags: v0.12.1, v0.12.0, v0.11.11",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/tags",
              "detail": "ProvableHQ/leo: latest tags: v4.0.2, v4.0.1, v4.0.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": false,
                "detail": "4 of 10 recent commits signed"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": true,
                "detail": "5 of 10 recent commits signed"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/commits?per_page=10",
              "detail": "ProvableHQ/snarkOS: 4 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/commits?per_page=10",
              "detail": "ProvableHQ/snarkVM: 5 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/commits?per_page=10",
              "detail": "ProvableHQ/sdk: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/commits?per_page=10",
              "detail": "ProvableHQ/leo: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": true,
                "detail": "8 release(s) with notes"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": true,
                "detail": "6 release(s) with notes"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": true,
                "detail": "10 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/contents/?ref=staging",
              "detail": "ProvableHQ/snarkOS: 8 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/contents/?ref=staging",
              "detail": "ProvableHQ/snarkVM: 6 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/contents/?ref=mainnet",
              "detail": "ProvableHQ/sdk: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/contents/?ref=master",
              "detail": "ProvableHQ/leo: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "ProvableHQ/snarkOS",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "ProvableHQ/snarkVM",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "ProvableHQ/sdk",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "ProvableHQ/leo",
                "ok": true,
                "detail": "CONTRIBUTING file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkOS/contents/?ref=staging",
              "detail": "ProvableHQ/snarkOS: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/snarkVM/contents/?ref=staging",
              "detail": "ProvableHQ/snarkVM: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/sdk/contents/?ref=mainnet",
              "detail": "ProvableHQ/sdk: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ProvableHQ/leo/contents/?ref=master",
              "detail": "ProvableHQ/leo: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Provable API (optional hosted service, default SDK and CLI endpoint). Registration at POST /consumers issues an API key; POST /jwts/:consumerId exchanges it for a signed JWT sent as a Bearer header. Public read endpoints are rate-limited (5 requests per second, 100,000 per day). Key scoping, rotation and JWT lifetime are not documented.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.explorer.provable.com/docs/api/services/get-auth-register",
              "detail": "Auth Register endpoint of the Provable API.",
              "quote": "Registers a new user and issues them an API key.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.explorer.provable.com/docs/api/services/issue-jwt",
              "detail": "Issue JWT endpoint; the response Authorization header carries the JWT with the Bearer prefix.",
              "quote": "Issues a signed JWT for a registered consumer",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.explorer.provable.com/docs/api/v2/intro",
              "detail": "API overview with rate limits and the service groups (SnarkOS mirror, public analytics, delegated proving, record scanning, auth).",
              "quote": "Rate limiting is enforced across all endpoints",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Position of a hosted service Provable runs; the rail does not require it (any snarkOS client serves the same chain data, see C3). Cross-reference CROPS S5.",
          "checked_at": "2026-10-09"
        },
        "B6.3": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Provable's privacy notice covers its websites, explorer, SDKs and tools. Personal data is kept no longer than reasonably necessary for the purpose, with retention criteria per legal basis and deletion or de-identification afterwards; no fixed periods. It states no automated decision-making or profiling. Record scanning requires registering a view key with Provable; the notice read does not name a retention period for view keys.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://provable.com/privacy",
              "detail": "Privacy Notice, last updated 2025-08-14, section Retention of Personal Data.",
              "quote": "We will usually retain the personal data we collect about you for no longer than reasonably necessary",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Applies only to Provable's optional hosted services. Cross-reference CROPS P2.",
          "checked_at": "2026-10-09"
        },
        "B10.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Logical view only. The Aleo docs describe the split between snarkVM (synthesizer, algorithms, ledger; local execution and proving) and snarkOS (validator, prover and client modes; AleoBFT), with pages on transactions, fees, consensus and node types. No integration view of the hosted API or parameter hosts and no infrastructure view.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "fe73f75044f1803c8d8dfc610b9e910b6b36a468",
              "checked_at": "2026-10-09",
              "url": "https://github.com/AleoNet/aleo-docs-source/blob/fe73f75044f1803c8d8dfc610b9e910b6b36a468/learn/network/architecture.mdx#L8-L34",
              "path": "learn/network/architecture.mdx",
              "detail": "Architecture page of developer.aleo.org (source repo AleoNet/aleo-docs-source); learn/core-concepts/transactions.mdx L87-L110 covers fees and fee visibility.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "For Provable's hosted services the counterparty would be Provable Inc. (Delaware), California law and arbitration per its Shield Wallet terms. Those terms point to separate API Terms whose link is a literal placeholder; no API terms page was found. The rail itself has no contracting party.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://provable.com/termsofuse",
              "detail": "Shield Wallet Terms of Use (last modified December 2025) name Provable Inc., a Delaware corporation, and refer API use to API Terms.",
              "quote": "subject to our API Terms and Conditions, available at [LINK]",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "provable.com/api-terms and similar paths return 404 (2026-10-09).",
          "checked_at": "2026-10-09"
        },
        "B11.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "No protocol funding stream. Issuance (about 5% a year) and fees go to validators, delegators and provers by consensus; nothing is routed to a foundation or developer. Ecosystem work is funded by Aleo Network Foundation grants (up to $100K each); Provable is a company whose own funding was not read from a primary source.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "29343ebbb7970e4240b4444346aeb26e31009bd7",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ProvableHQ/snarkVM/blob/29343ebbb7970e4240b4444346aeb26e31009bd7/ledger/block/src/helpers/target.rs#L54-L69",
              "path": "ledger/block/src/helpers/target.rs",
              "detail": "Staking block reward = 5% of supply per year spread over blocks + one third of the coinbase reward + transaction fees; the other two thirds of the coinbase go to provers.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://aleo.org/grants/",
              "detail": "Aleo Network Foundation grants programme page.",
              "quote": "The Aleo Network Foundation (ANF) Grants Program provides up to $100K in funding",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B12.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            },
            {
              "criterion": "C4",
              "index": 1
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://provable.com/privacy",
              "detail": "Provable states it does not run automated decision-making on personal data for its hosted services.",
              "quote": "We do not conduct automated processing of personal data, including profiling",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Settlement depends on consensus checks, fees and the restrictions list, which is a hand-maintained JSON file (empty) rather than an automated or AI screen. No AI component was found in snarkVM, snarkOS or the SDK in the seed research's code searches.",
          "checked_at": "2026-10-09"
        }
      }
    },
    "anoma-pay": {
      "slug": "anoma-pay",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/contents/?ref=main",
              "detail": "anoma/pa-evm: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-forwarder: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/contents/?ref=main",
              "detail": "anoma/anoma-app-sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/contents/?ref=main",
              "detail": "anoma/arm-risc0: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-resource: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": true,
                "detail": "scanning step in a workflow"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": true,
                "detail": "scanning step in a workflow"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": true,
                "detail": "scanning step in a workflow"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/contents/?ref=main",
              "detail": "anoma/pa-evm: scanning step in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-forwarder: scanning step in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/contents/?ref=main",
              "detail": "anoma/anoma-app-sdk: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/contents/?ref=main",
              "detail": "anoma/arm-risc0: scanning step in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-resource: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/contents/?ref=main",
              "detail": "anoma/pa-evm: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-forwarder: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/contents/?ref=main",
              "detail": "anoma/anoma-app-sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/contents/?ref=main",
              "detail": "anoma/arm-risc0: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-resource: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, required_signatures, pull_request, required_status_checks"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, required_signatures, pull_request, required_status_checks"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/rules/branches/main",
              "detail": "anoma/pa-evm: rules: deletion, non_fast_forward, required_signatures, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/rules/branches/main",
              "detail": "anoma/anomapay-erc20-forwarder: rules: deletion, non_fast_forward, required_signatures, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/rules/branches/main",
              "detail": "anoma/anoma-app-sdk: rules: deletion, non_fast_forward, pull_request",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/rules/branches/main",
              "detail": "anoma/arm-risc0: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/rules/branches/main",
              "detail": "anoma/anomapay-erc20-resource: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": true,
                "detail": "2 workflow file(s)"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": true,
                "detail": "2 workflow file(s)"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": true,
                "detail": "6 workflow file(s)"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": true,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": true,
                "detail": "1 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/contents/?ref=main",
              "detail": "anoma/pa-evm: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-forwarder: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/contents/?ref=main",
              "detail": "anoma/anoma-app-sdk: 6 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/contents/?ref=main",
              "detail": "anoma/arm-risc0: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-resource: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/contents/?ref=main",
              "detail": "anoma/pa-evm: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-forwarder: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/contents/?ref=main",
              "detail": "anoma/anoma-app-sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/contents/?ref=main",
              "detail": "anoma/arm-risc0: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-resource: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/contents/?ref=main",
              "detail": "anoma/pa-evm: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-forwarder: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/contents/?ref=main",
              "detail": "anoma/anoma-app-sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/contents/?ref=main",
              "detail": "anoma/arm-risc0: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-resource: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": true,
                "detail": "latest tags: v1.0.0-rc.4, v1.0.0-rc.3, v1.0.0-rc.2"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": false,
                "detail": "latest tags: contracts/v2.0.0-rc.7, contracts/v2.0.0-rc.6, contracts/v2.0.0-rc.5"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": true,
                "detail": "latest tags: v1.2.0, v1.1.0, v1.0.0"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": true,
                "detail": "latest tags: v2.0.0-rc.7, v2.0.0-rc.6, v2.0.0-rc.5"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": true,
                "detail": "latest tags: v3.0.0-rc.3, v3.0.0-rc.2, v3.0.0-rc.1"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/tags",
              "detail": "anoma/pa-evm: latest tags: v1.0.0-rc.4, v1.0.0-rc.3, v1.0.0-rc.2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/tags",
              "detail": "anoma/anomapay-erc20-forwarder: latest tags: contracts/v2.0.0-rc.7, contracts/v2.0.0-rc.6, contracts/v2.0.0-rc.5",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/tags",
              "detail": "anoma/anoma-app-sdk: latest tags: v1.2.0, v1.1.0, v1.0.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/tags",
              "detail": "anoma/arm-risc0: latest tags: v2.0.0-rc.7, v2.0.0-rc.6, v2.0.0-rc.5",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/tags",
              "detail": "anoma/anomapay-erc20-resource: latest tags: v3.0.0-rc.3, v3.0.0-rc.2, v3.0.0-rc.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": true,
                "detail": "8 of 10 recent commits signed"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/commits?per_page=10",
              "detail": "anoma/pa-evm: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/commits?per_page=10",
              "detail": "anoma/anomapay-erc20-forwarder: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/commits?per_page=10",
              "detail": "anoma/anoma-app-sdk: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/commits?per_page=10",
              "detail": "anoma/arm-risc0: 8 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/commits?per_page=10",
              "detail": "anoma/anomapay-erc20-resource: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": true,
                "detail": "9 release(s) with notes"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": true,
                "detail": "2 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/contents/?ref=main",
              "detail": "anoma/pa-evm: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-forwarder: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/contents/?ref=main",
              "detail": "anoma/anoma-app-sdk: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/contents/?ref=main",
              "detail": "anoma/arm-risc0: 9 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-resource: 2 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "anoma/pa-evm",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "anoma/anomapay-erc20-forwarder",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "anoma/anoma-app-sdk",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "anoma/arm-risc0",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "anoma/anomapay-erc20-resource",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/contents/?ref=main",
              "detail": "anoma/pa-evm: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-forwarder/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-forwarder: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anoma-app-sdk/contents/?ref=main",
              "detail": "anoma/anoma-app-sdk: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/arm-risc0/contents/?ref=main",
              "detail": "anoma/arm-risc0: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/anomapay-erc20-resource/contents/?ref=main",
              "detail": "anoma/anomapay-erc20-resource: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement for Anoma Foundation or Heliax in the terms, docs or site.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "attested",
          "value": "The docs say the Vast.ai datacenters that run the prover provide ISO certifications; no certificate, standard, entity or scope is named. Hosting of the transaction service and indexer is not described.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/anoma-pay-trust-model",
              "archive": "data/archive/anoma-pay-docs.txt",
              "detail": "Trust model page, Vast.ai datacenters entry.",
              "checked_at": "2026-10-09",
              "quote": "Vast.ai datacenters provide ISO certifications",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "Informal Systems (commit fc69013e, Oct 2025) and Nethermind (fee4f470, Oct-Nov 2025) audited the protocol adapter, and Informal Systems the forwarder (03e60b64); the deployed adapter tag is later. No review of the hosted transaction service, prover or indexer is listed.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration test of the backend, indexer or web app found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "evidenced",
          "value": "Vulnerability reports go to security@anoma.foundation with a promise to resolve them \"promptly\"; no per-severity patch timelines.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/anoma/pa-evm/blob/e368e2738df6a28f1b7577215da6789283952cba/README.md#L58-L63",
              "commit": "e368e2738df6a28f1b7577215da6789283952cba",
              "path": "README.md",
              "detail": "Security section of the pa-evm README.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "evidenced",
          "value": "The Foundation has breach procedures and will notify users and regulators of a personal data breach only where legally required; no time commitment.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anomapay.app/terms-and-conditions",
              "detail": "Terms, privacy section, data security.",
              "checked_at": "2026-10-09",
              "quote": "will notify you and any applicable regulator of a breach where the Foundation is legally required to do so",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "No recovery plan published. The docs say users may run the off-chain services themselves, but no code for them is public (S4 = 1).",
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page found (status.anoma.net does not resolve) and no post-mortems.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "unknown",
          "note": "Users sign in with a wallet or a passkey account (launch post); no statement on MFA.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "The SDK's TransferBackendClient, IndexerClient and EnvioClient take only a base URL in the docs; no authentication scheme is documented, and the backend code is closed.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "The terms state appropriate organisational and technical measures, with no detail; the trust model says the prover operator and Vast.ai see unencrypted witness data during proving. Observed: anomapay.app refuses TLS 1.1 and accepts TLS 1.2. No data classification.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anomapay.app/terms-and-conditions",
              "detail": "Terms, data security paragraph.",
              "checked_at": "2026-10-09",
              "quote": "The Foundation takes appropriate organizational and technical security measures",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://anomapay.app",
              "detail": "openssl s_client -tls1_1 to anomapay.app:443 failed with alert protocol version; -tls1_2 negotiated ECDHE-ECDSA-CHACHA20-POLY1305. Run 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect anomapay.app:443 -servername anomapay.app -tls1_1; echo | openssl s_client -connect anomapay.app:443 -servername anomapay.app -tls1_2"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "No fixed periods; data kept as long as needed for its purpose and legal retention duties, then destroyed. Onchain data cannot be erased.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anomapay.app/terms-and-conditions",
              "detail": "Terms, data retention paragraph.",
              "checked_at": "2026-10-09",
              "quote": "Upon expiry of the applicable retention period the Foundation will securely destroy your data",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The Foundation processes personal data under GDPR and the Swiss FADP; the terms do not use the words controller or processor for it. Recipients are named by category only. No DPIA mentioned.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anomapay.app/terms-and-conditions",
              "detail": "Terms section 6, data protection.",
              "checked_at": "2026-10-09",
              "quote": "The processing is aligned with the EU General Data Protection Regulation (GDPR) and the Federal Act on Data Protection (FADP)",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No DPA published; the terms prohibit commercial use, so no business-customer terms exist for the consumer app. The AnomaPay Business beta was not assessed.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical and integration views on docs.anoma.net (architecture overview and transaction lifecycle, trust model, protocol adapter, SDK API clients); no infrastructure view of the hosted services.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.anoma.net/anoma-pay-architecture",
              "detail": "Architecture overview and transaction lifecycle.",
              "checked_at": "2026-10-09",
              "quote": "The Transaction Service submits this object to the Protocol Adapter",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "O4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Anoma Foundation (Anoma Stiftung, CHE-264.379.335), Zug, Switzerland; Swiss law, courts of Zug. Personal, non-commercial use only under these terms.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anomapay.app/terms-and-conditions",
              "detail": "Terms sections 1 and 10.",
              "checked_at": "2026-10-09",
              "quote": "submitted to the exclusive jurisdiction of the ordinary courts of the city of Zug, Switzerland",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.zefix.ch/ZefixREST/api/v1/firm/1463475.json",
              "detail": "Zefix record.",
              "checked_at": "2026-10-09",
              "quote": "CHE-264.379.335",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Foundation-funded. The registered purpose lets the Foundation issue project tokens (XAN) and spend its assets to fund development, which it may outsource; user fees cover gas and small transfer and withdrawal fees.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.zefix.ch/ZefixREST/api/v1/firm/1463475.json",
              "detail": "Registered purpose of Anoma Stiftung (German), on project tokens and funding of development.",
              "checked_at": "2026-10-09",
              "quote": "Die Stiftung ist ermächtigt, Projekttoken für die Anoma Protokolle gegen Zahlung von FIAT-Währungen",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "absent",
          "value": "The terms have no termination clause and say nothing about funds or data on termination; the user's only remedy for changed terms is to stop using the Software. Funds stay in the forwarder; without the hosted services there is no public tooling to move them (S4 = 1).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anomapay.app/terms-and-conditions",
              "detail": "Terms version 1.0, sections 1 to 11 read in full; no termination section.",
              "checked_at": "2026-10-09",
              "quote": "If you do not agree with these Terms, please immediately cease all use of the Software.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "unknown",
          "note": "The docs say the proving service operator runs checks for KYC and AML compliance, while the terms say the Foundation does no transaction monitoring; neither says how checks work or whether AI is used. The prover code is closed.",
          "refs": [
            {
              "criterion": "C4",
              "index": 1
            },
            {
              "criterion": "C4",
              "index": 2
            }
          ],
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "Deposits free",
            "basis": "Launch post for the BNB Chain public beta; the terms say transactions are offered without fees apart from gas.",
            "evidence_index": 1
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Backend fee on transfers and withdrawals (flat + per-resource + percentage), in USDC, USDT, WETH or XAN",
            "basis": "The transaction service pays BSC gas and deducts the fee from the token sent; amounts come from backend.estimateFee and are not published. The terms describe the charge as gas, the launch post as small fees.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://anomapay.app/terms-and-conditions",
            "detail": "Terms and Conditions for AnomaPay, version 1.0, section 3.",
            "checked_at": "2026-10-09",
            "quote": "Transactions executed through AnomaPay are offered without fees.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://anoma.net/blog/the-anomapay-public-beta-is-live-on-bnb-chain",
            "detail": "Anoma blog, 2 April 2026, BNB Chain public beta.",
            "checked_at": "2026-10-09",
            "quote": "Deposits are free, with small fees for transfers and withdrawals.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.anoma.net/transfers",
            "detail": "SDK transfers page, fee estimation; estimateFee returns base_fee, base_fee_per_resource and percentage_fee in the chosen fee token.",
            "checked_at": "2026-10-09",
            "quote": "percentage of the transfer amount",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No fee amounts or gas sample recorded. Fee quotes need a built transaction posted to the backend (not done), and public BSC RPCs refuse historical log queries, so no settled transaction was sampled. Neither contract charges a fee.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Judgment call. In normal operation only a proof built from the user's keys moves tokens out of the non-upgradeable forwarder, and the terms call AnomaPay non-custodial. The S1 finding (score 0) shows that after a permanent adapter stop the same 3-of-5 signers can appoint an emergency caller who can send the forwarder's tokens anywhere. That is provider control over funds at rest, but only behind a public, irreversible stop, so hybrid rather than provider_custodial; a reviewer may prefer provider_custodial (as for Payy).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://anomapay.app/terms-and-conditions",
            "detail": "The terms describe a non-custodial wallet service by Anoma Foundation and cite no licence, SRO membership or regulator; they state the Foundation does no transaction monitoring.",
            "checked_at": "2026-10-09",
            "quote": "AnomaPay is a non-custodial wallet service.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.zefix.ch/ZefixREST/api/v1/firm/1463475.json",
            "detail": "Zefix (Swiss central business name index) entry for Anoma Stiftung, a foundation supervised by the Federal Department of Home Affairs; no financial-market authorisation is recorded there (Zefix does not record them).",
            "checked_at": "2026-10-09",
            "quote": "CHE-264.379.335",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Searched: the terms, docs.anoma.net (trust model, compliance paragraph) and the Zefix entry. Not searched: FINMA's register of authorised institutions and the Swiss SRO member lists (interactive searches). The docs say the proving service operator runs KYC/AML checks; no licence is cited for it.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "A withdrawal (burn) sends tokens to an EVM address the user names; converting them to local currency is outside the protocol. The AnomaPay Card advertised on the landing page was not assessed.",
        "burden": "institution",
        "refs": [
          {
            "criterion": "P3",
            "index": 1
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-03-05",
            "block": 84845927,
            "what": "Protocol Adapter v1.1.0 0xFC44…2B68 on BNB Smart Chain, tx 0x3c145e76…93c7 from 0xcD56…Db7b; the ERC20 forwarder 0xDe6A…840e followed on 2026-03-06 (block 85055504)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68?fields=deployment",
              "address": "0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
              "block_number": 84845927,
              "detail": "Sourcify creation data gives tx 0x3c145e76e65329f6152b20b6ea76158c34c5cd318759c727088e145bee2f93c7 in block 84845927 (2026-03-05 16:06:13 UTC per the block header); for the forwarder, tx 0x0d97fadbf2da722aa6327b38f66a547af0fe75d2a744721c5b0402a20154dc2d in block 85055504 (2026-03-06 18:18:18 UTC).",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://sourcify.dev/server/v2/contract/56/0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68?fields=deployment\" && cast block 84845927 --field timestamp --rpc-url https://bsc-dataseed.bnbchain.org"
            }
          ],
          "note": "The public beta opened on BNB Chain on 2026-04-02.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Anoma Stiftung (Anoma Foundation)",
            "jurisdiction": "CH-ZG",
            "register_url": "https://www.zefix.ch/en/search/entity/list/firm/1463475",
            "registration_number": "CHE-264.379.335"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.zefix.ch/ZefixREST/api/v1/firm/1463475.json",
              "detail": "Zefix record for Anoma Stiftung, seat Zug, status existing, foundation under federal supervision; seat address Dammstrasse 16, Zug since the publication of 2026-05-11.",
              "checked_at": "2026-10-09",
              "quote": "CHE-264.379.335",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anomapay.app/terms-and-conditions",
              "detail": "The terms name Anoma Foundation in Zug as the counterparty.",
              "checked_at": "2026-10-09",
              "quote": "Anoma Foundation, Gotthardstrasse 26, 6300 Zug, Switzerland",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The terms still give the earlier address (Gotthardstrasse 26); the register moved the seat address to Dammstrasse 16 in May 2026. The 2025 announcement says AnomaPay is developed by Heliax; the operating counterparty in the terms is the Foundation.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/security-advisories",
              "detail": "No published security advisories for anoma/pa-evm (anoma/anomapay-erc20-forwarder also has none).",
              "checked_at": "2026-10-09",
              "recheck": "for r in pa-evm anomapay-erc20-forwarder; do gh api repos/anoma/$r/security-advisories --jq length; done"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
              "address": "0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68",
              "block_number": 126642563,
              "detail": "isEmergencyStopped() is false on the adapter and getEmergencyCaller() is zero on the forwarder at block 126642563, so the emergency path has never been used.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68 \"isEmergencyStopped()(bool)\" --rpc-url https://bsc-rpc.publicnode.com",
              "check": {
                "call": "0xfddd4837",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Also searched the Anoma blog index and docs; no incident or post-mortem found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-01-27",
              "summary": "pa-evm contracts/v1.1.0 released, the version deployed on BSC (after the audited commits of Oct-Nov 2025).",
              "url": "https://github.com/anoma/pa-evm/releases/tag/contracts/v1.1.0"
            },
            {
              "date": "2026-03-05",
              "summary": "Protocol Adapter v1.1.0 deployed on BSC; ERC20 forwarder v1.0.1 deployed the next day.",
              "url": "https://sourcify.dev/server/v2/contract/56/0xFC44b66a39fe6923Ad8d3c93bFeC369728862B68?fields=deployment"
            },
            {
              "date": "2026-04-02",
              "summary": "AnomaPay public beta opens on BNB Chain.",
              "url": "https://anoma.net/blog/the-anomapay-public-beta-is-live-on-bnb-chain"
            },
            {
              "date": "2026-06-02",
              "summary": "AnomaPay V1 out of beta on BNB Chain and Ethereum.",
              "url": "https://anoma.net/blog/anomapay-v1-is-live"
            },
            {
              "date": "2026-08-24",
              "summary": "First pa-evm contracts/v2.0.0 release candidate; rc.9 on 2026-10-09. Not deployed on BSC.",
              "url": "https://github.com/anoma/pa-evm/releases/tag/contracts/v2.0.0-rc.0"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/anoma/pa-evm/releases",
              "detail": "Release list with publication dates (contracts/v1.1.0 2026-01-27; contracts/v2.0.0-rc.0 2026-08-24 to rc.9 2026-10-09).",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/anoma/pa-evm/releases --jq '.[] | [.tag_name, .published_at] | @tsv'"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://anoma.net/blog/anomapay-v1-is-live",
              "detail": "Anoma blog, 2 June 2026.",
              "checked_at": "2026-10-09",
              "quote": "AnomaPay is now officially out of beta and open to the world on BNB Chain and Ethereum.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Neither contract is upgradeable, so no onchain upgrade events exist; the v2 contracts would be a new deployment.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 56,
          "addresses": [
            "0xDe6A308ed57AF26BFf059e6C550BD4908aC1840e"
          ],
          "topic0": "0x913c7ddda7bb2ef1a6490bd8ca12ced1ae8d832e1f6ed559b4766af855a5ea26",
          "event": "Unwrapped(address indexed token, address indexed to, uint128 amount)",
          "window_days": 30,
          "exclusions": "Counts withdrawals (burns to an EVM address) only. The token is an indexed topic, which the volume script cannot read, so no amount is summed (USDC, USDT, WETH and XAN would mix). Shielded transfers inside the pool emit only encrypted payloads and are not observable; Wrapped (deposits) excluded."
        },
        "note": "Not computed; BSC log ranges need an archive RPC (RPC_56). A token_topic option in scripts/volumes.mjs would allow per-token sums.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: no blocks-per-day estimate for chain 56"
      },
      "notes": "Transfer protocol whose required proving backend, indexer and Envio endpoint are closed, so all operator controls apply; custody is recorded as hybrid, so custodial controls apply too. The Foundation is the counterparty in the terms. The AnomaPay Card and Business beta were not assessed. Bot facts (B2.1, B2.3, B8.2, B9.x) untouched."
    },
    "avalanche-card": {
      "slug": "avalanche-card",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found. Rain's security page lists SOC 2 Type II and PCI DSS only; avalanchecard.com has no security page. Rain Liquidity LLC, which offers the card and runs the app, is itself a Rain entity (Avalanche Card privacy policy), so Rain's security page is the operator's own position.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No ISO 27001 statement for the hosting or support organisation. Rain's status page attributes two outages (2025-06-12, 2025-10-20) to Google Cloud, which suggests but does not establish the host.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "attested",
          "value": "Rain (Signify Holdings, Inc. and affiliates, including Rain Liquidity LLC) states it holds SOC 2 Type II and PCI DSS; the SOC 2 report is available to partners and prospective partners on request through its trust center. A cardholder cannot obtain it; not read.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page (Signify Holdings, Inc.), section \"Security reports and policies\"; the trust center at trust.rain.xyz is a client-rendered Vanta page and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Partners and prospective partners can request our SOC 2 report, PCI DSS attestation, penetration test summary, and security policies through our trust center",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "Rain privacy policy (last updated 16 July 2026), Security section.",
              "checked_at": "2026-10-09",
              "quote": "Rain maintains SOC 2 Type II certification",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "attested",
          "value": "Rain states its smart contracts are reviewed by independent auditors before launch and for each new chain; no report is linked, and the Avalanche Card collateral contract is not identified (CROPS S6 unknown). No statement covers the app or backend.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Smart contract audits\"; no report is linked from the page.",
              "checked_at": "2026-10-09",
              "quote": "Our smart contracts are reviewed by independent auditors before launch and again for each new chain we support",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "attested",
          "value": "Rain says a penetration test summary is available to partners through its trust center; no date or tester is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page (Signify Holdings, Inc.), section \"Security reports and policies\"; the trust center at trust.rain.xyz is a client-rendered Vanta page and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Partners and prospective partners can request our SOC 2 report, PCI DSS attestation, penetration test summary, and security policies through our trust center",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "evidenced",
          "value": "Code is peer-reviewed and automatically scanned before production; the privacy policy mentions internal security testing and regular security assessments. No cadence or tool for platform scanning is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Secure development\".",
              "checked_at": "2026-10-09",
              "quote": "Code is peer-reviewed and automatically scanned for vulnerabilities before it reaches production",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No patch timelines found in the Rain security page, the Avalanche Card legal hub or the privacy policy.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "evidenced",
          "value": "Rain states a documented incident response plan that includes keeping partners informed; no notification time is committed, and nothing addresses cardholders directly beyond the GLBA notice.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Detection and response\".",
              "checked_at": "2026-10-09",
              "quote": "Security events are monitored centrally, and a documented incident response plan guides how we act and keep partners informed",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "Rain mentions an incident response plan (B3.1) but no recovery or continuity plan was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Rain runs a public status page (status.rain.xyz) with component status and incident history covering card authorizations and collateral; incident notes state a one-line cause at most and no post-mortem was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/",
              "detail": "Rain Platform Status (cState), with components for onboarding, API, card issuing, authorizations, disputes and collateral, and a paged incident history back to 2025.",
              "checked_at": "2026-10-09",
              "quote": "We continuously monitor the performance and availability of our services",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/",
              "detail": "Read the incident pages listed on status.rain.xyz pages 1 to 3 (2025-06-12 to 2026-09-28) on 2026-10-09. Updates give a one-line cause at most (partner OS patching, payment processor, expired certificate, processor rules engine); the 2026-09-28 incident says the root cause is still being investigated, and no post-mortem is linked from any incident.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/ | grep -i \"root cause\""
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "unknown",
          "note": "The site describes wallet-based authentication with iCloud backup or PIN-based recovery; no multi-factor login for cardholders is described.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "note": "Rain states signing keys are held in managed key storage with tightly controlled access; nothing on MFA or separate accounts for privileged staff.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "note": "Access reviews may be covered by Rain's SOC 2 Type II report, available to partners only (B1.3); not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "No cardholder-facing API. Rain's API documentation (docs.rain.xyz) redirects to a login page.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "note": "Rain's status page lists API keys under its Core API; the API reference is behind a login.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Encryption of sensitive data in transit and at rest, access controls, MFA and tokenization of card data, with PCI DSS for card data (privacy policy, \"may include\"). Observed: avalanchecard.com refuses TLS 1.1 and accepts TLS 1.2. No data classification stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "Rain privacy policy, Security section: encryption in transit and at rest, access controls, multifactor authentication, tokenization, PCI DSS for card data.",
              "checked_at": "2026-10-09",
              "quote": "encryption of sensitive data in transit and at rest",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://www.avalanchecard.com",
              "detail": "openssl s_client -tls1_1 to www.avalanchecard.com:443 failed with alert protocol version; -tls1_2 negotiated an ECDHE cipher. Run 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect www.avalanchecard.com:443 -servername www.avalanchecard.com -tls1_1; echo | openssl s_client -connect www.avalanchecard.com:443 -servername www.avalanchecard.com -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Kept as long as necessary; customer identification and transaction records five years or longer after account closure where law requires; biometric data destroyed within three years of last interaction where biometric law applies; blockchain data cannot be deleted. See CROPS P2 for what is collected.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "Rain privacy policy, Retention section.",
              "checked_at": "2026-10-09",
              "quote": "Customer identification records, transaction records, and related regulated financial services records may be retained for five years or longer following account closure",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Rain Liquidity LLC is controller for Avalanche Card services; Nimbus LLC (Third National) is controller for card issuance; Rain entities may act as independent or joint controllers or processors between themselves. No DPIA statement; an EU data protection contact is named.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "Avalanche Card (Rain) privacy policy, Entity Roles and Data Flows.",
              "checked_at": "2026-10-09",
              "quote": "For Avalanche Card services, Rain Liquidity LLC generally acts as the controller or business for the personal information described in this Privacy Policy",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "Rain privacy policy, Entity Roles and Data Flows: Nimbus LLC d/b/a Third National is controller for card issuance.",
              "checked_at": "2026-10-09",
              "quote": "For card issuance and customer account services, Nimbus LLC generally acts as a controller",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No published data processing agreement; Rain's trust center (partner access) may hold one.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "evidenced",
          "value": "Rain states security events are monitored centrally and onchain activity is monitored in real time by an in-house team; no SIEM product or endpoint detection is named.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Detection and response\".",
              "checked_at": "2026-10-09",
              "quote": "Security events are monitored centrally, and a documented incident response plan guides how we act and keep partners informed",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "unknown",
          "note": "No architecture document. The app terms and card agreements describe the collateral, oracle and liquidation flow in prose only; Rain's developer docs are behind a login.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Rain Liquidity LLC (app and services; Montana governing law; mailing address in Billings, Montana) and, for the card, the issuer Third National (Nimbus LLC, a Rain affiliate) under Puerto Rico law. The card agreements are three-party between the cardholder, Rain Liquidity and the issuer.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-terms-conditions-4b62a44e",
              "detail": "Avalanche App Terms & Conditions (last updated 26 February 2025), opening paragraph; section 17 Governing Law (Montana).",
              "checked_at": "2026-10-09",
              "quote": "We are Rain Liquidity LLC",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
              "detail": "International card agreement, section 15 Governing Law.",
              "checked_at": "2026-10-09",
              "quote": "These Card Terms will be interpreted in accordance with the laws of Puerto Rico",
              "archive": "data/archive/avalanche-card-ops-international-card-agreement.txt",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Only fee revenue is documented (FX fee on non-USD spend; penalty fees in the agreements). No statement of how Rain Liquidity or the Avalanche Card programme is funded and no financial statements were found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.avalanchecard.com/",
              "detail": "Avalanche Card site FAQ \"Are there any fees when using my card?\".",
              "checked_at": "2026-10-09",
              "quote": "FX Fees: 1% Monthly Account Fee: $0",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Rain Liquidity and the issuer may suspend, revoke or cancel the card or deny any transaction at any time, with or without cause or notice; Rain Liquidity may terminate app access or delete the account without warning. The app terms say a suspended user can still export the wallet or withdraw via a block explorer; collateral can be liquidated for unpaid charges. Records are kept five years or longer after closure (B6.3).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
              "detail": "International card agreement, section 10 Termination.",
              "checked_at": "2026-10-09",
              "quote": "in our sole discretion at any time, with or without cause and with or without giving you notice",
              "archive": "data/archive/avalanche-card-ops-international-card-agreement.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-terms-conditions-4b62a44e",
              "detail": "Avalanche App Terms & Conditions, wallet section.",
              "checked_at": "2026-10-09",
              "quote": "you can utilize tokens by exporting your wallet or withdrawing funds via the block explorer on the applicable blockchain",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Yes: Rain uses automated systems for fraud detection, sanctions screening, transaction monitoring, identity verification, biometric matching, eligibility and risk management. Whether these include machine learning is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "Rain privacy policy, Automated Processing and Decision-Making.",
              "checked_at": "2026-10-09",
              "quote": "We may use automated systems to support fraud detection, sanctions screening, transaction monitoring, identity verification, biometric matching, eligibility assessments, and risk management",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "Only an override path: where law grants it, users may request information, human review and contest a decision. Rain's AI and Data Use Exhibit sets standards for vendors' AI use, not for Rain's own systems. No monitoring, validation, decommissioning or bias documentation found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "Rain privacy policy, Automated Processing and Decision-Making: available where applicable law grants the right.",
              "checked_at": "2026-10-09",
              "quote": "request human review, express your point of view, and contest the decision",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "none",
            "amount": "Monthly account fee, virtual card, physical card and shipping: $0",
            "basis": "Site FAQ; card agreements allow fees to change.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "1% FX fee (site FAQ)",
            "basis": "Site FAQ. The same FAQ also says no conversion fees are charged; contradiction recorded in note.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "International card: FX fee up to 3% plus cross-border fee up to 3% (non-USD)",
            "basis": "International card agreement Important Disclosures, effective 12 February 2025.",
            "evidence_index": 1
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "US card: international transaction fee 2% of each transaction",
            "basis": "US card agreement account opening disclosures (last updated 5 February 2025).",
            "evidence_index": 2
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "International: late payment up to $40, returned payment up to $29; US: late payment up to 2% of the outstanding balance",
            "basis": "Card agreements, penalty fees; balances are settled from collateral and can trigger liquidation.",
            "evidence_index": 1
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Network gas may be paid by the user; Avalanche Card charges no gas fee itself",
            "basis": "Site FAQ footnote.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.avalanchecard.com/",
            "detail": "Avalanche Card site FAQ \"Are there any fees when using my card?\"; the \"What is the Avalanche Card\" answer says no gas or conversion fees are charged by Avalanche Card.",
            "checked_at": "2026-10-09",
            "quote": "FX Fees: 1% Monthly Account Fee: $0 Virtual Card Issuance: $0 Physical Card: $0 Card Shipping: $0",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
            "detail": "International card agreement (Rain Liquidity / Third National), Important Disclosures; penalty fees late payment up to $40, returned payment up to $29.",
            "checked_at": "2026-10-09",
            "quote": "Foreign Exchange Fee (non USD): up to 3% - Cross Border Fee: up to 3%",
            "archive": "data/archive/avalanche-card-ops-international-card-agreement.txt",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.avalanchecard.com/legal/avalanche-card-us-card-agreement-bcc089aa",
            "detail": "US card agreement account opening disclosures: no annual fee, cash advance none, international transaction 2%, late payment up to 2% of the outstanding balance.",
            "checked_at": "2026-10-09",
            "quote": "International Transaction N/A None 2% of each transaction in U.S. dollars",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The site FAQ (1% FX) and the agreements (up to 3% + 3% international; 2% US) disagree; the agreements are maxima and binding, the FAQ states current charges. The FAQ's \"no conversion fees\" line contradicts its own 1% FX line. No ATM fee is listed because no ATM access is documented (see cashout).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "unknown",
        "note": "CROPS S1 is unknown for this provider: no collateral contract can be tied to the card. The card agreement says Rain Liquidity and the issuer never hold custody of collateral, but they can liquidate it; the site says assets are owned and custodied by the user. These claims are unverified, so no custody model is recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "attested",
        "value": [
          {
            "entity": "Nimbus LLC d/b/a Third National",
            "holder": "partner",
            "country": "US",
            "regulator": "Not named in any document",
            "type": "Licensed lender and money transmitter; Visa-authorized card issuer (as stated by Rain)",
            "activities": "Card issuance, payment and settlement for the Avalanche Card (issuer named in both card agreements).",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
            "detail": "Avalanche Card privacy policy (the consolidated Rain policy, last updated 16 July 2026), Entity Roles and Data Flows; the change log adds \"licensed money transmission\" to Third National's scope on 11 July 2026. No regulator, state or licence number is given.",
            "checked_at": "2026-10-09",
            "quote": "is a licensed lender, money transmitter and Visa-authorized card issuer",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "trace",
            "url": "https://api.fdic.gov/banks/institutions?search=NAME:%22Third%20National%22&fields=NAME,CERT,ACTIVE,CITY,STNAME&limit=20",
            "detail": "FDIC BankFind institutions API, run 2026-10-09: the closest matches for \"Third National\" are other banks (Fifth Third Bank, N.A. and inactive banks); a search for NAME:Nimbus with ACTIVE:1 returns 0 institutions. NMLS Consumer Access returned HTTP 403 to a scripted request and was not bypassed; the Puerto Rico OCIF licence check (concesionarios.ocif.pr.gov) failed the TLS handshake.",
            "checked_at": "2026-10-09",
            "recheck": "curl -s 'https://api.fdic.gov/banks/institutions?search=NAME:Nimbus&filters=ACTIVE:1&fields=NAME,CERT' | grep -o '\"total\":[0-9]*'"
          }
        ],
        "note": "Attested only: Rain describes Third National as Nimbus LLC, a licensed lender and money transmitter, but no register entry was found. FDIC BankFind lists no institution named Third National or Nimbus, so it is not an FDIC-insured bank; the card agreements are governed by Puerto Rico law, but the OCIF licence check could not be reached; NMLS Consumer Access blocked scripted access. The site footer says only that the card is \"issued by partners licensed in their respective jurisdictions\". Rain Liquidity LLC states it is not a bank; no licence is claimed for it.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Third National (Nimbus LLC, Rain affiliate) as issuer, Rain Liquidity, Visa",
            "fee": "1% FX per site FAQ; agreements allow up to 3% + 3% (international) or 2% (US) on non-USD",
            "limits": "Spending power set by Rain Liquidity against collateral (USDC, USDT, AVAX, WAVAX per site); limits can be changed at any time.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
            "detail": "International card agreement, Defined Terms.",
            "checked_at": "2026-10-09",
            "quote": "The issuer for this card program is Third National.",
            "archive": "data/archive/avalanche-card-ops-international-card-agreement.txt",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
            "detail": "International card agreement, section 5 Purchases & Restrictions.",
            "checked_at": "2026-10-09",
            "quote": "Cash advances and balance transfers are not available under these Card Terms",
            "archive": "data/archive/avalanche-card-ops-international-card-agreement.txt",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.avalanchecard.com/legal/avalanche-card-us-card-agreement-bcc089aa",
            "detail": "US card agreement: ATM use is treated as a cash advance, only if enabled.",
            "checked_at": "2026-10-09",
            "quote": "With a PIN, you may, if enabled by us, use your Card to obtain cash from certain automated teller machines",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No ATM row: the international agreement excludes cash advances, and the US agreement allows ATM cash only \"if enabled\", with no ATM fee in its disclosures and no statement that it is enabled. No bank off-ramp is documented on avalanchecard.com or in the legal hub; the wallet holds crypto that can be withdrawn onchain, which is not a cash-out.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2025-02-12",
            "what": "International card agreement disclosures effective; earliest dated first-party document for the card"
          },
          "note": "The US card agreement was last updated on 2025-02-05 and gives no effective date. No dated launch announcement was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945",
              "detail": "International card agreement, Important Disclosures header.",
              "checked_at": "2026-10-09",
              "quote": "Effective as of 2/12/25",
              "archive": "data/archive/avalanche-card-ops-international-card-agreement.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-card-us-card-agreement-bcc089aa",
              "detail": "US card agreement header.",
              "checked_at": "2026-10-09",
              "quote": "Last Updated: February 5, 2025",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Rain Liquidity LLC",
            "jurisdiction": "US"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-terms-conditions-4b62a44e",
              "detail": "Avalanche App Terms & Conditions; governing law Montana; card services mailing address in Billings, Montana (US card agreement).",
              "checked_at": "2026-10-09",
              "quote": "We are Rain Liquidity LLC",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "State of formation is not stated in any document and no company register entry was found (Montana and Delaware business searches are interactive web apps), so only the country is recorded and there is no register_url. Rain Liquidity LLC is a subsidiary or affiliate of Signify Holdings, Inc. (Rain) per the privacy policy.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-09-28",
              "summary": "Rain platform: unexpected card declines and API issues for some partners, 18:53 to 19:35 UTC; root cause still under investigation. Rain-wide; which programmes were affected is not stated.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/"
            },
            {
              "date": "2026-06-25",
              "summary": "Rain platform: elevated API error rates for 3h32m, caused by an expired encryption certificate.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-06-25-elevated-api-error-rate/"
            },
            {
              "date": "2026-06-03",
              "summary": "Rain platform: partial outage affecting card authorizations for 9 minutes, attributed to operating-system patching at a partner.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-06-03-payments-partner-outage/"
            },
            {
              "date": "2026-05-05",
              "summary": "Rain platform: elevated card declines for 3h10m from a partial outage at its payment processor.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-05-05-elevated-authorization-declines/"
            },
            {
              "date": "2026-01-02",
              "summary": "Rain platform: elevated card declines for 1h15m from an incident in the processor rules engine; Rain stated funds were safe.",
              "funds_lost": "no",
              "url": "https://status.rain.xyz/issues/2026-01-02-payementology-rules-declines/"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/",
              "detail": "Rain status incident 2026-09-28.",
              "checked_at": "2026-10-09",
              "quote": "We are investigating an issue that is causing unexpected declines for transactions",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-06-25-elevated-api-error-rate/",
              "detail": "Rain status incident 2026-06-25.",
              "checked_at": "2026-10-09",
              "quote": "The issue was caused by an expired encryption certificate",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-06-03-payments-partner-outage/",
              "detail": "Rain status incident 2026-06-03.",
              "checked_at": "2026-10-09",
              "quote": "Our partner has identified the cause as operating system patching activity on their side",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-05-05-elevated-authorization-declines/",
              "detail": "Rain status incident 2026-05-05.",
              "checked_at": "2026-10-09",
              "quote": "The incident was related to our payment processor and has been mitigated",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-01-02-payementology-rules-declines/",
              "detail": "Rain status incident 2026-01-02.",
              "checked_at": "2026-10-09",
              "quote": "Funds are safe and Rain infrastructure is working as intended",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No Avalanche Card-specific incident report was found on avalanchecard.com or its legal hub. The entries are Rain platform incidents from Rain's status page (Rain Liquidity, the operator, is a Rain entity); the pages do not say which card programmes were affected. Planned maintenance and earlier incidents (Google Cloud outages 2025-06-12 and 2025-10-20, webhook latency) are not listed.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-02-05",
              "summary": "US card agreement last updated (issuer Third National; 2% international transaction fee).",
              "url": "https://legal.avalanchecard.com/legal/avalanche-card-us-card-agreement-bcc089aa"
            },
            {
              "date": "2025-02-12",
              "summary": "International card agreement Important Disclosures effective (FX up to 3%, cross-border up to 3%).",
              "url": "https://legal.avalanchecard.com/legal/avalanche-card-international-card-agreement-94211945"
            },
            {
              "date": "2025-02-26",
              "summary": "Avalanche App Terms & Conditions last updated (Rain Liquidity LLC, Montana law).",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-terms-conditions-4b62a44e"
            },
            {
              "date": "2026-05-13",
              "summary": "Consolidated Rain privacy policy adopted, covering Avalanche Card services (change log: initial policy consolidation).",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7"
            },
            {
              "date": "2026-07-11",
              "summary": "Privacy policy revised: biometric retention cut from 5 to 3 years; licensed money transmission added to Third National's scope; EU representative identified.",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7"
            },
            {
              "date": "2026-07-16",
              "summary": "Privacy policy last updated.",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-privacy-policy-945fafe7",
              "detail": "Privacy policy change log (entries 13 May and 11 July 2026; header last updated 16 July 2026).",
              "checked_at": "2026-10-09",
              "quote": "change of biometric data retention period from 5 to 3 years",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.avalanchecard.com/legal/avalanche-app-terms-conditions-4b62a44e",
              "detail": "App terms header.",
              "checked_at": "2026-10-09",
              "quote": "Last updated 2-26-25",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "Incumbent: the provider file lists no contracts, so there is nothing a volume spec could be computed over; card settlement runs offchain through the issuer and Visa.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "notes": "Incumbent card offered by Rain Liquidity LLC (a Rain entity) and issued by Third National (Nimbus LLC, a Rain affiliate). All operator and custodial controls fall on Rain Liquidity and its Rain affiliates; Rain's security page (rain.xyz/security) and status page are therefore cited as the operator's own position. Reports Rain makes available only to partners (SOC 2, PCI DSS, penetration test summary) are recorded as attested. No repository facts apply (no public code)."
    },
    "avici-card": {
      "slug": "avici-card",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No security page, trust centre or ISO 27001 statement on avici.money (pages: home, tos, tosavicicard, privacypolicy) or docs.avici.money. Rain lists SOC 2 Type II and PCI DSS, not ISO 27001.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "attested",
          "value": "Avici states nothing. Issuer group (Rain): SOC 2 Type II and PCI DSS, reports available to partners on request through its trust center; not read.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page (Signify Holdings, Inc.), section \"Security reports and policies\"; the trust center at trust.rain.xyz is a client-rendered Vanta page and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Partners and prospective partners can request our SOC 2 report, PCI DSS attestation, penetration test summary, and security policies through our trust center",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy (last updated 16 July 2026), Security section.",
              "checked_at": "2026-10-09",
              "quote": "Rain maintains SOC 2 Type II certification",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers \"every card program\", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No audit report for the card loan-escrow contract, whose chain and address are not disclosed (CROPS S6 unknown). Rain says its own contracts are audited, but the escrow is described as created by Avici and is not shown to be Rain's.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "attested",
          "value": "Avici states nothing. Issuer group (Rain): a penetration test summary is available to partners through its trust center; it covers Rain, not the Avici app or backend.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page (Signify Holdings, Inc.), section \"Security reports and policies\"; the trust center at trust.rain.xyz is a client-rendered Vanta page and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Partners and prospective partners can request our SOC 2 report, PCI DSS attestation, penetration test summary, and security policies through our trust center",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers \"every card program\", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "evidenced",
          "value": "Avici states nothing. Issuer group (Rain): code is peer-reviewed and automatically scanned before production; no cadence stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Secure development\".",
              "checked_at": "2026-10-09",
              "quote": "Code is peer-reviewed and automatically scanned for vulnerabilities before it reaches production",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers \"every card program\", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No patch timelines from Avici or Rain.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "evidenced",
          "value": "Avici makes no incident-notification commitment in its terms or privacy policy. Issuer group (Rain): a documented incident response plan that keeps partners informed; no time stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Detection and response\".",
              "checked_at": "2026-10-09",
              "quote": "Security events are monitored centrally, and a documented incident response plan guides how we act and keep partners informed",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers \"every card program\", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Avici publishes no status page. Issuer group (Rain): status.rain.xyz with incident history; no post-mortems found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/",
              "detail": "Rain Platform Status (cState), with components for onboarding, API, card issuing, authorizations, disputes and collateral, and a paged incident history back to 2025.",
              "checked_at": "2026-10-09",
              "quote": "We continuously monitor the performance and availability of our services",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/",
              "detail": "Read the incident pages listed on status.rain.xyz pages 1 to 3 (2025-06-12 to 2026-09-28) on 2026-10-09. Updates give a one-line cause at most (partner OS patching, payment processor, expired certificate, processor rules engine); the 2026-09-28 incident says the root cause is still being investigated, and no post-mortem is linked from any incident.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/ | grep -i \"root cause\""
            }
          ],
          "note": "Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers \"every card program\", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Wallet withdrawals require a biometric passkey; MCP sign-in uses email and a one-time code. No separate second factor for app login is described.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.avici.money/getting-started/avici-wallet/withdraw-funds.md",
              "detail": "Avici docs, Withdraw funds.",
              "checked_at": "2026-10-09",
              "quote": "you will be prompted to verify the transaction using your biometric passkey",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "Avici's read-only MCP connector authenticates through a browser-based OAuth flow with email and a one-time code; the CLI signs in by QR approval in the mobile app and stores a session locally. No payment API is offered to customers.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.avici.money/getting-started/avici-cli-and-mcp/faqs.md",
              "detail": "Avici CLI & MCP FAQ, question 13.",
              "checked_at": "2026-10-09",
              "quote": "MCP authentication happens through a browser-based OAuth flow, which uses your Avici email and a one-time code",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "note": "The CLI and MCP FAQ says logins expire and must be renewed, without stating a period.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "note": "The CLI and MCP are read-only (balances, card details, transactions); no export limits or export logging are described.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Avici: administrative, technical and physical safeguards, limited access, connected-service tokens stored encrypted; no data classification or encryption-at-rest statement for other data. Issuer group (Rain): encryption in transit and at rest, PCI DSS for card data. Observed: avici.money refuses TLS 1.1 and accepts TLS 1.2.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/privacypolicy",
              "detail": "Avici privacy policy (last updated 7 October 2026), Security.",
              "checked_at": "2026-10-09",
              "quote": "Access tokens for connected services are stored encrypted",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Security section: encryption in transit and at rest, access controls, multifactor authentication, tokenization, PCI DSS for card data.",
              "checked_at": "2026-10-09",
              "quote": "encryption of sensitive data in transit and at rest",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://avici.money",
              "detail": "openssl s_client -tls1_1 to avici.money:443 failed with alert protocol version; -tls1_2 negotiated an ECDHE cipher. Run 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect avici.money:443 -servername avici.money -tls1_1; echo | openssl s_client -connect avici.money:443 -servername avici.money -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "KYC and AML records held by the verification provider for the relationship plus the legal period, typically five years; transaction and card records as financial regulation requires; Avi notes and connected-service tokens until deleted; data deleted or anonymised when no longer needed; account deletion available in the app subject to legal holds.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/privacypolicy",
              "detail": "Avici privacy policy, Data Retention.",
              "checked_at": "2026-10-09",
              "quote": "for the period required by applicable law after it ends, typically five years",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Avici Inc (Delaware) is responsible for the personal data in its policy; the verification provider collects identity data directly and holds it under its own notice. Controller and processor roles are not named as such; no DPIA statement.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/privacypolicy",
              "detail": "Avici privacy policy, Who We Are.",
              "checked_at": "2026-10-09",
              "quote": "Avici Inc is responsible for the personal data described in this policy",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No data processing agreement published.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "evidenced",
          "value": "Avici states nothing. Issuer group (Rain): security events monitored centrally; no SIEM product or endpoint detection named.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Detection and response\".",
              "checked_at": "2026-10-09",
              "quote": "Security events are monitored centrally, and a documented incident response plan guides how we act and keep partners informed",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers \"every card program\", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical view only: the docs describe the card flow (USDC into a loan-escrow contract, USD credit on the card, Avici \"spend attestation\" charges, liquidation every 1 to 7 days to settle with Visa). No infrastructure or integration architecture, and no chain or contract address.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.avici.money/getting-started/secured-credit-cards.md",
              "detail": "Avici docs, Secured Credit Cards, \"This is how the contract works\".",
              "checked_at": "2026-10-09",
              "quote": "we put a “charge” using the spend attestation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Avici Inc, a Delaware corporation (651 N Broad St, Suite 201, Middletown, Delaware), under Delaware law for the Terms of Use; the card terms are three-party between the user, Avici Inc and the issuer Third National, under Puerto Rico law.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tos",
              "detail": "Avici Terms of Use (last updated 25 June 2026), Contact.",
              "checked_at": "2026-10-09",
              "quote": "651 N Broad St, Suite 201 Middletown, Delaware 19709",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tosavicicard",
              "detail": "Avici Spend Card Terms, Governing Law.",
              "checked_at": "2026-10-09",
              "quote": "These Card Terms will be interpreted in accordance with the laws of Puerto Rico",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Customer fees: card purchase and annual fees, ATM fees on Platinum cards, a $35 dispute fee, wire and SWIFT fees on virtual accounts; the Terms list cards, Credit Mode, Grow, Privacy Send and Avici Biz as paid features. No financial statements or funding statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tos",
              "detail": "Avici Terms of Use, opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "including paid features such as Avici cards, Credit Mode, Avici Grow, Privacy Send, or Avici Biz",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Avici may terminate, restrict or pause use at its discretion, including for compliance, fraud or risk reasons; Avici and the issuer may cancel the card at any time with or without cause or notice. Wallet funds stay in the self-custody wallet (Avici's claim); funds in the card escrow are subject to liquidation for outstanding charges. Account deletion is available, subject to legal retention (B6.3).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tos",
              "detail": "Avici Terms of Use, section 20 Termination.",
              "checked_at": "2026-10-09",
              "quote": "We may terminate, restrict, or pause your use of the Site or services at our discretion",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tosavicicard",
              "detail": "Avici Spend Card Terms, Termination.",
              "checked_at": "2026-10-09",
              "quote": "with or without cause and with or without giving you notice",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Partly. Avici's AI assistant Avi and the CLI/MCP are read-only and cannot move money, so they are not in the payment path. Card compliance runs through Sumsub ongoing AML monitoring (Avici docs) and, at the issuer group, Rain's automated fraud, sanctions and transaction-monitoring systems; whether either uses machine learning is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.avici.money/getting-started/avici-cli-and-mcp.md",
              "detail": "Avici docs, CLI & MCP.",
              "checked_at": "2026-10-09",
              "quote": "All current Avici CLI and MCP capabilities are read-only",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Automated Processing and Decision-Making.",
              "checked_at": "2026-10-09",
              "quote": "We may use automated systems to support fraud detection, sanctions screening, transaction monitoring, identity verification, biometric matching, eligibility assessments, and risk management",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Avici's documents name only the issuer, Third National; Rain's privacy policy identifies Third National as Nimbus LLC, a Rain affiliate, and Rain's security page covers \"every card program\", so Rain's statements are recorded as the issuer group's position (inferred link; Avici does not name Rain).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "For Avi, the privacy policy limits model providers to those that do not train on user content and keep data briefly or not at all. For compliance decisions only Rain's override path is documented (human review where law grants it). No monitoring, validation, decommissioning or bias documentation.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/privacypolicy",
              "detail": "Avici privacy policy, How we use AI.",
              "checked_at": "2026-10-09",
              "quote": "We work only with providers whose terms do not allow your content to be used to train their models",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Automated Processing and Decision-Making: available where applicable law grants the right.",
              "checked_at": "2026-10-09",
              "quote": "request human review, express your point of view, and contest the decision",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Virtual Platinum $15 first card, $10 each further card; virtual Signature $30 first year then $20/year",
            "basis": "Docs Fees and Limits; card orders paid in-app.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Physical Platinum $50 one-time; physical Signature $75 plus $20/year from year two",
            "basis": "Docs Fees and Limits; priority delivery adds $50 international or $15 US.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "FX up to 3% (currently 1%, by Visa); cross-border up to 3% (currently 0%); no Avici markup",
            "basis": "Avici Spend Card Terms Important Disclosures (maxima); the docs say Visa may charge 0.4-1% on non-USD.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM: Platinum $1 + 0.65%, declined or balance inquiry $0.60; Signature $0",
            "basis": "Docs Fees and Limits, ATM table.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Dispute fee $35, non-refundable, disputes only above $30",
            "basis": "Docs card FAQ.",
            "evidence_index": 2
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Late payment up to $40, returned payment up to $29 (card terms maxima)",
            "basis": "Avici Spend Card Terms Important Disclosures; the docs FAQ says there are no late penalties because spends auto-deduct.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Virtual account payout: ACH $0, wire $15, SEPA EUR 0, SWIFT $25; minimum transfer $2",
            "basis": "Docs Virtual Accounts Fees and Limits.",
            "evidence_index": 3
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.avici.money/getting-started/secured-credit-cards/fees-and-limits.md",
            "detail": "Avici docs, Secured Credit Cards, Fees and Limits (card purchase fees, transaction and forex fees, ATM table).",
            "checked_at": "2026-10-09",
            "quote": "First card costs $15. Subsequent cards: $10 one-time fee, no recurring charges.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://avici.money/tosavicicard",
            "detail": "Avici Spend Card Terms (last updated 20 June 2025), Important Disclosures effective 5 December 2024: maxima, cross-border up to 3% currently 0%, late payment up to $40, returned payment up to $29.",
            "checked_at": "2026-10-09",
            "quote": "Foreign Exchange Fee (non USD): up to 3% , currently 1% (Charged by Visa",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.avici.money/getting-started/secured-credit-cards/faqs.md",
            "detail": "Avici docs, card FAQs, disputes.",
            "checked_at": "2026-10-09",
            "quote": "you will need to pay the **$35 dispute fee** in **USDC or USDT**",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.avici.money/getting-started/virtual-accounts/fees-and-limits.md",
            "detail": "Avici docs, Virtual Accounts, Fees and Limits (USD and EUR accounts).",
            "checked_at": "2026-10-09",
            "quote": "Pay Out (Withdrawal) via Wire Transfer / USD | 15 USD",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Gas for card top-ups is covered by Avici's relayer per the docs (CROPS components) and is not listed as a user fee. Swap and bridging fees for auto-top-up through Relay are not stated.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "unknown",
        "note": "CROPS S1 is unknown: the loan-escrow contract's chain and address are not disclosed. The docs claim the escrow is self-custodial and only the user's wallet can withdraw, while Avici can charge it via spend attestations and liquidate spent USDC; the card terms say Avici and the issuer never hold custody. Unverified, so no custody model is recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "attested",
        "value": [
          {
            "entity": "Third National (Nimbus LLC d/b/a Third National, per Rain)",
            "holder": "partner",
            "country": "US",
            "regulator": "Not named in any document",
            "type": "Licensed lender and money transmitter; Visa-authorized card issuer (as stated by Rain)",
            "activities": "Card issuance and BIN sponsorship for the Avici card.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://avici.money/tos",
            "detail": "Avici Terms of Use, third-party services.",
            "checked_at": "2026-10-09",
            "quote": "Third National (card issuance and BIN sponsorship)",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.raincards.xyz/legal/privacy-policy",
            "detail": "Rain privacy policy, Entity Roles and Data Flows: describes Nimbus LLC, doing business as Third National, without naming a regulator, state or licence number.",
            "checked_at": "2026-10-09",
            "quote": "is a licensed lender, money transmitter and Visa-authorized card issuer",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "trace",
            "url": "https://api.fdic.gov/banks/institutions?search=NAME:%22Third%20National%22&fields=NAME,CERT,ACTIVE,CITY,STNAME&limit=20",
            "detail": "FDIC BankFind institutions API, run 2026-10-09: the closest matches for \"Third National\" are other banks (Fifth Third Bank, N.A. and inactive banks); a search for NAME:Nimbus with ACTIVE:1 returns 0 institutions. NMLS Consumer Access returned HTTP 403 to a scripted request and was not bypassed; the Puerto Rico OCIF licence check (concesionarios.ocif.pr.gov) failed the TLS handshake.",
            "checked_at": "2026-10-09",
            "recheck": "curl -s 'https://api.fdic.gov/banks/institutions?search=NAME:Nimbus&filters=ACTIVE:1&fields=NAME,CERT' | grep -o '\"total\":[0-9]*'"
          }
        ],
        "note": "Attested only, and only by Rain: Avici's documents name Third National as issuer without any licence, and say nothing of Rain. FDIC BankFind lists no institution named Third National or Nimbus; the card terms are governed by Puerto Rico law, but the OCIF licence check could not be reached; NMLS Consumer Access blocked scripted access. Ramp partners Moonpay and Bridge (named in the Terms) were not checked against registers. Avici Inc claims no licence.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Third National (issuer), Visa",
            "fee": "No Avici FX markup; Visa 0.4-1% on non-USD",
            "limits": "Spend up to the USDC in the card escrow; no transaction limits unless set by the user.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Third National (issuer), Visa",
            "fee": "Platinum $1 + 0.65%; Signature $0",
            "limits": "$1,000 per transaction, $3,000 and 3 withdrawals per day; virtual cards at NFC ATMs.",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Virtual USD/EUR accounts (banking partners; Terms name Moonpay and Bridge for off-ramp)",
            "fee": "ACH $0, wire $15, SEPA EUR 0, SWIFT $25",
            "limits": "Annual limit 27,000 USD/EUR at tier 1, unlimited at tier 2 with source-of-funds proof; country risk table applies.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://avici.money/tosavicicard",
            "detail": "Avici Spend Card Terms, Defined Terms.",
            "checked_at": "2026-10-09",
            "quote": "The issuer for this card program is Third National.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.avici.money/getting-started/secured-credit-cards/fees-and-limits.md",
            "detail": "Avici docs, Fees and Limits, ATM Withdrawal table.",
            "checked_at": "2026-10-09",
            "quote": "$1000 per txn",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.avici.money/getting-started/virtual-accounts/fees-and-limits.md",
            "detail": "Avici docs, Virtual Accounts Fees and Limits; virtual accounts are fiat on- and off-ramp channels that convert to and from USDC in the Avici wallet.",
            "checked_at": "2026-10-09",
            "quote": "Pay Out (Withdrawal) via ACH / USD",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://avici.money/tos",
            "detail": "Avici Terms of Use, Introduction.",
            "checked_at": "2026-10-09",
            "quote": "Fiat onramp and offramp services via Moonpay and Bridge",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Bank payout is from the Avici wallet through a virtual account, not from the card escrow. The virtual-account country table prohibits some countries that are on the card allowlist (for example Bangladesh and Barbados) and limits others to SEPA or ACH; per-country rows were not split out, so ALL overstates bank payout availability in those countries. Which partner runs the virtual accounts is not named in the docs.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2024-12-05",
            "what": "Avici Spend Card Terms Important Disclosures effective; earliest dated first-party document for the card"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tosavicicard",
              "detail": "Avici Spend Card Terms, Important Disclosures header.",
              "checked_at": "2026-10-09",
              "quote": "Effective as of 5th December 2024",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No dated launch announcement was found on avici.money or docs.avici.money.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Avici Inc",
            "jurisdiction": "US-DE"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/privacypolicy",
              "detail": "Avici privacy policy, Who We Are; the Terms give the Middletown, Delaware address.",
              "checked_at": "2026-10-09",
              "quote": "operated by Avici Inc, a Delaware corporation in the United States",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Not checked in the Delaware Division of Corporations register (interactive search), so no register_url or file number.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-09-28",
              "summary": "Rain platform: unexpected card declines and API issues for some partners, 18:53 to 19:35 UTC; root cause still under investigation. Rain-wide; which programmes were affected is not stated.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/"
            },
            {
              "date": "2026-06-25",
              "summary": "Rain platform: elevated API error rates for 3h32m, caused by an expired encryption certificate.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-06-25-elevated-api-error-rate/"
            },
            {
              "date": "2026-06-03",
              "summary": "Rain platform: partial outage affecting card authorizations for 9 minutes, attributed to operating-system patching at a partner.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-06-03-payments-partner-outage/"
            },
            {
              "date": "2026-05-05",
              "summary": "Rain platform: elevated card declines for 3h10m from a partial outage at its payment processor.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-05-05-elevated-authorization-declines/"
            },
            {
              "date": "2026-01-02",
              "summary": "Rain platform: elevated card declines for 1h15m from an incident in the processor rules engine; Rain stated funds were safe.",
              "funds_lost": "no",
              "url": "https://status.rain.xyz/issues/2026-01-02-payementology-rules-declines/"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/",
              "detail": "Rain status incident 2026-09-28.",
              "checked_at": "2026-10-09",
              "quote": "We are investigating an issue that is causing unexpected declines for transactions",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-06-25-elevated-api-error-rate/",
              "detail": "Rain status incident 2026-06-25.",
              "checked_at": "2026-10-09",
              "quote": "The issue was caused by an expired encryption certificate",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-06-03-payments-partner-outage/",
              "detail": "Rain status incident 2026-06-03.",
              "checked_at": "2026-10-09",
              "quote": "Our partner has identified the cause as operating system patching activity on their side",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-05-05-elevated-authorization-declines/",
              "detail": "Rain status incident 2026-05-05.",
              "checked_at": "2026-10-09",
              "quote": "The incident was related to our payment processor and has been mitigated",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-01-02-payementology-rules-declines/",
              "detail": "Rain status incident 2026-01-02.",
              "checked_at": "2026-10-09",
              "quote": "Funds are safe and Rain infrastructure is working as intended",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No Avici incident report found on avici.money, docs.avici.money or its legal pages. The entries are Rain platform incidents from status.rain.xyz, included because the issuer Third National is a Rain affiliate; Avici does not name Rain, and the pages do not say which programmes were affected.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2024-12-05",
              "summary": "Avici Spend Card Terms Important Disclosures effective (issuer Third National; FX up to 3%, currently 1%).",
              "url": "https://avici.money/tosavicicard"
            },
            {
              "date": "2025-06-20",
              "summary": "Avici Spend Card Terms last updated (an earlier version dated 9 June 2025 is on the same page).",
              "url": "https://avici.money/tosavicicard"
            },
            {
              "date": "2026-06-25",
              "summary": "Avici Terms of Use last updated (previous version 21 April 2026 kept on the page).",
              "url": "https://avici.money/tos"
            },
            {
              "date": "2026-10-07",
              "summary": "Avici privacy policy last updated (adds the Avi assistant and connected-service data).",
              "url": "https://avici.money/privacypolicy"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tosavicicard",
              "detail": "Avici Spend Card Terms header.",
              "checked_at": "2026-10-09",
              "quote": "SPEND CARD TERMS (last updated 20th June 2025)",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/tos",
              "detail": "Avici Terms of Use header.",
              "checked_at": "2026-10-09",
              "quote": "Last updated: June 25, 2026",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://avici.money/privacypolicy",
              "detail": "Avici privacy policy header.",
              "checked_at": "2026-10-09",
              "quote": "Last updated: October 7, 2026.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "Incumbent: the provider file lists no contracts, so there is nothing a volume spec could be computed over; card settlement runs offchain through the issuer and Visa.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "notes": "Incumbent card from Avici Inc (Delaware), issued by Third National. Avici's own documents never name Rain; the Rain link rests on Rain's privacy policy identifying Third National as its affiliate Nimbus LLC and on the Rain card-terms template (see the CROPS research log). Partner-level facts are labelled \"Issuer group (Rain)\". Avici publishes no security page, trust centre or status page. No repository facts apply."
    },
    "aztec": {
      "slug": "aztec",
      "fees": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": [
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Mana used x fee per mana, in Fee Juice; minimum about 2.27e-6 AZTEC per mana on 2026-10-09",
            "basis": "Rollup FeeLib minimum = sequencer cost (L1 gas and blobs) + prover cost (provingCostPerMana, set by governance) + congestion cost (burned), converted at an oracle ETH/fee-asset rate. Paid from a non-transferable Fee Juice balance or by a fee-paying contract.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Optional priority fee per mana, set by the user in gas settings",
            "basis": "EIP-1559-style max and priority fee per mana chosen by the sender. Unburnt fees per epoch go 70% to the block proposer and 30% to provers.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
            "checked_at": "2026-10-09",
            "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/l1-contracts/src/core/libraries/rollup/FeeLib.sol#L269-L330",
            "path": "l1-contracts/src/core/libraries/rollup/FeeLib.sol",
            "detail": "getManaMinFeeComponentsAt sums sequencer, prover and congestion cost per mana. Read on Ethereum at block 26,154,934 (2026-10-09) with cast on Rollup 0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34 (chain 1, not recordable as onchain evidence for an aztec:mainnet row) gives getManaMinFeeAt = 2,269,387,395,825; components congestionCost 0, multiplier 1e9 (minimum), sequencerCost 122,988,048,037, proverCost 2,146,399,347,788; manaTarget 75,000,000.",
            "recheck": "cast call 0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34 \"getManaMinFeeComponentsAt(uint256,bool)((uint256,uint256,uint256,uint256))\" $(cast block latest --field timestamp --rpc-url https://ethereum-rpc.publicnode.com) true --rpc-url https://ethereum-rpc.publicnode.com"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
            "checked_at": "2026-10-09",
            "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-developers/docs/foundational-topics/fees.md#L46-L60",
            "path": "docs/docs-developers/docs/foundational-topics/fees.md",
            "detail": "fee = daMana x feePerDaMana + l2Mana x feePerL2Mana; Fee Juice is bridged AZTEC and non-transferable; base and priority fees per mana as in EIP-1559. L141-L143 says collected fees, minus burnt congestion, go to provers and block proposers once an epoch is proven."
          },
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
            "checked_at": "2026-10-09",
            "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-participate/token/economics.md#L39-L51",
            "path": "docs/docs-participate/token/economics.md",
            "detail": "Congestion cost is burned; of the remainder 70% goes to the sequencer and 30% to provers."
          }
        ],
        "note": "No protocol or Aztec Labs fee. The payer needs Fee Juice bridged from AZTEC on Ethereum through the one-way FeeJuicePortal (an L1 transaction with its own ETH gas), or a third-party fee-paying contract, which may charge in other tokens and whose terms were not reviewed. The Fee Juice per transaction depends on its mana use, which was not sampled.",
        "checked_at": "2026-10-09"
      },
      "custody_model": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with the S1 finding (anchor 3 in substance, held at 2). A private transfer nullifies the sender's notes and creates notes for the recipient; keys stay in the user's PXE. The L1 backing of a bridged token sits in that token's portal under its owner's control, and the docs call some circuits under-constrained.",
        "checked_at": "2026-10-09"
      },
      "licences": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://aztec-labs.com/terms-of-service.html",
            "detail": "Aztec Labs' terms name Spilsbury Holdings Limited as a software developer, disclaim investment advice and brokerage, and cite no licence or regulator.",
            "quote": "a private limited company incorporated and registered in England and Wales under company number 11093783",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://find-and-update.company-information.service.gov.uk/company/11093783",
            "detail": "Companies House entry, active, nature of business SIC 62012 (business and domestic software development).",
            "quote": "Company Overview for SPILSBURY HOLDINGS LIMITED (11093783)",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://aztec.network/terms-of-service",
            "detail": "Aztec Foundation (Swiss Stiftung, Zug) terms describe stewardship of open-source software and cite no licence or regulator.",
            "quote": "a Stiftung incorporated and registered in Zug, Switzerland",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Searched: Aztec Labs and Aztec Foundation terms and privacy policies, the Companies House entry. Not searched: the FCA cryptoasset register and Financial Services Register (client-rendered) and FINMA's lists. Neither entity transmits or holds users' funds on the rail, so a licence would be expected only for services outside it.",
        "checked_at": "2026-10-09"
      },
      "cashout": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "No fiat leg. The payee receives notes of an app-deployed token on Aztec; leaving means bridging the token out through its third-party L1 portal and converting on Ethereum, outside the protocol.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "maturity": {
        "first_deployment": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "date": "2025-11-13",
            "block": 23786836,
            "what": "First Aztec mainnet rollup (Registry index 0, 0x603b…CA12) at Ethereum block 23,786,836. The canonical v5 Rollup (0x91fF…8E34) was deployed at block 25,428,902 on 2026-06-30."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 1,
              "address": "0x603bb2c05D474794ea97805e8De69bCcFb3bCA12",
              "block_number": 23786836,
              "url": "https://sourcify.dev/server/v2/contract/1/0x603bb2c05D474794ea97805e8De69bCcFb3bCA12?fields=deployment",
              "detail": "Sourcify records the creation transaction 0x2e76…a254 in Ethereum block 23,786,836 (timestamp 2025-11-13 00:52:35 UTC from the block header). Registry 0x35b2…e298 was created nine blocks earlier (23,786,827). Registry getRollup(0) returns this address; getVersion lists three versions (0, 2934756905, 4248422647).",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x35b22e09Ee0390539439E24f06Da43D83f90e298 \"getRollup(uint256)(address)\" 0 --rpc-url https://ethereum-rpc.publicnode.com; cast block 23786836 --field timestamp --rpc-url https://ethereum-rpc.publicnode.com"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 1,
              "address": "0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34",
              "block_number": 25428902,
              "url": "https://sourcify.dev/server/v2/contract/1/0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34?fields=deployment",
              "detail": "Canonical Rollup (Registry getCanonicalRollup) created in Ethereum block 25,428,902, 2026-06-30 07:08:47 UTC; exact Sourcify match.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x35b22e09Ee0390539439E24f06Da43D83f90e298 \"getCanonicalRollup()(address)\" --rpc-url https://ethereum-rpc.publicnode.com"
            }
          ],
          "note": "Judgment call. The first rollup in the mainnet Registry is recorded. State does not carry over between rollup versions (alpha.md L60-L77), so the deployment that holds today's notes dates from 2026-06-30, and the docs describe the network as Alpha. The block number is an Ethereum L1 block.",
          "checked_at": "2026-10-09"
        },
        "entity": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "legal_name": "Spilsbury Holdings Limited (trading as Aztec Labs)",
            "jurisdiction": "GB",
            "register_url": "https://find-and-update.company-information.service.gov.uk/company/11093783",
            "registration_number": "11093783"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://aztec-labs.com/terms-of-service.html",
              "detail": "Aztec Labs terms identify the company behind the Aztec Labs name; Aztec Labs runs the hosted mainnet RPC and the snapshot hosts.",
              "quote": "a private limited company incorporated and registered in England and Wales under company number 11093783",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/11093783",
              "detail": "Companies House entry, status active, incorporated 2017-12-04.",
              "quote": "Company Overview for SPILSBURY HOLDINGS LIMITED (11093783)",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Judgment call. Aztec Labs is recorded as the maintaining organisation, as directed. Aztec Foundation (Swiss Stiftung, Zug) runs aztec.network, stewards development and since 2026-10-06 is the copyright holder in aztec-packages' LICENSE; its Swiss commercial-register entry was not looked up.",
          "checked_at": "2026-10-09"
        },
        "incidents": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2026-05-11",
              "summary": "SECURITY.md reports 8 critical and 7 high vulnerabilities found internally and by external audits in Aztec Network v4 (the mainnet version until v5); no details or exploitation statement are given.",
              "funds_lost": "unknown",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/SECURITY.md#L37-L44"
            },
            {
              "date": "2026-07-28",
              "summary": "GHSA-778c-2h5c-8r96 (low) - a checkpoint of over 72 blocks pushed through the escape hatch and proven would halt L2 nodes (uncaught validation error in the archiver).",
              "funds_lost": "no",
              "url": "https://github.com/AztecProtocol/aztec-packages/security/advisories/GHSA-778c-2h5c-8r96"
            },
            {
              "date": "2026-10-08",
              "summary": "GHSA-2hc8-mq24-76v2 (high) - the native UltraHonk verifier in barretenberg accepted recursive proofs with a malformed pairing accumulator; fixed in v5.2.1, which the release notes say does not affect the Aztec network.",
              "funds_lost": "no",
              "url": "https://github.com/AztecProtocol/aztec-packages/security/advisories/GHSA-2hc8-mq24-76v2"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/security-advisories",
              "detail": "Three published advisories (GHSA-73xc-j27q-wg75 medium, GHSA-2hc8-mq24-76v2 high, GHSA-778c-2h5c-8r96 low) on 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/AztecProtocol/aztec-packages/security-advisories --jq '.[] | [.ghsa_id,.severity,.published_at] | @tsv'"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "checked_at": "2026-10-09",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/SECURITY.md#L37-L44",
              "path": "SECURITY.md",
              "detail": "Table of high and critical vulnerabilities discovered in v4 by 2026-05-11."
            }
          ],
          "note": "The medium advisory (same verifier, abort on a point at infinity) is not listed separately. Release v4.2.1 (2026-05-07) was a mandatory hotfix restoring governance signalling, a liveness bug rather than an incident. No post-mortem of a mainnet halt was found. The docs say no part of the stack is fully audited and halts are expected during Alpha.",
          "checked_at": "2026-10-09"
        },
        "changes": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2025-11-13",
              "summary": "Registry and first rollup deployed on Ethereum (blocks 23,786,827 and 23,786,836).",
              "url": "https://sourcify.dev/server/v2/contract/1/0x603bb2c05D474794ea97805e8De69bCcFb3bCA12?fields=deployment"
            },
            {
              "date": "2026-03-04",
              "summary": "Second rollup version (Registry version 2934756905, 0xAe20…4962) deployed at Ethereum block 24,586,322.",
              "url": "https://sourcify.dev/server/v2/contract/1/0xAe2001f7e21d5EcABf6234E9FDd1E76F50F74962?fields=deployment"
            },
            {
              "date": "2026-06-30",
              "summary": "Third rollup version (Registry version 4248422647, 0x91fF…8E34), now canonical, deployed at Ethereum block 25,428,902; v5.0.0 (2026-07-11) is the first release supported on mainnet for it. State does not migrate between versions.",
              "url": "https://github.com/AztecProtocol/aztec-packages/releases/tag/v5.0.0"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "chain_id": 1,
              "address": "0x35b22e09Ee0390539439E24f06Da43D83f90e298",
              "block_number": 26154934,
              "url": "https://sourcify.dev/server/v2/contract/1/0x35b22e09Ee0390539439E24f06Da43D83f90e298?fields=deployment",
              "detail": "Registry numberOfVersions() = 3; getRollup for versions 0, 2934756905 and 4248422647 returns 0x603b…CA12, 0xAe20…4962 and 0x91fF…8E34; getCanonicalRollup() = 0x91fF…8E34. Deployment blocks from Sourcify, dates from the block headers.",
              "checked_at": "2026-10-09",
              "recheck": "for i in 0 1 2; do v=$(cast call 0x35b22e09Ee0390539439E24f06Da43D83f90e298 \"getVersion(uint256)(uint256)\" $i --rpc-url https://ethereum-rpc.publicnode.com | cut -d' ' -f1); cast call 0x35b22e09Ee0390539439E24f06Da43D83f90e298 \"getRollup(uint256)(address)\" $v --rpc-url https://ethereum-rpc.publicnode.com; done"
            }
          ],
          "note": "The date each version became canonical (a governance action) was not read; deployment dates are recorded. Governance had 5 proposals at the seed read.",
          "checked_at": "2026-10-09"
        }
      },
      "volume": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_observable",
        "reason": "Private transfers move value between encrypted notes inside the rollup; only nullifiers, note hashes and fee payers reach Ethereum, never amounts or tokens. Public L1 events (portal deposits and withdrawals, checkpoint proposals) are bridging and rollup bookkeeping, not payment settlement. The volume script reads EVM logs over the provider's listed contracts only, and this row lists none because its primary chain is aztec:mainnet."
      },
      "facts": {
        "B2.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": true,
                "detail": "security policy file: SECURITY.md"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/contents/?ref=next",
              "detail": "AztecProtocol/aztec-packages: security policy file: SECURITY.md",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/contents/?ref=main",
              "detail": "AztecProtocol/networks: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": true,
                "detail": "scanning step in a workflow"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/contents/?ref=next",
              "detail": "AztecProtocol/aztec-packages: scanning step in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/contents/?ref=main",
              "detail": "AztecProtocol/networks: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/contents/?ref=next",
              "detail": "AztecProtocol/aztec-packages: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/contents/?ref=main",
              "detail": "AztecProtocol/networks: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, required_status_checks"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/rules/branches/next",
              "detail": "AztecProtocol/aztec-packages: rules: deletion, non_fast_forward, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/rules/branches/main",
              "detail": "AztecProtocol/networks: rules: deletion, non_fast_forward, pull_request",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": true,
                "detail": "26 workflow file(s)"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": true,
                "detail": "2 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/contents/?ref=next",
              "detail": "AztecProtocol/aztec-packages: 26 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/contents/?ref=main",
              "detail": "AztecProtocol/networks: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/contents/?ref=next",
              "detail": "AztecProtocol/aztec-packages: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/contents/?ref=main",
              "detail": "AztecProtocol/networks: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/contents/?ref=next",
              "detail": "AztecProtocol/aztec-packages: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/contents/?ref=main",
              "detail": "AztecProtocol/networks: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": true,
                "detail": "latest tags: v7.0.0-nightly.20261019, v7.0.0-nightly.20261018, v7.0.0-nightly.20261017"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/tags",
              "detail": "AztecProtocol/aztec-packages: latest tags: v7.0.0-nightly.20261019, v7.0.0-nightly.20261018, v7.0.0-nightly.20261017",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/tags",
              "detail": "AztecProtocol/networks: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": true,
                "detail": "7 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/commits?per_page=10",
              "detail": "AztecProtocol/aztec-packages: 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/commits?per_page=10",
              "detail": "AztecProtocol/networks: 7 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/contents/?ref=next",
              "detail": "AztecProtocol/aztec-packages: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/contents/?ref=main",
              "detail": "AztecProtocol/networks: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "AztecProtocol/aztec-packages",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "AztecProtocol/networks",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/aztec-packages/contents/?ref=next",
              "detail": "AztecProtocol/aztec-packages: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/AztecProtocol/networks/contents/?ref=main",
              "detail": "AztecProtocol/networks: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Aztec Labs' privacy policy keeps contact data, technical usage data and service-use data for 12 months, then may keep it in anonymised form. Its scope is the Aztec Labs website and services; it does not mention the hosted mainnet RPC, whose ingress logs every request (log sample rate 1.0) per the deployment config.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://aztec-labs.com/privacy-policy.html",
              "detail": "Section 8, Retention of Your Personal Data.",
              "quote": "your technical usage information for 12 months",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "checked_at": "2026-10-09",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/spartan/environments/mainnet.env#L18-L23",
              "path": "spartan/environments/mainnet.env",
              "detail": "The mainnet RPC ingress (mainnet.rpc.aztec-labs.com) sets session affinity by client IP, RPC_INGRESS_LOG_SAMPLE_RATE=1.0 and a Cloud Armor policy."
            }
          ],
          "note": "Position of a hosted service Aztec Labs runs; the rail does not require it (users can run their own node, see C3). Cross-reference CROPS P2.",
          "checked_at": "2026-10-09"
        },
        "B8.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Partial. The hosted mainnet RPC is deployed on Google Cloud behind a named Cloud Armor (WAF) policy; the policy rules, host hardening benchmark, IDS/IPS and open ports are not published.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "checked_at": "2026-10-09",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/spartan/environments/mainnet.env#L18-L23",
              "path": "spartan/environments/mainnet.env",
              "detail": "RPC_CLOUD_ARMOR_POLICY_NAME=mainnet-rpc-policy for the mainnet RPC ingress; no policy rules in the repo."
            }
          ],
          "note": "Applies only to Aztec Labs' optional hosted RPC. No external port scan was run.",
          "checked_at": "2026-10-09"
        },
        "B10.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Logical and integration views. The docs describe the client-side PXE, the public AVM on nodes, private and public state, L1-L2 messaging and the L1 contracts; the deployment configs in spartan/ describe Aztec Labs' own infrastructure but there is no prose infrastructure view for self-hosters beyond the node setup guide.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "checked_at": "2026-10-09",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-developers/docs/foundational-topics/index.md#L13-L61",
              "path": "docs/docs-developers/docs/foundational-topics/index.md",
              "detail": "Aztec overview with the high-level flow (aztec.js, PXE, public VM, rollup to Ethereum) and the private/public execution and state model; sibling pages cover PXE, messaging, accounts and fees."
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "No terms cover the hosted mainnet RPC. Aztec Labs' terms (Spilsbury Holdings Limited, England and Wales, English law, London arbitration) cover its website and testnet tools; Aztec Foundation's terms (Swiss Stiftung, Zug) cover aztec.network. The rail itself has no contracting party.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://aztec-labs.com/terms-of-service.html",
              "detail": "Terms last updated 2024-09-13; Services are defined as website information and the sandbox/testnet Testing Tools.",
              "quote": "a private limited company incorporated and registered in England and Wales under company number 11093783",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://aztec.network/terms-of-service",
              "detail": "Aztec Foundation terms, last updated 2025-07-15.",
              "quote": "a Stiftung incorporated and registered in Zug, Switzerland",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Protocol rewards fund operators, not developers. AZTEC is minted in advance to a RewardDistributor and paid at 400 AZTEC per slot (70% sequencer, 30% provers), adjustable by governance; unburnt fees go to the same parties. Development is stewarded by Aztec Foundation and carried out by Aztec Labs, a private company; their funding was not read from a primary source.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "49a592109ec4f18d79212b43d621891aaf36f7b6",
              "checked_at": "2026-10-09",
              "url": "https://github.com/AztecProtocol/aztec-packages/blob/49a592109ec4f18d79212b43d621891aaf36f7b6/docs/docs-participate/token/economics.md#L11-L51",
              "path": "docs/docs-participate/token/economics.md",
              "detail": "Reward sources, the per-slot checkpoint reward and the fee split."
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://aztec.network/terms-of-service",
              "detail": "Aztec Foundation describes its role as stewarding development.",
              "quote": "stewards the development of open-source, blockchain-based software",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B12.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            },
            {
              "criterion": "C4",
              "index": 1
            }
          ],
          "note": "Inclusion depends on proofs, fees and a protocol allowlist of setup-phase public functions (a static list, not a screen of addresses). The seed code search for sanction, country and geoblock found no screening. The Cloud Armor policy on the hosted RPC is unpublished and is not in the payment path when a user runs a node.",
          "checked_at": "2026-10-09"
        }
      }
    },
    "bitget-wallet-card": {
      "slug": "bitget-wallet-card",
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Crypto top-up 1.0% (5 to 8 digit account NFT), 0.5% (4 digits), 0.25% (3 digits)",
            "basis": "Fiat24 pricing for individuals (from 1 June 2024); the terms make the Pricing page part of the contract and say fees may change without notice.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Low-value transaction fee 0.15 USD, EUR or CHF per card payment below 10 (CNH 1.00 below CNH 70)",
            "basis": "Fiat24 price adjust plan, in force from 15 June 2026.",
            "evidence_index": 1
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Refund processing fee 1 USD, EUR or CHF (7 CNH) per card refund, capped at the refund amount",
            "basis": "Fiat24 MasterCard Debit page, from 15 May 2026.",
            "evidence_index": 2
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "No annual or monthly card fee",
            "basis": "Bitget card page, stated for all regional programmes; Fiat24's card page lists no issuance fee.",
            "evidence_index": 5
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Free between EUR24, USD24, CHF24 and CNH24 balances; card conversion rate not stated",
            "basis": "Fiat24 Money Exchange page; the card debits the matching currency balance first (\"Direct Pay\"), else converts to the default card currency.",
            "evidence_index": 3
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Bank payout free; 10 EUR or 10 CHF if the payout is returned; minimum payout 100 EUR or 100 CHF",
            "basis": "Fiat24 Cash Payout page.",
            "evidence_index": 4
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Card 10,000 EUR/day, 20,000 EUR/month (Standard); account 30,000 USD/30 days for new individuals",
            "basis": "Fiat24 MasterCard Debit and Individual Account pages; higher card tiers for 3 and 4 digit NFTs.",
            "evidence_index": 2
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Arbitrum gas for approvals and top-ups",
            "basis": "Fiat24 terms, fee schedule clause d; varies with network conditions.",
            "evidence_index": 6
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/products/pricing-for-individuals",
            "detail": "Fiat24 pricing for individuals, top-up fee by NFT length.",
            "checked_at": "2026-10-09",
            "quote": "1.0% Crypto topup fee",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/developer/price-adjust-plan",
            "detail": "Fiat24 price adjust plan, timeline for refund and low-value card transaction fees.",
            "checked_at": "2026-10-09",
            "quote": "low-value card transaction fee",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
            "detail": "Fiat24 MasterCard Debit page, spending limits by tier and refund processing fee.",
            "checked_at": "2026-10-09",
            "quote": "USD refunds: 1 USD per transaction",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/transactions/money-exchange",
            "detail": "Fiat24 Money Exchange page, fee section.",
            "checked_at": "2026-10-09",
            "quote": "allows Fiat24 users to exchange one currency for another",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/payments/cash-payout",
            "detail": "Fiat24 Cash Payout page, minimum amount and returned-payout fee.",
            "checked_at": "2026-10-09",
            "quote": "If a payout is returned, we charge a fee of 10 CHF or 10 EUR.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://web3.bitget.com/card",
            "detail": "Bitget Wallet Card page, benefits and FAQ on fees (all regional programmes).",
            "checked_at": "2026-10-09",
            "quote": "No interest markup, no monthly card fee, no hidden charges",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
            "detail": "Fiat24 terms (effective 21 April 2026), section 15 fee schedule.",
            "checked_at": "2026-10-09",
            "quote": "there are fees deducted by the blockchain network itself",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Fees are Fiat24's, the issuer of this programme. Bitget's card FAQ says assetback 'typically covers most top-up and currency conversion fees' and that standard fees apply beyond the monthly allowance, without stating them; it does not say which programme that refers to. No card FX margin is published by Fiat24, so that component is unknown, not zero. Premium account NFTs cost 1,500 or 15,000 F24 to mint.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S4",
            "index": 0
          }
        ],
        "note": "Agrees with S1 (score 0): the balance is a Fiat24 deposit claim represented by EUR24/USD24/CHF24/CNH24 tokens in the cardholder's address; Fiat24's operator EOA can move any balance with sendToSundry, transfers need a Fiat24-set Live status, and bank payouts need Fiat24's cash operator. Judgment call: recorded as provider_custodial rather than hybrid because the asset itself is a bank liability the issuer controls, not a token the user can exit with.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "SR Saphirstein AG (Fiat24)",
            "holder": "partner",
            "country": "CH",
            "regulator": "Swiss Financial Market Supervisory Authority (FINMA)",
            "type": "FinTech licence under Article 1b of the Swiss Banking Act",
            "activities": "Accepting public deposits up to the FinTech licence limits (no lending, no interest); issuer of the Fiat24 Mastercard debit card and the cash tokens.",
            "register_url": "https://www.finma.ch/en/finma-public/authorised-institutions-individuals-and-products/",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.finma.ch/en/finma-public/authorised-institutions-individuals-and-products/",
            "archive": "data/archive/bitget-wallet-card-ops-finma-register.txt",
            "detail": "FINMA register search for \"Saphirstein\" returns one entry, SR Saphirstein AG, Zürich, in the category of licensed persons under Article 1b BA (FinTech licence). The page is client-rendered, so the search API response is archived.",
            "checked_at": "2026-10-09",
            "quote": "Licensed persons pursuant to Article 1b BA (FinTech licence)",
            "recheck": "curl -s -X POST https://www.finma.ch/en/api/search/getresult --data 'query=Saphirstein&Order=4&ds={721FBF20-81A8-4E0F-B271-1B95975C0EC4}'",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
            "detail": "Fiat24 terms section 1 name SR Saphirstein AG, CHE-256.014.995, as a FINMA-supervised FinTech licensee.",
            "checked_at": "2026-10-09",
            "quote": "has a license as a fintech company according to Article 1b of the Swiss Banking Act",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "FinTech licensees are supervised by FINMA directly for anti-money-laundering purposes, so no self-regulatory organisation membership was looked for. FINMA's register shows no licence number. The provider file's context notes that Swiss deposit protection does not apply to Fiat24 deposits. Bitget Wallet's own entities and any licences they hold were not looked up: Bitget is the referring wallet, not a party to the Fiat24 card contract.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "SR Saphirstein AG (Fiat24) as issuer, Mastercard",
            "fee": "0.15 per payment below 10 in the card currency; refunds 1 USD/EUR/CHF or 7 CNH",
            "limits": "10,000 EUR per day, 20,000 EUR per month (Standard tier); virtual card only, no PIN, so no ATM withdrawals",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "SR Saphirstein AG (Fiat24)",
            "fee": "Free; 10 EUR or 10 CHF if returned",
            "limits": "EUR and CHF only; minimum 100; only to a bank account that has first deposited into the Fiat24 account; payee bank not in a restricted country",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
            "detail": "Fiat24 MasterCard Debit page, card format, limits and fees.",
            "checked_at": "2026-10-09",
            "quote": "The Fiat24 Debit Card is a virtual card only without PIN.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/payments/cash-payout",
            "detail": "Fiat24 Cash Payout page, payout account rule, minimum and fee.",
            "checked_at": "2026-10-09",
            "quote": "Minimal payout amount is 100 EUR or 100 CHF.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ALL means the availability list, which is CN (existing cardholders only). Whether Mainland China cardholders can use the EUR/CHF bank payout in practice depends on having deposited from an IBAN first, which the payout page says is required; no CNH payout is documented.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2024-11-12",
            "block": 273715521,
            "what": "Fiat24CardAuthorization proxy 0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14 on Arbitrum One (card debits). The EUR24 cash token it debits dates from block 4699193 (2022-01-16)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/tx/0x53392365e29a675af7378d8122c832ba12357427e12314c3f0cf83b2e91057a7",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "chain_id": 42161,
              "block_number": 273715521,
              "detail": "The receipt of tx 0x53392365...57a7 (sender 0x1272...9D59, the Fiat24 admin EOA) has contractAddress 0xe2e3B88B...5b14 in block 273715521, timestamp 1731420531 (2024-11-12 14:08:51 UTC); Sourcify's creation data gives the same transaction and block.",
              "checked_at": "2026-10-09",
              "recheck": "cast receipt 0x53392365e29a675af7378d8122c832ba12357427e12314c3f0cf83b2e91057a7 contractAddress --rpc-url https://arb1.arbitrum.io/rpc && cast block 273715521 --field timestamp --rpc-url https://arb1.arbitrum.io/rpc"
            }
          ],
          "note": "The card authorizer is the settlement contract for card payments; Fiat24 docs announced the Mastercard debit card for December 2024. Bitget's referral of accounts (walletProviderMap 8088) has no deployment of its own.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "SR Saphirstein AG (Fiat24)",
            "jurisdiction": "CH-ZH",
            "register_url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE256014995",
            "registration_number": "CHE-256.014.995"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE256014995",
              "detail": "Swiss UID register, SR Saphirstein AG (SR Saphirstein Ltd), Bellerivestrasse 245, 8008 Zürich, Aktiengesellschaft, commercial register status active, reference CH-020.3.046.001-4, last checked by the register 22.09.2026.",
              "checked_at": "2026-10-09",
              "quote": "CH-020.3.046.001-4",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
              "detail": "Fiat24 names SR Saphirstein AG as the card issuer.",
              "checked_at": "2026-10-09",
              "quote": "SR Saphirstein AG, based in Switzerland, owns the Fiat24 brand and serves as the principal issuer of MasterCard",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The cardholder contracts with SR Saphirstein AG under the Fiat24 account and card terms; Bitget Wallet is the referring wallet and is not a party to them.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "Searched: Fiat24 user manual, developer docs and release notice, legal pages, status.fiat24.com (history is client-rendered and failed to load), Bitget help articles on this programme. No incident disclosure found; Fiat24 publishes no incident log and its contracts are not in a public repository with advisories.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-02-01",
              "summary": "Fiat24 API stops returning Visa card fields; cards are Mastercard only.",
              "url": "https://docs.fiat24.com/developer/release-notice/2025-02-01"
            },
            {
              "date": "2026-04-21",
              "summary": "Current Fiat24 terms for users and clients take effect.",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients"
            },
            {
              "date": "2026-05-15",
              "summary": "Card refund processing fee introduced (1 USD/EUR/CHF, 7 CNH; first charged 21 May 2026).",
              "url": "https://docs.fiat24.com/developer/price-adjust-plan"
            },
            {
              "date": "2026-06-05",
              "summary": "New individual clients capped at 30,000 USD per month, limit upgrades suspended.",
              "url": "https://docs.fiat24.com/user/account-types/individual-account"
            },
            {
              "date": "2026-06-15",
              "summary": "Low-value card transaction fee introduced (0.15 per payment below 10 USD/EUR/CHF).",
              "url": "https://docs.fiat24.com/developer/price-adjust-plan"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/release-notice/2025-02-01",
              "detail": "Fiat24 release notice of 2025-02-01.",
              "checked_at": "2026-10-09",
              "quote": "Disable VISA cards",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "Terms effective date.",
              "checked_at": "2026-10-09",
              "quote": "Effective from: 21 April 2026",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/price-adjust-plan",
              "detail": "Price adjust plan timeline (15 May and 15 June 2026).",
              "checked_at": "2026-10-09",
              "quote": "refund processing fee",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/user/account-types/individual-account",
              "detail": "Individual account page, monthly limit change and current closure to new individual clients.",
              "checked_at": "2026-10-09",
              "quote": "all new individual clients will be subject to a monthly transaction limit of USD 30,000",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Undated changes not listed. Bitget help article 802 closes new Mainland China sign-ups for this programme, and Fiat24's individual account page says it is not accepting new individual clients \"due to maintenance works\"; neither gives a date. The contracts are upgradeable by one EOA (S2), and implementation changes were not enumerated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 42161,
          "addresses": [
            "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14"
          ],
          "topic0": "0xccd892fadc4aff70d2a87e68be8c4ea12542363d8f405acbf0949c6816b99ccb",
          "event": "Authorized(string authorizationToken, uint256 indexed tokenId, address indexed sender, string cardId, address cardCurrency, uint256 paidAmount)",
          "token_word": 2,
          "amount_word": 3,
          "decimals": 2,
          "window_days": 30,
          "exclusions": "Card authorizations by all Fiat24 accounts, not only Bitget-referred ones (the event does not carry the wallet provider; filtering by tokenId would need walletProvider() per account). Incremented, Adviced and Reversed events are not counted, so reversals are not netted. Amounts are in the cash token's 2 decimals, per currency (USD24, EUR24, CHF24, CNH24). Gross observed."
        },
        "note": "Spec checked against the Authorized log in tx 0x568b9d28...e21f (word 2 USD24 0xbE00f3db..., word 3 = 484, i.e. 4.84 USD). Not computed; the maintainer runs scripts/volumes.mjs.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: eth_getLogs: Too Many Requests"
      },
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found for SR Saphirstein AG in the Fiat24 user manual, developer docs, legal pages or fiat24.com, or for Bitget Wallet on its card and security technology pages.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No hosting or support organisation certification found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No audit of the Fiat24 contracts, backend or card authorizer found (CROPS S6 unknown). Bitget's security technology page cites CertiK and SlowMist audits of Bitget Swap and the NFT marketplace, not the card.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or attestation found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "The Fiat24 terms, card terms and privacy policy oblige the client to report incidents to Fiat24 but contain no commitment by Fiat24 to notify clients of security or data incidents.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Status page at status.fiat24.com (uptime monitor with status update history); no post-mortem found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.fiat24.com/",
              "detail": "Fiat24 status page; uptime and history are loaded client-side and failed to load when read.",
              "checked_at": "2026-10-09",
              "quote": "Service status",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Account access is by wallet signature from the address holding the Fiat24 account NFT (one factor, the wallet key); online card payments may require 3-D Secure with a one-time password sent by email.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
              "detail": "MasterCard Debit page, OTP per email section.",
              "checked_at": "2026-10-09",
              "quote": "may be asked to provide a one-time password (OTP) sent to their email",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-2-api-reference",
              "detail": "API reference, secured APIs require a header signed by the NFT holder's wallet.",
              "checked_at": "2026-10-09",
              "quote": "Fiat24 does NOT use any standard protocol for authentication and authorisation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "A custom header with tokenid, network, a personal_sign signature by the NFT holder's wallet, the signed text and a deadline; no OAuth, OpenID Connect, SAML or JWT.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-2-api-reference",
              "detail": "API reference, secured APIs section.",
              "checked_at": "2026-10-09",
              "quote": "Fiat24 does NOT use any standard protocol for authentication and authorisation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C3",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Platforms (beta Authorized Access Model) call the same APIs with a header signed by the address holding the platform NFT, after the client authorises that NFT; there are no API keys, and rotation would mean moving the NFT.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-5-authorized-access-model",
              "detail": "Authorized Access Model, authentication and access section.",
              "checked_at": "2026-10-09",
              "quote": "Fiat24 does NOT use any standard protocol for authentication and authorization",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Server-to-server links between Fiat24, Marqeta and Bitget are not documented.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "Signed request headers carry a deadline of at most 20 minutes; a card display token is valid for 5 minutes.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-2-api-reference",
              "detail": "API reference, signature deadline example and card token validity.",
              "checked_at": "2026-10-09",
              "quote": "We only allow the signature to be valid for 20 minutes max.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "The privacy policy states only \"industry standard security measures\"; no data classification, encryption at rest or TLS version is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Fiat24 privacy policy (effective 14 February 2023), section 5.",
              "checked_at": "2026-10-09",
              "quote": "We employ industry standard security measures designed to protect the security of all information submitted through the Services",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Fiat24 retains personal data as long as needed for the stated purposes and as required by law, with no fixed periods; deletion on termination is not stated. Balances and transactions are recorded on a public blockchain and cannot be deleted.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Privacy policy, section 5.",
              "checked_at": "2026-10-09",
              "quote": "We retain information we collect as long as it is necessary and relevant",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            },
            {
              "criterion": "P3",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The privacy policy describes SR Saphirstein AG as the company that collects, uses, shares and stores users' personal information; it does not use the terms controller or processor or mention a DPIA. Bitget Wallet's own policy covers its app separately.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Privacy policy opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "entered in the Commercial Register of the Canton of Zurich under the number CHE-256.014.995",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Fiat24's developer integration guide documents the logical and integration views (contracts, account NFT, cash tokens, card authorisation, API, onboarding); no infrastructure view.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/integration-guide/part-1-smart-contracts",
              "detail": "Integration guide part 1, smart contracts on Arbitrum and Mantle.",
              "checked_at": "2026-10-09",
              "quote": "The entire booking system of Fiat24 is managed transparently on the Arbitrum and Mantle blockchain",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "O4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "SR Saphirstein AG (Fiat24), Zurich, Switzerland, CHE-256.014.995; terms under Swiss law with the ordinary courts of Zurich. Bitget Wallet is not a party to the card contract.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE256014995",
              "detail": "Swiss UID register entry for SR Saphirstein AG.",
              "checked_at": "2026-10-09",
              "quote": "SR Saphirstein AG",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "Terms section 1, who we are.",
              "checked_at": "2026-10-09",
              "quote": "has a license as a fintech company according to Article 1b of the Swiss Banking Act",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Fiat24 charges per-use fees (crypto top-up percentage, card refund and low-value transaction fees, premium NFT mint fees); its price adjust plan cites rising operational and compliance costs. No annual report was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/products/pricing-for-individuals",
              "detail": "Pricing for individuals.",
              "checked_at": "2026-10-09",
              "quote": "1.0% Crypto topup fee",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/developer/price-adjust-plan",
              "detail": "Price adjust plan, rationale paragraph.",
              "checked_at": "2026-10-09",
              "quote": "refund processing fee",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Fiat24 may close an account with two months' notice (immediately if the balance is zero) or without notice on breach, legal order or suspected crime; suspension is shown only as account status. The client may close the account in the dApp once all balances are zero; bank payouts need Fiat24's cash operator (S4).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "Terms section 23.",
              "checked_at": "2026-10-09",
              "quote": "by giving you two months prior notice",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/user/account-types/individual-account",
              "detail": "Individual account page, close account steps.",
              "checked_at": "2026-10-09",
              "quote": "Before you close your account, all balances need to be zero.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Automated screening is in the payment path, the cash tokens check an onchain sanctions list on every transfer (C4) and the card system blocks cards on detected unusual activity; neither document says whether AI or a learned model is used.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
              "detail": "MasterCard Debit page, card blocking section.",
              "checked_at": "2026-10-09",
              "quote": "if the system detects some unusual or suspicious activity",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "The only documented control is a user override, unblocking the card in the dApp (each block or unblock locks the status for 24 hours); monitoring, validation, decommissioning and bias evaluation are not documented.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
              "detail": "MasterCard Debit page, protect your card section.",
              "checked_at": "2026-10-09",
              "quote": "Each block or un-block action will lock the action for 24 hours",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      }
    },
    "blanksquare": {
      "slug": "blanksquare",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/contents/?ref=main",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielding-dapp: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielder-quickstart: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/contents/?ref=main",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielding-dapp: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielder-quickstart: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/contents/?ref=main",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielding-dapp: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielder-quickstart: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": false,
                "detail": "rules: required_signatures"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/rules/branches/main",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: rules: required_signatures",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/rules/branches/main",
              "detail": "Cardinal-Cryptography/shielding-dapp: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/rules/branches/main",
              "detail": "Cardinal-Cryptography/shielder-quickstart: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": false,
                "detail": "25 workflow file(s)"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": true,
                "detail": "4 workflow file(s)"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/contents/?ref=main",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: 25 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielding-dapp: 4 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielder-quickstart: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/contents/?ref=main",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielding-dapp: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielder-quickstart: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/contents/?ref=main",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielding-dapp: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielder-quickstart: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": true,
                "detail": "latest tags: v0.1.0, shielder-scheduler-tee-20251030-140127, shielder-scheduler-tee-20251017-120503"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": true,
                "detail": "latest tags: 1.0.5, 1.0.4, 1.0.3"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/tags",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: latest tags: v0.1.0, shielder-scheduler-tee-20251030-140127, shielder-scheduler-tee-20251017-120503",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/tags",
              "detail": "Cardinal-Cryptography/shielding-dapp: latest tags: 1.0.5, 1.0.4, 1.0.3",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/tags",
              "detail": "Cardinal-Cryptography/shielder-quickstart: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": true,
                "detail": "5 of 5 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/commits?per_page=10",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/commits?per_page=10",
              "detail": "Cardinal-Cryptography/shielding-dapp: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/commits?per_page=10",
              "detail": "Cardinal-Cryptography/shielder-quickstart: 5 of 5 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": true,
                "detail": "4 release(s) with notes"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/contents/?ref=main",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielding-dapp: 4 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielder-quickstart: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Cardinal-Cryptography/blanksquare-monorepo",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "Cardinal-Cryptography/shielding-dapp",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Cardinal-Cryptography/shielder-quickstart",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/contents/?ref=main",
              "detail": "Cardinal-Cryptography/blanksquare-monorepo: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielding-dapp/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielding-dapp: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/shielder-quickstart/contents/?ref=main",
              "detail": "Cardinal-Cryptography/shielder-quickstart: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No certification statement for Common Labs Inc. or Cardinal Cryptography in the docs or archived terms.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "zkSecurity audited the contracts and circuits at zkOS-monorepo commit 22e2f52 (March 2025); the deployed Shielder.sol changed after that commit. No review of the relayer, TEE prover or apps is listed.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            },
            {
              "criterion": "S6",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration test of the relayer, TEE prover or apps found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No SECURITY file, disclosure page or patch timeline in the repositories, docs or archived terms.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No incident-notification commitment in the docs or archived terms excerpts.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page or post-mortem found; the apps and relayer went offline without a notice we could find.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "The relayer API takes unauthenticated JSON POSTs (quote_fees, relay); no OAuth, JWT or API key option exists in its configuration. The SDK otherwise talks only to a user-chosen RPC.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/integration-guides/fees.md",
              "detail": "The fee quote is a POST to the relayer with a token and pocket-money payload only.",
              "checked_at": "2026-10-09",
              "quote": "is equivalent to making a POST request to the `/quote_fees` endpoint of the relayer API",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/crates/shielder-relayer/README.md#L30-L65",
              "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
              "path": "crates/shielder-relayer/README.md",
              "detail": "The relayer's options cover RPC, keys, pricing, ports and fees, with no client authentication setting; the OpenAPI spec is served at /api.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "unknown",
          "note": "The apps' privacy policy (PDF, 25 July 2025) was not re-read in full; the archived excerpts list data categories and recipients but not retention periods.",
          "refs": [
            {
              "criterion": "P2",
              "index": 1
            }
          ],
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical and integration views on the docs site (protocol overview, notes and accounts, relayers, anonymity revokers, client-side components, TEE proof delegation, SDK guides, deployments); infrastructure only as the relayer's Docker and configuration README. Not versioned with the code except the relayer README.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/llms.txt",
              "detail": "Docs index listing the protocol-details and integration-guides pages.",
              "checked_at": "2026-10-09",
              "quote": "TEE-based Proof Delegation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "O3",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Common Labs Inc., Panama (registered address in Panama City); terms under Panama law. Applies to the apps and Shielder Service, not to direct contract use.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/other/terms-and-conditions-shielder-service",
              "archive": "data/archive/blanksquare-shielder-terms.txt",
              "detail": "Terms 19.1 and 22.18.",
              "checked_at": "2026-10-09",
              "quote": "These Terms will be governed by the law of Panama"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "An onchain fee switch exists (up to 5% per deposit and withdrawal, paid to the owner Safe) but is set to 0; relayer commission would accrue to the relayer's fee address. No other funding source is published.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53",
              "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "block_number": 52380966,
              "detail": "protocolDepositFeeBps() and protocolWithdrawFeeBps() return 0; protocolFeeReceiver() is the owner Safe 0x9Dc4…2165.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0xb1a076ea",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Common Labs may terminate the Shielder Service agreement immediately if the user is a Restricted Individual (other termination clauses not in the archived excerpts). Funds stay in the contract and can be withdrawn with the SDK's direct path while it is unpaused (S4).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/other/terms-and-conditions-shielder-service",
              "archive": "data/archive/blanksquare-shielder-terms.txt",
              "detail": "Terms 6.2.",
              "checked_at": "2026-10-09",
              "quote": "SERVICE PROVIDER has the right to terminate the Agreement with immediate effect if the User is a Restricted Individual."
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "absent",
          "value": "No automated screening or AI in the payment path. The contract checks only proofs, nullifiers and amounts; the relayer has no sanctions, blocklist or analytics code. The anonymity revoker acts on a governance decision, not an automated one.",
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "not_applicable",
          "reason": "No AI component in the payment path (B12.1 absent).",
          "burden": "none",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "Protocol deposit and withdrawal fees both 0 bps on Base (contract cap 500 bps each)",
            "basis": "protocolDepositFeeBps and protocolWithdrawFeeBps, settable at once by the owner Safe up to MAX_FEE_BPS 500; receiver is the owner Safe. Unchanged at every block sampled since deployment.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "Relayer fee = network fee + optional pocket money + commission (default 15% of relay cost), in the withdrawn token",
            "basis": "Set by whoever runs a relayer (shielder-relayer SERVICE_FEE_PERCENT); optional, since withdrawManual needs no relayer. The official Base relayer did not resolve on 2026-10-09.",
            "evidence_index": 2
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Base gas; sample 1,764,659 gas, about 0.0000106 ETH incl. L1 fee, for the last shield (2026-04-02)",
            "basis": "Paid by the depositor, and by the withdrawer on the direct path; relayers fold it into their fee.",
            "evidence_index": 4
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://sourcify.dev/server/v2/contract/8453/0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53",
            "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
            "block_number": 52380966,
            "detail": "protocolDepositFeeBps() and protocolWithdrawFeeBps() return 0 and protocolFeeReceiver() is the owner Safe 0x9Dc4…2165 at block 52380966; both fees also read 0 at blocks 33246477, 40000000 and 46000000.",
            "checked_at": "2026-10-09",
            "recheck": "cast call 0x064A67a5484DF6baf36be42F9554d45E7741dCFf \"protocolWithdrawFeeBps()(uint256)\" --rpc-url https://mainnet.base.org",
            "check": {
              "call": "0xb1a076ea",
              "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
            },
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/contracts/ProtocolFee.sol#L13-L109",
            "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
            "path": "contracts/ProtocolFee.sol",
            "detail": "MAX_FEE_BPS is 500; the setters (called by onlyOwner functions in Shielder.sol L168-L184) revert above it; fees round up.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/Cardinal-Cryptography/blanksquare-monorepo/blob/5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e/crates/shielder-relayer/README.md#L49-L60",
            "commit": "5dad5a07fc4ace59c9ea390fd683bdf0c27ec36e",
            "path": "crates/shielder-relayer/README.md",
            "detail": "Relayer configuration table, service-fee-percent default 15%, relay gas estimate 2,000,000, max pocket money 0.1 native token, quote validity 15 s.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.blanksquare.io/integration-guides/fees.md",
            "detail": "Understanding Fees page, protocol fee and relayer fee structure.",
            "checked_at": "2026-10-09",
            "quote": "the amount the relayer charges for the service (calculated as a percentage of `relayer_cost`)",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://basescan.org/tx/0x7abb4a49363a5a338df618ea184eeac84c5417103c4de8a5b4dfa662365c8c3e",
            "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
            "block_number": 44167109,
            "detail": "The last transaction that changed the Shielder's Merkle tree (NewAccount log, block 44167109, 2026-04-02 09:52:45 UTC) used 1,764,659 gas at 0.006 gwei plus an L1 fee of 54,547,339,119 wei, about 0.0000106 ETH in total.",
            "checked_at": "2026-10-09",
            "recheck": "cast receipt 0x7abb4a49363a5a338df618ea184eeac84c5417103c4de8a5b4dfa662365c8c3e --rpc-url https://base.drpc.org"
          }
        ],
        "note": "No withdrawal gas sample; public Base RPCs refuse log queries over the deployment's range, so only the last tree-changing transaction was located (by bisecting merkleTree() state).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "C2",
            "index": 0
          }
        ],
        "note": "Agrees with S1 (score 1). Only a valid proof moves funds out, to the address bound in it, and the terms say the service provider does not safekeep or control crypto-assets. The disclosed risk is that a 2-of-5 Safe can upgrade the escrow with no timelock and pause withdrawals.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.blanksquare.io/other/terms-and-conditions-shielder-service",
            "archive": "data/archive/blanksquare-shielder-terms.txt",
            "detail": "The Shielder Service terms (4 Nov 2025) describe a non-custodial service by Common Labs Inc. (Panama) and cite no licence, registration or regulator in the archived sections.",
            "checked_at": "2026-10-09",
            "quote": "SERVICE PROVIDER does not safekeep or control any crypto-assets on behalf of the Users."
          }
        ],
        "note": "Searched: the docs (llms.txt, FAQ, fraud protection, legal pages) and the archived terms and privacy excerpts; no licence is claimed. Not searched: the Panama Public Registry and Superintendency registers (interactive search), and the full PDF terms beyond the archived excerpts.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "A payment is a withdrawal of tokens to the payee's own Base address; converting them to local currency is outside the protocol and the apps.",
        "burden": "institution",
        "refs": [
          {
            "criterion": "C2",
            "index": 0
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2025-07-23",
            "block": 33246476,
            "what": "Shielder proxy 0x064A…dCFf created in tx 0xf63c3126…8045 by 0x9A3C…bebA, two transactions after the implementation 0xfFF4…8b53 (tx 0x1bc2f5ad…a6a8); unpaused in the same block."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53?fields=deployment",
              "address": "0xfFF44d366DeDF9B2A531109E1A08BF9873C58b53",
              "block_number": 33246476,
              "detail": "Sourcify creation data for the implementation gives tx 0x1bc2f5ad1486353b4bc94c9b1dc7b603b192709f3bf731025f78a93f181ca6a8 in block 33246476 by 0x9A3CE7876beCF00e6467E7AE38e059Ee8c12bebA. The proxy has no Sourcify record; its deploy receipt (tx 0xf63c31263f7dc17c56862a7d763b4d24f1fd9e0f141e488d5d43401730068045, same block and sender) has contractAddress 0x064A…dCFf. Block 33246476 is dated 2025-07-23 14:51:39 UTC.",
              "checked_at": "2026-10-09",
              "recheck": "cast receipt 0xf63c31263f7dc17c56862a7d763b4d24f1fd9e0f141e488d5d43401730068045 contractAddress --rpc-url https://mainnet.base.org"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Common Labs Inc.",
            "jurisdiction": "PA"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/other/terms-and-conditions-shielder-service",
              "archive": "data/archive/blanksquare-shielder-terms.txt",
              "detail": "Terms definition 22.18 names the service provider and its registered address in Panama City; section 19.1 sets Panama law.",
              "checked_at": "2026-10-09",
              "quote": "Common Labs Inc. with its registered address at"
            }
          ],
          "note": "No company-register entry; the Panama Public Registry search is interactive and was not used. The code is written by Cardinal Cryptography (GitHub org); its relation to Common Labs is not stated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Cardinal-Cryptography/blanksquare-monorepo/security-advisories",
              "detail": "No published security advisories for Cardinal-Cryptography/blanksquare-monorepo.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/Cardinal-Cryptography/blanksquare-monorepo/security-advisories --jq length"
            }
          ],
          "note": "No security incident found in the docs or repository. Service status: on 2026-10-09 the web app and blanksquare.io returned Vercel DEPLOYMENT_NOT_FOUND and the Base relayer host did not resolve; no notice of the shutdown was found, so it is recorded here and in changes only as an observation, not a dated incident.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-07-23",
              "summary": "Shielder proxy deployed with implementation 0xfFF4…8b53 (v0.1.1) and unpaused (tx 0x87a2b37d…53d7); owner the deployer EOA 0x9A3C…bebA, protocol fees 0.",
              "url": "https://basescan.org/tx/0xf63c31263f7dc17c56862a7d763b4d24f1fd9e0f141e488d5d43401730068045"
            },
            {
              "date": "2025-07-28",
              "summary": "Ownership transferred from the deployer EOA to the 2-of-5 Safe 0x9Dc4…2165 (OwnershipTransferred, block 33462649).",
              "url": "https://basescan.org/tx/0x51ee17e500d88c471690cc5d17abf88982e2add8631fb65a5de31e5762f863a9"
            },
            {
              "date": "2025-11-04",
              "summary": "Current version of the Shielder Service terms (restricted-country annex, Panama law).",
              "url": "https://docs.blanksquare.io/other/terms-and-conditions-shielder-service"
            },
            {
              "date": "2026-04-02",
              "summary": "Last transaction that changed the Shielder's Merkle tree (a NewAccount); no tree change since, and the apps and relayer were offline on 2026-10-09.",
              "url": "https://basescan.org/tx/0x7abb4a49363a5a338df618ea184eeac84c5417103c4de8a5b4dfa662365c8c3e"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/address/0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "address": "0x064A67a5484DF6baf36be42F9554d45E7741dCFf",
              "block_number": 52380966,
              "detail": "State read at blocks 33246477, 40000000, 46000000 and 52380966 - the EIP-1967 implementation slot is 0xfFF4…8b53 throughout, fees 0 and paused false; owner() changes from 0x9A3C…bebA to the Safe at block 33462649 (bisected), whose OwnershipTransferred log is in tx 0x51ee17e5…63a9. merkleTree() nextFreeLeafId last changed at block 44167109 (bisected).",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x064A67a5484DF6baf36be42F9554d45E7741dCFf \"owner()(address)\" --block 33462648 --rpc-url https://mainnet.base.org",
              "check": {
                "slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
                "expect": "0x000000000000000000000000fff44d366dedf9b2a531109e1a08bf9873c58b53"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.blanksquare.io/other/terms-and-conditions-shielder-service",
              "archive": "data/archive/blanksquare-shielder-terms.txt",
              "detail": "Terms version date.",
              "checked_at": "2026-10-09",
              "quote": "Terms and Conditions of the Shielder Service, version of 04 November 2025"
            }
          ],
          "note": "Upgrade and pause history comes from state sampling, not a full log scan (public Base RPCs refuse long log ranges), so an upgrade reverted between samples would be missed. The privacy policy is dated 25 July 2025.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 8453,
          "addresses": [
            "0x064A67a5484DF6baf36be42F9554d45E7741dCFf"
          ],
          "topic0": "0xe29a05751186ef5c2f95758981409c90ffb53df312ac3c9045828ca41ca491ed",
          "event": "Withdraw(bytes3 version, address token, uint256 amount, address to, uint256, uint256, address relayer, uint256 fee, uint256, uint256, uint256, uint256 protocolFee, bytes)",
          "amount_word": 2,
          "token_word": 1,
          "window_days": 30,
          "exclusions": "Withdrawals only (the payment leg to the payee). Native ETH appears as token 0x0000…0000. Amounts are gross of relayer fee and protocol fee. NewAccount and Deposit (shielding) events are excluded."
        },
        "note": "All Withdraw fields are non-indexed and in plaintext, so payouts are observable. The tree has not changed since 2026-04-02, so a 30-day window is expected to be empty. Not computed; Base log ranges need an archive RPC (RPC_8453).",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: eth_getLogs: request limit reached"
      },
      "notes": "Transfer protocol; no required closed component, so operator controls are recorded only for the services Common Labs ran (relayer, TEE prover, apps), all offline or dormant on 2026-10-09. Custodial-only controls are left unset (self-custody). Bot facts (B2.1, B2.3, B8.2, B9.x) untouched."
    },
    "coca-card": {
      "slug": "coca-card",
      "facts": {
        "B1.1": {
          "status": "attested",
          "value": "COCA's docs say the cards are \"PCI DSS and ISO compliant\" without naming the ISO standard, the certified entity, the certifier or a certificate. Whether this refers to COCA, its unnamed card programme provider or the issuer is not stated.",
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.coca.xyz/coca/banking-account/overview",
              "archive": "data/archive/coca-card-ops-docs-overview.txt",
              "detail": "Banking account overview, Top-Tier Security section.",
              "checked_at": "2026-10-09",
              "quote": "COCA cards are PCI DSS and ISO compliant",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE statement for CCA Labs FZCO. COCA's docs and the COCA 3.0 post relay that its wallet-infrastructure vendor Privy is SOC 2 Type I and Type II certified; that covers Privy, not COCA, and was not checked.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No independent review of COCA's app, backend or card spending contract found. The docs cite Privy's audits (Cure53, Zellic, Doyensec) and Morpho's audits, which cover those vendors.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No customer incident-notification commitment found in the Wallet Terms, Privacy Notice or docs.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "The Privacy Notice lists business continuity and disaster recovery among processing purposes; no recovery plan is published.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No public status page found (coca.xyz pages and docs read; status subdomains not probed beyond those in the provider file's notes, which did not respond).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Login is through Privy with email, social login or device-based authentication (no seed phrase); 3D Secure is available for card payments and the card can be frozen in the app. No mandatory second factor is described.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.coca.xyz/coca/the-bank-we-all-deserve/is-coca-safe",
              "archive": "data/archive/coca-card-ops-docs-is-coca-safe.txt",
              "detail": "Is COCA safe? page, Privy key management.",
              "checked_at": "2026-10-09",
              "quote": "email, social login, or device-based authentication",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "unknown",
          "note": "The Privacy Notice (dated 4 November 2023) names network and information security as a purpose but states no encryption, TLS or classification measures.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Customer account records normally kept up to six years after the relationship ends; data of never-activated accounts may be deleted after 6 months; with transaction activity, data is kept until the user requests deletion, subject to legal duties. Erasure can be requested. See CROPS P2 for what is collected.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/privacy",
              "archive": "data/archive/coca-card-ops-privacy.txt",
              "detail": "Privacy, Data Use and Retention Notice (dated 4 November 2023), retention section.",
              "checked_at": "2026-10-09",
              "quote": "We normally keep customer account records for up to six years after your relationship with Coca ends",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "CCA Labs FZCO states it is data controller for personal information processed in its business. International transfers rely on authority approval or contracts based on European Commission model clauses. No DPIA statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/privacy",
              "archive": "data/archive/coca-card-ops-privacy.txt",
              "detail": "Privacy Notice opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "Coca is a data controller in respect of personal information",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "unknown",
          "note": "Docs describe an EIP-7702 smart wallet that approves each card authorization, Privy key management and Morpho/Gauntlet yield, but name no chain, address, card provider or issuer; no architecture document.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "CCA Labs FZCO, registered in Dubai Silicon Oasis (UAE), registration number DSO-FZCO-31557, under the COCA Wallet Terms. The card is described as a third-party extension; no card issuer or programme manager is named in any COCA document.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "archive": "data/archive/coca-card-ops-terms.txt",
              "detail": "COCA Wallet Terms (dated 4 November 2023), opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "registration number DSO-FZCO-31557",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "COCA says rewards are funded by card and payment revenue, merchant-funded offers and DeFi yield (Morpho vaults curated by Gauntlet); loyalty tiers require staking the COCA token. Plastic-card and ATM fees apply (see fees). No financial statements found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.coca.xyz/coca/the-bank-we-all-deserve/why-are-rewards-so-high",
              "archive": "data/archive/coca-card-ops-docs-rewards.txt",
              "detail": "Why are rewards so high? page.",
              "checked_at": "2026-10-09",
              "quote": "They allocate a marketing budget to offer rewards",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "COCA may terminate, suspend or limit any user's use at any time without liability; if it withdraws the wallet altogether it will endeavour to give two months' notice; no refund of fees. The user can close the account. COCA says funds stay in the user's self-custodial wallet and private keys can be exported (since August 2026), so balances do not depend on COCA on termination; this is a provider claim not verified in the CROPS file (S1 unknown).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "archive": "data/archive/coca-card-ops-terms.txt",
              "detail": "COCA Wallet Terms, clauses 6 and 7.",
              "checked_at": "2026-10-09",
              "quote": "we may at any time and without liability, terminate, suspend or limit your use or any functionality of the Coca Wallet",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/post/coca-monthly-update-august-2026",
              "archive": "data/archive/coca-card-ops-update-aug-2026.txt",
              "detail": "COCA Monthly Update August 2026, private key export.",
              "checked_at": "2026-10-09",
              "quote": "You can now export your private keys for both the Crypto Wallet and Banking sections",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Yes. The Privacy Notice says application decisions may be taken solely on automated checks (fraud prevention and identity data) for anti-money-laundering and fraud purposes. An AI support chat is on the 2026 roadmap (not in the payment path).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/privacy",
              "archive": "data/archive/coca-card-ops-privacy.txt",
              "detail": "Privacy Notice, automated decision-making.",
              "checked_at": "2026-10-09",
              "quote": "Application decisions may be taken based solely on automated checks",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "Only a rights statement is published (users have rights in relation to automated decision-making in verification); no monitoring, validation, decommissioning or bias documentation.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/privacy",
              "archive": "data/archive/coca-card-ops-privacy.txt",
              "detail": "Privacy Notice, automated decision-making.",
              "checked_at": "2026-10-09",
              "quote": "You have rights in relation to the automated decision-making used in the verification process",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Virtual card free; plastic card 5 USD (Starter to Standard+), free for Premium and above; no annual fee",
            "basis": "COCA Card docs page and banking overview.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "none",
            "amount": "Zero FX fees on direct pairs; other pairs not stated",
            "basis": "Banking overview.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM free up to 250 USD per month, then 2% (card page); the overview says free up to 200 USD",
            "basis": "COCA Card docs page and banking overview disagree on the free allowance.",
            "evidence_index": 0
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Purchases 30,000 EUR per transaction, day and month; ATM 850 EUR per day, 5,000 EUR per month, 5 per day",
            "basis": "COCA Card docs page.",
            "evidence_index": 2
          },
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "Crypto purchases and swaps advertised with \"zero COCA fees\"; third-party fees may apply",
            "basis": "Crypto account docs; the Wallet Terms say third-party fees (card usage, DeFi, staking) are not charged by COCA.",
            "evidence_index": 3
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.coca.xyz/coca/banking-account/coca-card",
            "archive": "data/archive/coca-card-ops-docs-card.txt",
            "detail": "COCA Card page, card fee note and ATM table.",
            "checked_at": "2026-10-09",
            "quote": "Plastic card is 5$ for Starter, Standard & Standard+",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.coca.xyz/coca/banking-account/overview",
            "archive": "data/archive/coca-card-ops-docs-overview.txt",
            "detail": "Banking account overview, Fees.",
            "checked_at": "2026-10-09",
            "quote": "Zero ATM Withdrawals Fees Globally Up to $200",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.coca.xyz/coca/banking-account/coca-card",
            "archive": "data/archive/coca-card-ops-docs-card.txt",
            "detail": "COCA Card page, purchase and ATM limits.",
            "checked_at": "2026-10-09",
            "quote": "Max cash withdrawal amount per day 850 EUR",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.coca.xyz/coca/crypto-account/exchange-assets",
            "archive": "data/archive/coca-card-ops-docs-exchange.txt",
            "detail": "Exchange assets page.",
            "checked_at": "2026-10-09",
            "quote": "Swap assets with Zero COCA Fees",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Card top-up and IBAN transfer fees, the FX rate source, network fees for stablecoin top-ups and any card-to-card transfer fee (shown in-app per the September 2026 update) are not published. Cashback and APY are rewards, not fees, and are not recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "unknown",
        "note": "S1 is unknown in the provider file. COCA describes a self-custodial EIP-7702 smart wallet with Privy keys that approves each card authorization, and since COCA 3.0 (April 2026) claims it cannot access, freeze or move funds; no chain, contract or address is published, so the claim cannot be checked.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "unknown",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.coca.xyz/post/q-a-recap-everything-you-asked-about-coca-3-0-and-more-answered",
            "archive": "data/archive/coca-card-ops-qa-recap.txt",
            "detail": "COCA 3.0 Q&A recap; on DAC8, COCA describes itself as a software provider.",
            "checked_at": "2026-10-09",
            "quote": "current role as a Software Provider",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.coca.xyz/terms",
            "archive": "data/archive/coca-card-ops-terms.txt",
            "detail": "The Wallet Terms describe card use as an extension provided by third-party service providers, unnamed.",
            "checked_at": "2026-10-09",
            "quote": "as an extension provided by third party services providers",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No licence found for any party. COCA names no issuer, programme manager, IBAN provider or regulator, and calls itself a software provider. CCA Labs FZCO holds no licence stated in any COCA document. The Android app id (com.wirex.wallet) and third-party reports point at Wirex as former card infrastructure provider, but no COCA document confirms the current issuer, so no partner licence is recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Unnamed card programme provider and issuer, Visa",
            "fee": "No COCA fee stated for purchases; zero FX on direct pairs",
            "limits": "30,000 EUR per transaction, day and month; residents of the 54 supported countries.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Unnamed issuer, Visa ATMs",
            "fee": "Free up to 250 USD a month, then 2% (overview says 200 USD)",
            "limits": "850 EUR per day, 5,000 EUR per month, 5 withdrawals per day.",
            "evidence_index": 0
          },
          {
            "countries": [
              "AT",
              "BE",
              "BG",
              "CZ",
              "DK",
              "EE",
              "FI",
              "FR",
              "DE",
              "GR",
              "HU",
              "IS",
              "IE",
              "IT",
              "LV",
              "LT",
              "LU",
              "MT",
              "NL",
              "NO",
              "PL",
              "PT",
              "RO",
              "SK",
              "SI",
              "ES",
              "SE",
              "GB"
            ],
            "method": "bank_transfer",
            "partner": "Unnamed IBAN provider (SEPA, EUR)",
            "fee": "Not published",
            "limits": "Personal EUR IBAN since COCA 3.0 (April 2026); USD and ACH announced, not confirmed live.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.coca.xyz/coca/banking-account/coca-card",
            "archive": "data/archive/coca-card-ops-docs-card.txt",
            "detail": "COCA Card page, purchase and ATM limits and fees.",
            "checked_at": "2026-10-09",
            "quote": "Max purchase amount per transaction 30,000 EUR",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.coca.xyz/post/q-a-recap-everything-you-asked-about-coca-3-0-and-more-answered",
            "archive": "data/archive/coca-card-ops-qa-recap.txt",
            "detail": "COCA 3.0 Q&A recap listing the countries whose residents can get an IBAN.",
            "checked_at": "2026-10-09",
            "quote": "Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the UK",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ALL means every country on the card availability list in the provider file. The IBAN list omits Croatia and Cyprus, which are on the card list. Sending from COCA to other bank accounts is described in the COCA 3.0 post.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2023-11-04",
            "what": "COCA Wallet Terms dated 4 November 2023 already define Card Usage; earliest dated primary source for the card. No launch announcement found."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "archive": "data/archive/coca-card-ops-terms.txt",
              "detail": "COCA Wallet Terms header and clause 2(j) Card Usage.",
              "checked_at": "2026-10-09",
              "quote": "Dated: 4 November 2023",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The card has run on rebuilt infrastructure since COCA 3.0 (20 April 2026), which COCA presents as its move to full self-custody.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "CCA Labs FZCO",
            "jurisdiction": "AE-DU",
            "registration_number": "DSO-FZCO-31557"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/terms",
              "archive": "data/archive/coca-card-ops-terms.txt",
              "detail": "COCA Wallet Terms opening paragraph (registered address Dubai Silicon Oasis, DDP, Building A1).",
              "checked_at": "2026-10-09",
              "quote": "registration number DSO-FZCO-31557",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Not checked in the Dubai Integrated Economic Zones register (no public search found), so no register_url.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident report found. Searched coca.xyz/news and the blog feed (monthly updates March to September 2026, COCA 3.0 post and Q&A recap) and docs.coca.xyz. No status page found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2023-11-04",
              "summary": "COCA Wallet Terms and Privacy Notice dated (CCA Labs FZCO; card as third-party extension).",
              "url": "https://www.coca.xyz/terms"
            },
            {
              "date": "2026-04-20",
              "summary": "COCA 3.0 released; COCA says the infrastructure was rebuilt for full self-custody and personal EUR IBANs went live.",
              "url": "https://www.coca.xyz/post/coca-3-0-full-banking-you-control"
            },
            {
              "date": "2026-09-01",
              "summary": "Updated Loyalty Program (claimable rewards, monthly claim capacity, no cashback cap).",
              "url": "https://www.coca.xyz/post/coca-monthly-update-september-2026"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/post/coca-3-0-full-banking-you-control",
              "archive": "data/archive/coca-card-ops-coca-3-0.txt",
              "detail": "COCA 3.0 announcement, 20 April 2026 (updated 23 April).",
              "checked_at": "2026-10-09",
              "quote": "EUR bank accounts are now live",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.coca.xyz/post/coca-monthly-update-september-2026",
              "archive": "data/archive/coca-card-ops-update-sep-2026.txt",
              "detail": "COCA Monthly Update September 2026.",
              "checked_at": "2026-10-09",
              "quote": "On September 1, we launched the updated COCA Loyalty Program",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Private key export for the Banking section arrived in August 2026 (monthly update, archived).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "No listed contracts; the card spending contract, chain and settlement addresses are not published. COCA says it is listed on Paymentscan, a third-party card tracker; provider-reported or third-party figures are not stored.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "coinbase-commerce": {
      "slug": "coinbase-commerce",
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "1% in the sampled payment (0.03 of 3.00 USDC to the operator fee destination)",
            "basis": "feeAmount is set per TransferIntent by Coinbase as operator and sent to its registered fee destination; the Terms point to a Fee page (coinbase.com returns 403 to curl) and allow changes with notice.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Base sample 2026-04-01, about 0.0000012 ETH (235,051 gas at 0.005 gwei plus L1 fee)",
            "basis": "Gas of the last Commerce payment found on Base (swapAndTransferUniswapV3Native, tx 0xb20c…e2fb); varies with Base gas price and payment path.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://basescan.org/tx/0xb20c670013eb85ce88ed2353acca655f0c1463552be8c39b335908fe2cbfe2fb",
            "chain_id": 8453,
            "block_number": 44134913,
            "detail": "Receipt read 2026-10-09: the payer spent 0.001405 ETH, swapped to 3.00 USDC; USDC Transfer of 30000 (0.03) to 0x6d86…29c8 and 2970000 (2.97) to recipient 0xFf56…6E8Af; Transferred log from 0x0305…b7a8 with operator 0x8fcC…73db. gasUsed 235051, effectiveGasPrice 5000150 wei, l1Fee 10808119346 wei.",
            "checked_at": "2026-10-09",
            "recheck": "cast receipt 0xb20c670013eb85ce88ed2353acca655f0c1463552be8c39b335908fe2cbfe2fb --rpc-url https://mainnet.base.org"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
            "archive": "data/archive/coinbase-commerce-terms.txt",
            "detail": "Commerce Terms (last updated 2025-10-29), Fees section.",
            "checked_at": "2026-10-09",
            "quote": "We reserve the right to change those fee(s) at our discretion with notice",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The fee rate is from one observed payment, not from a fee schedule; the Fee page the Terms cite could not be read. The swap path adds Uniswap pool fees and slippage, paid by the payer, which are not itemised. No limits were found.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 2
          },
          {
            "criterion": "S4",
            "index": 2
          }
        ],
        "note": "Agrees with S1 (score 3). Payments move payer to merchant wallet atomically; the Terms say Coinbase does not store the crypto merchants receive. Stray balances in the contract can be swept by an owner-appointed sweeper; they are not payment funds.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.bma.bm/regulated-entities",
            "archive": "data/archive/coinbase-commerce-ops-bma-register.txt",
            "detail": "The Bermuda Monetary Authority's register of regulated entities lists two Coinbase affiliates (Coinbase Bermuda Limited and Coinbase Bermuda Services Limited, both Class F digital asset business licences) and no entry for Coinbase Bermuda Technologies Limited.",
            "checked_at": "2026-10-09",
            "quote": "Coinbase Bermuda Services Limited",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
            "archive": "data/archive/coinbase-commerce-terms.txt",
            "detail": "The Commerce Terms name Coinbase Bermuda Technologies Limited as the provider and cite no licence or regulator for it.",
            "checked_at": "2026-10-09",
            "quote": "Coinbase Bermuda Technologies Limited",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Absent for the contracting entity. Searched: the BMA regulated-entities register (full page, string \"Coinbase Bermuda Technologies\" not found), the Commerce Terms and Privacy Policy. The affiliate Coinbase Bermuda Services Limited holds a BMA Class F licence covering payment services with digital assets (registration 202302681, effective 2023-09-15), but no Commerce document names it, so it is not recorded as a partner licence. Other Coinbase group licences (US, EU, UK) were not searched because the Commerce Terms name only the Bermuda entity.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "Payments settle to the merchant's own wallet; the Terms say Coinbase does not store the crypto received. Converting it to local currency is outside the product.",
        "burden": "institution",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
            "archive": "data/archive/coinbase-commerce-terms.txt",
            "detail": "Commerce Terms on the Merchant Wallet.",
            "checked_at": "2026-10-09",
            "quote": "We do not store the cryptocurrency you receive as payment",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The Privacy Policy mentions affiliates converting crypto to fiat and withdrawing to a bank account; no first-party cash-out terms for Commerce merchants were found (help.coinbase.com returns 403).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2024-10-14",
            "block": 21073248,
            "what": "Transfers 0x0305…b7a8 on Base, the contract that carried Base payments; the README address 0xeADE…4971 was deployed earlier, at block 17832328 (2024-07-31)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x03059433BCdB6144624cC2443159D9445C32b7a8?fields=deployment",
              "address": "0x03059433BCdB6144624cC2443159D9445C32b7a8",
              "chain_id": 8453,
              "block_number": 21073248,
              "detail": "Sourcify creation data gives transactionHash 0x84f4bb975782746100fde2d23fd5250cfebb8efa26b9f6a97808cdaa22ae6f62, blockNumber 21073248, deployer 0x8899CECFD929504414696C734eAf6300FDbB428C (the owner EOA); block time 2024-10-14 UTC.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://sourcify.dev/server/v2/contract/8453/0x03059433BCdB6144624cC2443159D9445C32b7a8?fields=deployment\" && cast block 21073248 --field timestamp --rpc-url https://mainnet.base.org"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0xeADE6bE02d043b3550bE19E960504dbA14A14971?fields=deployment",
              "address": "0xeADE6bE02d043b3550bE19E960504dbA14A14971",
              "chain_id": 8453,
              "block_number": 17832328,
              "detail": "Sourcify creation data gives tx 0x29836b71657b710efae9c81e34220aca20a40049e410e2f68bdffb8cc69d82ea at block 17832328 by the same deployer; block time 2024-07-31 UTC.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://sourcify.dev/server/v2/contract/8453/0xeADE6bE02d043b3550bE19E960504dbA14A14971?fields=deployment\""
            }
          ],
          "note": "Judgment call. Recorded the primary settlement contract (0x0305…b7a8). The protocol has earlier Base deployments that are not in the provider's contracts list (DefiLlama tracks six Base addresses), so the rail is older than this date; those were not dated here.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Coinbase Bermuda Technologies Limited",
            "jurisdiction": "BM"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
              "archive": "data/archive/coinbase-commerce-terms.txt",
              "detail": "Commerce Terms (last updated 2025-10-29) name the provider of the Services.",
              "checked_at": "2026-10-09",
              "quote": "Coinbase Bermuda Technologies Limited",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "From the Terms only; the Bermuda Registrar of Companies entry was not looked up (its search is not machine-readable), so there is no register URL or number.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2024-03-27",
              "summary": "Web3 retail payments degradation (status page, impact minor).",
              "funds_lost": "unknown",
              "url": "https://status.commerce.coinbase.com/incidents/2ll0btt8tp4d"
            },
            {
              "date": "2024-04-21",
              "summary": "Payments from Coinbase retail accounts unavailable; self-custodial wallet payments continued (impact minor).",
              "funds_lost": "unknown",
              "url": "https://status.commerce.coinbase.com/incidents/5g16f3zz5jrj"
            },
            {
              "date": "2024-04-21",
              "summary": "Donations on Commerce unavailable; status update says funds are safe (impact minor).",
              "funds_lost": "no",
              "url": "https://status.commerce.coinbase.com/incidents/r07r2lxc8287"
            },
            {
              "date": "2025-09-17",
              "summary": "Delayed payment confirmations from Coinbase accounts and self-custodial wallets on Polygon; transactions submitted but did not confirm (impact minor).",
              "funds_lost": "unknown",
              "url": "https://status.commerce.coinbase.com/incidents/nb8gn8xlwcqh"
            },
            {
              "date": "2025-10-20",
              "summary": "Coinbase-wide login and transaction outage caused by an AWS outage; status update says funds are safe (impact minor).",
              "funds_lost": "no",
              "url": "https://status.commerce.coinbase.com/incidents/zmr4w5wymh0n"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.commerce.coinbase.com/api/v2/incidents.json",
              "detail": "Statuspage incidents feed, 50 incidents from 2021-01-06 to 2026-03-20; listed here are those since 2024 (the onchain-protocol period) with impact above none.",
              "checked_at": "2026-10-09",
              "quote": "Delayed Payment Confirmation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Service incidents only; no security incident or loss of payment funds was found. Searched: the Commerce status page feed, the protocol repo (no SECURITY file, no advisories) and the org SECURITY.md. The 2025 Coinbase customer data incident concerned Coinbase retail accounts and is not recorded for Commerce; no Commerce primary source mentions it.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2024-10-14",
              "summary": "New Transfers contract 0x0305…b7a8 deployed on Base from source that was never pushed to the repo (permit nonce fix); it carried Base payments from then on.",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x03059433BCdB6144624cC2443159D9445C32b7a8"
            },
            {
              "date": "2025-10-29",
              "summary": "Commerce Terms of Service updated (current version).",
              "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service"
            },
            {
              "date": "2026-04-01",
              "summary": "Last Transferred event found on Base in the seed scan (block 44134913); none found since in sampled windows. Coinbase now directs Commerce merchants to the Coinbase Business Checkouts API.",
              "url": "https://basescan.org/tx/0xb20c670013eb85ce88ed2353acca655f0c1463552be8c39b335908fe2cbfe2fb"
            },
            {
              "date": "2026-09-22",
              "summary": "OnchainKit, the public checkout SDK, deprecated and its repository archived.",
              "url": "https://github.com/coinbase/onchainkit"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.cdp.coinbase.com/coinbase-business/checkout-apis/migrate-from-commerce/overview",
              "detail": "CDP migration guide from the Commerce Charge API to the Checkouts API (undated page).",
              "checked_at": "2026-10-09",
              "quote": "Migrate from Commerce Charge API to the Checkouts API",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "O1",
              "index": 0
            },
            {
              "criterion": "O2",
              "index": 1
            }
          ],
          "note": "The product appears to be winding down; no dated first-party retirement notice was found (coinbase.com returns 403).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 8453,
          "addresses": [
            "0x03059433BCdB6144624cC2443159D9445C32b7a8",
            "0xeADE6bE02d043b3550bE19E960504dbA14A14971"
          ],
          "topic0": "0xb7ee4fafa10d16ee883a136a3dcc9179d8e6041ba71cc29c2b0bce4f7bdd6e86",
          "event": "Transferred(address indexed operator, bytes16 id, address recipient, address sender, uint256 spentAmount, address spentCurrency)",
          "amount_word": 3,
          "token_word": 4,
          "window_days": 30,
          "exclusions": "spentAmount (word 3) is what the payer spent in spentCurrency (word 4; zero address = native ETH), including the operator fee and before any swap, so sums are per payer-side currency. All operators are counted, not only Coinbase's. Gross observed."
        },
        "note": "Spec checked against the log in tx 0xb20c…e2fb (word 3 = 1405295302545581, word 4 = 0). The seed scan found no Transferred event on Base after 2026-04-01, so a 30-day window will likely return zero events. Not computed; the maintainer runs scripts/volumes.mjs.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: eth_getLogs: request limit reached"
      },
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/contents/?ref=master",
              "detail": "coinbase/commerce-onchain-payment-protocol: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/contents/?ref=main",
              "detail": "coinbase/onchainkit (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/contents/?ref=master",
              "detail": "coinbase/coinbase-commerce-php: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
              "archive": "data/archive/coinbase-commerce-terms.txt",
              "detail": "The Commerce Terms contain no patch or vulnerability-remediation commitment.",
              "checked_at": "2026-10-09",
              "quote": "Coinbase Commerce Terms of Service",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S6",
              "index": 1
            }
          ],
          "note": "Searched: Commerce Terms and Privacy Policy (archived), the protocol repo, and the coinbase org SECURITY.md (points to HackerOne, no timelines). coinbase.com/security returns 403 and has no Wayback snapshot.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": true,
                "detail": "scanning step in a workflow"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/contents/?ref=master",
              "detail": "coinbase/commerce-onchain-payment-protocol: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/contents/?ref=main",
              "detail": "coinbase/onchainkit (archived): scanning step in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/contents/?ref=master",
              "detail": "coinbase/coinbase-commerce-php: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260611115217/https://www.coinbase.com/en-ca/legal/commerce/privacy-policy",
              "archive": "data/archive/coinbase-commerce-privacy.txt",
              "detail": "The Commerce Privacy Policy (2024-12-03) has no breach-notification commitment; the Terms have none either.",
              "checked_at": "2026-10-09",
              "quote": "Coinbase Commerce Privacy Policy",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Searched both documents for notify, notification, breach and incident; the only notice commitment concerns changes to the arbitration agreement.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Statuspage at status.commerce.coinbase.com with 50 incidents since 2021; updates are short status notes and no post-mortem with root cause was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.commerce.coinbase.com",
              "detail": "Public status page with email and SMS subscription.",
              "checked_at": "2026-10-09",
              "quote": "Coinbase Commerce Status",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.commerce.coinbase.com/api/v2/incidents.json",
              "detail": "Incident feed with update texts.",
              "checked_at": "2026-10-09",
              "quote": "Donations on Commerce Unavailable",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "The SDK checkout calls Coinbase's JSON-RPC endpoint with a public CDP client key in the URL path; no OAuth, OpenID Connect or JWT on the Commerce path. The successor Checkouts API uses JWT bearer tokens.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.cdp.coinbase.com/coinbase-business/checkout-apis/migrate-from-commerce/overview",
              "detail": "Migration guide contrasts the Commerce X-CC-Api-Key header with the Checkouts API's bearer token with a CDP API key.",
              "checked_at": "2026-10-09",
              "quote": "Switch from API key to JWT Bearer tokens",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S5",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Charge API calls use a static X-CC-Api-Key header held server-side; webhooks are HMAC-SHA256 signed and verified in constant time by the reference client. No key scoping or rotation is documented.",
          "refs": [
            {
              "criterion": "S5",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Information is retained as needed under internal retention policies, with no fixed periods; on account closure data is retained or deleted per the policy. Coinbase may terminate access with immediate effect.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260611115217/https://www.coinbase.com/en-ca/legal/commerce/privacy-policy",
              "archive": "data/archive/coinbase-commerce-privacy.txt",
              "detail": "Section 4 of the Commerce Privacy Policy.",
              "checked_at": "2026-10-09",
              "quote": "We retain your information as needed to provide our Services",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Coinbase Bermuda Technologies Limited processes merchant and user data under the policy; processing it does as processor on behalf of merchants is excluded from the policy. No DPIA is mentioned.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260611115217/https://www.coinbase.com/en-ca/legal/commerce/privacy-policy",
              "archive": "data/archive/coinbase-commerce-privacy.txt",
              "detail": "Scope paragraph of the Commerce Privacy Policy.",
              "checked_at": "2026-10-09",
              "quote": "This Policy does not apply to any processing which Coinbase Commerce carries out as a processor on behalf of Customers",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260611115217/https://www.coinbase.com/en-ca/legal/commerce/privacy-policy",
              "archive": "data/archive/coinbase-commerce-privacy.txt",
              "detail": "The policy says Coinbase acts as processor for merchants but neither it nor the Terms reference a data processing agreement.",
              "checked_at": "2026-10-09",
              "quote": "as a processor on behalf of Customers",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Searched the Terms and Privacy Policy for processing agreement, addendum and DPA; the Wayback Machine has no snapshot of coinbase.com/legal/commerce/data-processing-agreement; coinbase.com returns 403 to curl.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/contents/?ref=master",
              "detail": "coinbase/commerce-onchain-payment-protocol: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/contents/?ref=main",
              "detail": "coinbase/onchainkit (archived): no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/contents/?ref=master",
              "detail": "coinbase/coinbase-commerce-php: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, required_status_checks, required_signatures, required_linear_history"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, required_status_checks, required_signatures, required_linear_history"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, required_status_checks, required_signatures, required_linear_history"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/rules/branches/master",
              "detail": "coinbase/commerce-onchain-payment-protocol: rules: deletion, non_fast_forward, pull_request, required_status_checks, required_signatures, required_linear_history",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/rules/branches/main",
              "detail": "coinbase/onchainkit (archived): rules: deletion, non_fast_forward, pull_request, required_status_checks, required_signatures, required_linear_history",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/rules/branches/master",
              "detail": "coinbase/coinbase-commerce-php: rules: deletion, non_fast_forward, pull_request, required_status_checks, required_signatures, required_linear_history",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": true,
                "detail": "14 workflow file(s)"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/contents/?ref=master",
              "detail": "coinbase/commerce-onchain-payment-protocol: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/contents/?ref=main",
              "detail": "coinbase/onchainkit (archived): 14 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/contents/?ref=master",
              "detail": "coinbase/coinbase-commerce-php: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/contents/?ref=master",
              "detail": "coinbase/commerce-onchain-payment-protocol: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/contents/?ref=main",
              "detail": "coinbase/onchainkit (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/contents/?ref=master",
              "detail": "coinbase/coinbase-commerce-php: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/contents/?ref=master",
              "detail": "coinbase/commerce-onchain-payment-protocol: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/contents/?ref=main",
              "detail": "coinbase/onchainkit (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/contents/?ref=master",
              "detail": "coinbase/coinbase-commerce-php: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": true,
                "detail": "latest tags: v0.38.2, v0.38.1, v0.38.0"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": true,
                "detail": "latest tags: v1.0.1, v1.0.0, 1.0.11"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/tags",
              "detail": "coinbase/commerce-onchain-payment-protocol: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/tags",
              "detail": "coinbase/onchainkit (archived): latest tags: v0.38.2, v0.38.1, v0.38.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/tags",
              "detail": "coinbase/coinbase-commerce-php: latest tags: v1.0.1, v1.0.0, 1.0.11",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": true,
                "detail": "4 of 8 recent commits signed"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": true,
                "detail": "7 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/commits?per_page=10",
              "detail": "coinbase/commerce-onchain-payment-protocol: 4 of 8 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/commits?per_page=10",
              "detail": "coinbase/onchainkit (archived): 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/commits?per_page=10",
              "detail": "coinbase/coinbase-commerce-php: 7 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": true,
                "detail": "6 release(s) with notes"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": true,
                "detail": "1 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/contents/?ref=master",
              "detail": "coinbase/commerce-onchain-payment-protocol: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/contents/?ref=main",
              "detail": "coinbase/onchainkit (archived): 6 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/contents/?ref=master",
              "detail": "coinbase/coinbase-commerce-php: 1 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "coinbase/commerce-onchain-payment-protocol",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "coinbase/onchainkit (archived)",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "coinbase/coinbase-commerce-php",
                "ok": true,
                "detail": "contribution section in README"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/commerce-onchain-payment-protocol/contents/?ref=master",
              "detail": "coinbase/commerce-onchain-payment-protocol: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/onchainkit/contents/?ref=main",
              "detail": "coinbase/onchainkit (archived): contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/coinbase/coinbase-commerce-php/contents/?ref=master",
              "detail": "coinbase/coinbase-commerce-php: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical view only. The protocol README explains operators, TransferIntent signing and the contract methods; no infrastructure or integration architecture for the Charge API, signer or checkout is published.",
          "refs": [
            {
              "criterion": "C2",
              "index": 0
            },
            {
              "criterion": "O3",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Coinbase Bermuda Technologies Limited, Bermuda; the Terms' dispute clauses provide for AAA arbitration.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
              "archive": "data/archive/coinbase-commerce-terms.txt",
              "detail": "Commerce Terms opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "Coinbase Bermuda Technologies Limited",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Company-register entry not looked up; see maturity.entity.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Transaction fees charged to merchants (1% observed in a 2026-04-01 payment, paid to the operator's fee destination), within the Coinbase group.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/tx/0xb20c670013eb85ce88ed2353acca655f0c1463552be8c39b335908fe2cbfe2fb",
              "chain_id": 8453,
              "block_number": 44134913,
              "detail": "0.03 USDC of a 3.00 USDC payment went to the operator fee destination 0x6d86…29c8.",
              "checked_at": "2026-10-09",
              "recheck": "cast receipt 0xb20c670013eb85ce88ed2353acca655f0c1463552be8c39b335908fe2cbfe2fb --rpc-url https://mainnet.base.org"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Coinbase may terminate or suspend access with immediate effect, for any reason and without notice. Funds are already in the merchant's own wallet, so termination does not hold funds; data follows the privacy policy's retention rules.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://web.archive.org/web/20260930113606/https://www.coinbase.com/legal/commerce/terms-of-service",
              "archive": "data/archive/coinbase-commerce-terms.txt",
              "detail": "Termination section of the Commerce Terms.",
              "checked_at": "2026-10-09",
              "quote": "We may terminate or suspend your access to and use of the Services with immediate effect",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 2
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "unknown",
          "note": "The Privacy Policy says Commerce analyses public blockchain data, including wallet addresses, to detect fraud and abuse, and the operator can refuse to sign intents; whether that screening is automated or uses AI is not stated, and the API and signer are closed. Searched the Terms, Privacy Policy and protocol README for automated, machine learning and artificial intelligence.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      }
    },
    "curvy": {
      "slug": "curvy",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/contents/?ref=main",
              "detail": "0xCurvy/contracts: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/contents/?ref=main",
              "detail": "0xCurvy/sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/contents/?ref=main",
              "detail": "0xCurvy/rs-core: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/contents/?ref=main",
              "detail": "0xCurvy/payments-sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/contents/?ref=main",
              "detail": "0xCurvy/docs: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/contents/?ref=main",
              "detail": "0xCurvy/contracts: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/contents/?ref=main",
              "detail": "0xCurvy/sdk: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/contents/?ref=main",
              "detail": "0xCurvy/rs-core: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/contents/?ref=main",
              "detail": "0xCurvy/payments-sdk: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/contents/?ref=main",
              "detail": "0xCurvy/docs: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/contents/?ref=main",
              "detail": "0xCurvy/contracts: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/contents/?ref=main",
              "detail": "0xCurvy/sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/contents/?ref=main",
              "detail": "0xCurvy/rs-core: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/contents/?ref=main",
              "detail": "0xCurvy/payments-sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/contents/?ref=main",
              "detail": "0xCurvy/docs: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": false,
                "detail": "rules: deletion, non_fast_forward"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/rules/branches/main",
              "detail": "0xCurvy/contracts: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/rules/branches/main",
              "detail": "0xCurvy/sdk: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/rules/branches/main",
              "detail": "0xCurvy/rs-core: rules: deletion, non_fast_forward",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/rules/branches/main",
              "detail": "0xCurvy/payments-sdk: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/rules/branches/main",
              "detail": "0xCurvy/docs: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": true,
                "detail": "2 workflow file(s)"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/contents/?ref=main",
              "detail": "0xCurvy/contracts: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/contents/?ref=main",
              "detail": "0xCurvy/sdk: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/contents/?ref=main",
              "detail": "0xCurvy/rs-core: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/contents/?ref=main",
              "detail": "0xCurvy/payments-sdk: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/contents/?ref=main",
              "detail": "0xCurvy/docs: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/contents/?ref=main",
              "detail": "0xCurvy/contracts: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/contents/?ref=main",
              "detail": "0xCurvy/sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/contents/?ref=main",
              "detail": "0xCurvy/rs-core: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/contents/?ref=main",
              "detail": "0xCurvy/payments-sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/contents/?ref=main",
              "detail": "0xCurvy/docs: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/contents/?ref=main",
              "detail": "0xCurvy/contracts: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/contents/?ref=main",
              "detail": "0xCurvy/sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/contents/?ref=main",
              "detail": "0xCurvy/rs-core: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/contents/?ref=main",
              "detail": "0xCurvy/payments-sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/contents/?ref=main",
              "detail": "0xCurvy/docs: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": true,
                "detail": "latest tags: v0.0.8-rc.2"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": true,
                "detail": "latest tags: v0.1.3, v0.1.2, v0.1.1"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": true,
                "detail": "latest tags: v0.2.0-rc.4, v0.2.0-rc.3, v0.2.0-rc.2"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/tags",
              "detail": "0xCurvy/contracts: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/tags",
              "detail": "0xCurvy/sdk: latest tags: v0.0.8-rc.2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/tags",
              "detail": "0xCurvy/rs-core: latest tags: v0.1.3, v0.1.2, v0.1.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/tags",
              "detail": "0xCurvy/payments-sdk: latest tags: v0.2.0-rc.4, v0.2.0-rc.3, v0.2.0-rc.2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/tags",
              "detail": "0xCurvy/docs: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "3 of 10 recent commits signed"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "3 of 10 recent commits signed"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/commits?per_page=10",
              "detail": "0xCurvy/contracts: 3 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/commits?per_page=10",
              "detail": "0xCurvy/sdk: 3 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/commits?per_page=10",
              "detail": "0xCurvy/rs-core: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/commits?per_page=10",
              "detail": "0xCurvy/payments-sdk: 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/commits?per_page=10",
              "detail": "0xCurvy/docs: 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/contents/?ref=main",
              "detail": "0xCurvy/contracts: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/contents/?ref=main",
              "detail": "0xCurvy/sdk: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/contents/?ref=main",
              "detail": "0xCurvy/rs-core: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/contents/?ref=main",
              "detail": "0xCurvy/payments-sdk: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/contents/?ref=main",
              "detail": "0xCurvy/docs: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xCurvy/contracts",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "0xCurvy/sdk",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "0xCurvy/rs-core",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "0xCurvy/payments-sdk",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "0xCurvy/docs",
                "ok": true,
                "detail": "contribution section in README"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/contents/?ref=main",
              "detail": "0xCurvy/contracts: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/sdk/contents/?ref=main",
              "detail": "0xCurvy/sdk: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/rs-core/contents/?ref=main",
              "detail": "0xCurvy/rs-core: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/payments-sdk/contents/?ref=main",
              "detail": "0xCurvy/payments-sdk: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/docs/contents/?ref=main",
              "detail": "0xCurvy/docs: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found for Curvy Tech d.o.o. in the docs repository, privacy policy or website.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No hosting or support organisation certification found for the API, Portal Broadcaster or key host.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "Ethernal audit (23 March to 15 April 2026) of the V1 contracts at commit 5f6e43cf, published in the contracts repository; the deployed V2 contracts and the hosted API, broadcaster and key host are not covered.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration test of the hosted services found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "The privacy policy (25 February 2026) has no incident notification commitment, and no terms of service exist to search.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "status.curvy.box does not resolve and the docs link no status page or post-mortem.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "Users log in with an EIP-712 wallet signature (or a WebAuthn PRF passkey); the API then uses a bearer JWT that the SDK refreshes; some endpoints take anonymous single-use Privacy Pass tokens instead of the JWT.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/for-programmers/authentication.md#L1-L3",
              "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
              "path": "docs/for-programmers/authentication.md",
              "detail": "Authentication page says login relies on EIP-712 signatures, with passkey login as an alternative.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/src/http/index.ts#L78-L90",
              "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
              "path": "src/http/index.ts",
              "detail": "The SDK HTTP client attaches \"Authorization Bearer\" with the session token only when a request's identity policy asks for it.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Applies to the hosted Curvy API, which the SDK requires at start-up (C3).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "The SDK refreshes the JWT every 14 minutes; the server-side token lifetime is not documented.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/sdk/blob/75ce11eda3ea9521f6ed81f0019787eee0a9080c/src/constants/intervals.ts#L2",
              "commit": "75ce11eda3ea9521f6ed81f0019787eee0a9080c",
              "path": "src/constants/intervals.ts",
              "detail": "JWT_REFRESH_INTERVAL = 14 * 60 * 1000 ms.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "The privacy policy states encryption in transit, secure infrastructure environments, access controls and limited collection; no data classification, encryption at rest or TLS version is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://curvy.box/privacy-policy",
              "detail": "Privacy policy section 11, security.",
              "checked_at": "2026-10-09",
              "quote": "Encryption in transit",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Communication data \"as long as necessary\", security logs for \"a limited operational period\", compliance flags per legal requirements; no periods are given and deletion is on request where applicable. On-chain data is permanent.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://curvy.box/privacy-policy",
              "detail": "Privacy policy section 7, data retention.",
              "checked_at": "2026-10-09",
              "quote": "Security logs for a limited operational period",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The privacy policy speaks for \"Curvy\" without naming a legal entity, controller or processor, and mentions no DPIA; it gives GDPR legal bases and shares data with hosting, analytics and blockchain analytics providers.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://curvy.box/privacy-policy",
              "detail": "Privacy policy introduction and section 6.",
              "checked_at": "2026-10-09",
              "quote": "Welcome to Curvy",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "The contracts README describes the hub-and-spoke deployment (aggregator on Arbitrum, portal factories elsewhere) and the docs repository covers the logical building blocks (portals, privacy aggregator, Curvy ID, compliance model); the hosted API and broadcaster infrastructure are not described.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/README.md#L28-L40",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "README.md",
              "detail": "Contracts README, deployment layout by chain.",
              "checked_at": "2026-10-09"
            }
          ],
          "refs": [
            {
              "criterion": "P3",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Curvy Tech d.o.o. Beograd (Serbia), per the docs FAQ, which adds that an EU holding entity is being set up. No terms of service name a contracting party.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/faq.md#L63-L67",
              "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
              "path": "docs/faq.md",
              "detail": "FAQ \"Where is Curvy incorporated?\".",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The Serbian Business Registers Agency search (pretraga2.apr.gov.rs) did not connect from this environment, so no register entry is cited.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Protocol fees collected by the vault (deposit 10 bps, withdrawal 20 bps, per-token gas fees) to a fee collector that is the AUTHORITY Safe; the FAQ says Curvy earns revenue through these fees.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/faq.md#L10-L18",
              "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
              "path": "docs/faq.md",
              "detail": "FAQ \"How does Curvy make money?\".",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/address/0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
              "address": "0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
              "chain_id": 42161,
              "block_number": 513202075,
              "detail": "feeCollectorAddress() returns Safe 0xB2c1…4b9F.",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00 \"feeCollectorAddress()(address)\" --rpc-url https://arb1.arbitrum.io/rpc --block 513202075"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://curvy.box/privacy-policy",
              "detail": "The privacy policy is the only legal page; it has no termination terms.",
              "checked_at": "2026-10-09",
              "quote": "We do not custody user funds.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Searched: curvy.box/terms, /terms-of-use, /tos, /imprint and /legal (all 404), the privacy policy, and the docs repository. Withdrawals and portal recovery are permissionless onchain (C2, S4), but no document says what happens to API accounts, Curvy IDs or data on termination.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Automated risk scoring by Global Ledger decides whether the Curvy-operated Portal Broadcaster deploys a shield portal; the privacy policy says sanctions and AML screening and risk scoring may apply. No statement on whether AI or a learned model is used.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://curvy.box/privacy-policy",
              "detail": "Privacy policy section 3, compliance and risk monitoring.",
              "checked_at": "2026-10-09",
              "quote": "Risk scoring may be applied to transactions.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "The compliance model describes pre-emptive scoring and a planned retroactive tainting mechanism (work in progress); no appeal or override, monitoring, validation, decommissioning or bias evaluation is documented.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/for-the-curious/compliance-model.md#L16-L31",
              "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
              "path": "docs/for-the-curious/compliance-model.md",
              "detail": "Compliance model, pre-emptive and retroactive checks.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Deposit (shield) fee 10 bps of the gross amount",
            "basis": "CurvyVaultV2.depositFee() = 10 at Arbitrum block 513202075; set by the AUTHORITY Safe, capped at 10% (MAX_FEE 1000 bps).",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "Withdrawal (unshield) fee 20 bps",
            "basis": "CurvyVaultV2.withdrawalFee() = 20 at the same block; same setter and cap.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "Aggregation fee 0 onchain (FAQ states 0.1%)",
            "basis": "CurvyAggregatorAlphaV2.protocolFeePerThousand() = 0 at the same block, enforced through the aggregation proof; the FAQ's 0.1% is not in force.",
            "evidence_index": 1
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "USDC gas fees 0.014557 portal deployment, 0.023026 note commitment, 0.021973 withdrawal",
            "basis": "perTokenGasFees(2) for USDC; fixed per-token amounts set by Curvy, deducted from the note.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://arbitrum.blockscout.com/address/0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
            "address": "0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
            "chain_id": 42161,
            "block_number": 513202075,
            "detail": "depositFee() = 10, withdrawalFee() = 20, perTokenGasFees(2) = (2, 14557, 23026, 21973); token 2 is USDC 0xaf88…5831 (getTokenAddress(2)).",
            "checked_at": "2026-10-09",
            "check": {
              "call": "0x67a52793",
              "expect": "0x000000000000000000000000000000000000000000000000000000000000000a"
            },
            "recheck": "cast call 0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00 \"depositFee()(uint96)\" --rpc-url https://arb1.arbitrum.io/rpc && cast call 0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00 \"perTokenGasFees(uint256)((uint256,uint256,uint256,uint256))\" 2 --rpc-url https://arb1.arbitrum.io/rpc",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://arbitrum.blockscout.com/address/0xE51924cEF003a654EC9735c4d97f5D4862cBcbB1",
            "address": "0xE51924cEF003a654EC9735c4d97f5D4862cBcbB1",
            "chain_id": 42161,
            "block_number": 513202075,
            "detail": "protocolFeePerThousand() = 0.",
            "checked_at": "2026-10-09",
            "check": {
              "call": "0xe6a014cb",
              "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
            },
            "recheck": "cast call 0xE51924cEF003a654EC9735c4d97f5D4862cBcbB1 \"protocolFeePerThousand()(uint256)\" --rpc-url https://arb1.arbitrum.io/rpc",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/faq.md#L10-L18",
            "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
            "path": "docs/faq.md",
            "detail": "FAQ lists shielding 0.1%, aggregation 0.1% and unshielding 0.2%.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Judgment call: the withdrawal fee is recorded as paid by the payee, since the note holder unshielding pays it. Gas fees for other tokens differ per token (read perTokenGasFees(tokenId)). Cross-chain payments also bear the bridge cost, absorbed by the merchant in the Payments SDK. The app and relayer may add costs not visible onchain.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with S1 (score 1): funds sit in the CurvyVaultV2 proxy and leave only on a valid withdrawal proof or portal recovery; the privacy policy says Curvy does not custody funds. The disclosed risk is that the 4-of-6 Safe can upgrade the vault with no timelock (S2 = 1), and shielding depends on Curvy's operator.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.nbs.rs/en/ciljevi-i-funkcije/nadzor-nad-finansijskim-institucijama/digital-imo/reg_di/",
            "detail": "National Bank of Serbia register of virtual currency service providers lists three entities (Vescon, MCM 965, AX Crypto); Curvy Tech d.o.o. is not among them.",
            "checked_at": "2026-10-09",
            "quote": "Register of virtual currency service providers",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/faq.md#L63-L67",
            "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
            "path": "docs/faq.md",
            "detail": "FAQ names Curvy Tech d.o.o. Beograd as the incorporated entity; no licence is mentioned anywhere in the docs or privacy policy.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Searched: NBS virtual currency service provider register, the docs repository and the privacy policy. Not searched: the Serbian Securities Commission register for digital token service providers, and EU MiCA registers (the EU holding entity is described as in progress).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "Withdrawals pay tokens to the address encoded in the proof; converting them to local currency is outside the protocol and Curvy's hosted services.",
        "burden": "institution",
        "refs": [
          {
            "criterion": "C2",
            "index": 0
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-07-28",
            "block": 488602304,
            "what": "CurvyVaultV2 ERC1967 proxy 0xcC8d…4f00 on Arbitrum One (tx 0x90553cc1…9c4e); the aggregator proxy followed at block 488602314. V1 contracts on Arbitrum are older and outside the unit."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/tx/0x90553cc181b3ddef129dfa4008f0e8d17e26123d708c3f61f060061ef3df9c4e",
              "address": "0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
              "chain_id": 42161,
              "block_number": 488602304,
              "detail": "The receipt of tx 0x90553cc1…9c4e has contractAddress 0xcC8d…4f00 in block 488602304, timestamp 1785242107 (2026-07-28 12:35:07 UTC).",
              "checked_at": "2026-10-09",
              "recheck": "cast receipt 0x90553cc181b3ddef129dfa4008f0e8d17e26123d708c3f61f060061ef3df9c4e contractAddress --rpc-url https://arb1.arbitrum.io/rpc && cast block 488602304 --field timestamp --rpc-url https://arb1.arbitrum.io/rpc"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/contracts/blob/e996fe719580f4d82ff34f06ee8a0916df65a613/evm/ignition/deployments/production_arbitrum_v2/journal.jsonl#L51-L53",
              "commit": "e996fe719580f4d82ff34f06ee8a0916df65a613",
              "path": "evm/ignition/deployments/production_arbitrum_v2/journal.jsonl",
              "detail": "The Ignition journal records the CurvyVault ERC1967Proxy deployment with the same transaction hash.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Curvy Tech d.o.o. Beograd",
            "jurisdiction": "RS"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/0xCurvy/docs/blob/73d17acd6a35d0aa4ba4c15f3717fcef3895d5df/docs/faq.md#L63-L67",
              "commit": "73d17acd6a35d0aa4ba4c15f3717fcef3895d5df",
              "path": "docs/faq.md",
              "detail": "FAQ \"Where is Curvy incorporated?\" names Curvy Tech d.o.o. Beograd in Serbia and an EU holding entity in progress.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No company register entry; the Serbian Business Registers Agency search did not connect. The privacy policy names no entity.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xCurvy/contracts/security-advisories",
              "detail": "The contracts repository's published security advisories list is empty.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/0xCurvy/contracts/security-advisories --jq length"
            }
          ],
          "note": "Searched: GitHub advisories, the docs repository and the privacy policy. No incident affecting the V2 Arbitrum contracts found. Third-party incident databases were not used.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-07-28",
              "summary": "V2 vault and aggregator deployed on Arbitrum (blocks 488602245 to 488602416), replacing the audited V1 stack.",
              "url": "https://arbitrum.blockscout.com/tx/0x90553cc181b3ddef129dfa4008f0e8d17e26123d708c3f61f060061ef3df9c4e"
            },
            {
              "date": "2026-08-24",
              "summary": "Vault and aggregator upgraded in one Safe transaction to implementations 0xBf38…eEb0 and 0x855d…3F0A, with no timelock.",
              "url": "https://arbitrum.blockscout.com/tx/0xe7e2d7214a05c38650ea29c2735f38a964337ceeabdbf74eefb20f797e6f532c"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://arbitrum.blockscout.com/tx/0xe7e2d7214a05c38650ea29c2735f38a964337ceeabdbf74eefb20f797e6f532c",
              "address": "0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00",
              "chain_id": 42161,
              "block_number": 497924661,
              "detail": "Upgraded(address) logs from the vault (to 0xBf38…eEb0) and the aggregator (to 0x855d…3F0A) in tx 0xe7e2d721…532c at block 497924661, timestamp 1787583116 (2026-08-24 14:51:56 UTC).",
              "checked_at": "2026-10-09",
              "recheck": "cast logs --from-block 497924661 --to-block 497924661 --address 0xcC8d5c60A8fb15Aa3793647eF531f1bA7dF24f00 0xbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b --rpc-url https://arb1.arbitrum.io/rpc"
            }
          ],
          "note": "The privacy policy was last updated 25 February 2026. FeeChange events were not enumerated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "Amounts are public but not expressible in the spec format. The aggregator's PendingNotes event carries tokens and amounts in dynamic arrays, so they have no fixed word index. The vault's Deposit and Withdraw events keep the token in an indexed topic, which a spec cannot read, so amounts of ETH, USDC and other tokens would be summed together. A spec needs topic-based token selection or array decoding.",
        "note": "Not a statement that settlement is hidden; with a token filter on topic1, Vault Deposit/Withdraw (word 0 = amount) would give gross shield and unshield flows per token.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "daimo-pay": {
      "slug": "daimo-pay",
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "no published fee; relayer keeps any surplus over the payee minimum (2026-10-07 sample, 30 USDC in and out)",
            "basis": "The executor only checks that the payee receives minOutputAmount, computed from Daimo-signed prices and the session's slippage bps; any surplus goes to the relayer. Commercial pricing is set off-chain per organisation and not published.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "one ERC-20 transfer (or native send) to the session's deposit address, at the source chain's gas price",
            "basis": "The SDK's crypto flow sends the exact amount to the deposit address; no approval is needed (CROPS S3).",
            "evidence_index": 1
          },
          {
            "kind": "network",
            "paid_by": "none",
            "amount": "relayer-paid settlement gas, Base sample 2026-10-07, about 0.0000196 ETH (3,057,526 gas at 0.0064 gwei)",
            "basis": "sameChainFinish submitted by the relayer EOA through the DaimoPayRelayer wrapper (tx 0x8d3d…bd00); the gas includes deploying the deposit address. Recovered by Daimo through pricing not visible here.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://basescan.org/tx/0x8d3d409f5ca6bef78bf3b88f48bc92cf085cc192ee04399b2b7323edf417bd00",
            "chain_id": 8453,
            "block_number": 52280330,
            "detail": "Receipt read 2026-10-09: from relayer 0xA9C3…4E2f to wrapper 0xc88f…eE04; SameChainFinish from the manager with paymentToken USDC, paymentAmount 30000000 and outputAmount 30000000; gasUsed 3057526, effectiveGasPrice 6411200 wei, l1Fee 34968834359 wei. Block time 2026-10-07 05:13 UTC.",
            "checked_at": "2026-10-09",
            "recheck": "cast receipt 0x8d3d409f5ca6bef78bf3b88f48bc92cf085cc192ee04399b2b7323edf417bd00 --rpc-url https://mainnet.base.org"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/sdk/src/web/hooks/useWalletFlow.ts#L648-L668",
            "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
            "path": "packages/sdk/src/web/hooks/useWalletFlow.ts",
            "detail": "The EVM payment is a single transfer(depositAddress, amount) or native send.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "refs": [
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S1",
            "index": 2
          }
        ],
        "note": "Searched for a fee schedule: docs.daimo.com (all guides and the API reference, no fee or pricing page), daimo.com/pricing (404), the terms and privacy notice. Fiat rails and exchange deposits may carry partner fees that were not itemised. No FX margin or limits are published; the relayer surplus is bounded by maxSameChainFinishSlippageBps and related params per session.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S1",
            "index": 3
          }
        ],
        "note": "Judgment call. The payer self-custodies until deposit, but funds in flight sit in a deposit address that only the Daimo-run manager and relayers can release, and the relayer runs arbitrary calls on them. Recorded as provider-custodial in flight rather than hybrid. Agrees with S1 (score 0). Daimo's privacy notice calls it noncustodial.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://daimo.com/privacy",
            "detail": "The privacy notice says Daimo does not act as a financial institution or custodian; neither it nor the terms name a licence or regulator.",
            "checked_at": "2026-10-09",
            "quote": "do not act as a financial institution or custodian",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://daimo.com/terms-of-use",
            "detail": "Terms of use (last updated 2025-04-01) name Daimo, Inc. and cite no licence.",
            "checked_at": "2026-10-09",
            "quote": "We are Daimo, Inc.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Searched: terms of use, privacy notice, docs (fiat guide names Coinbase and Stripe onramps and Sumsub KYC as partners). Not searched: the FinCEN MSB registrant search and state money-transmitter registers (form-based), and the fiat partners' own licences, which are not recorded because no Daimo document names the licensed entity.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "The payee receives stablecoins to its own address; converting them to local currency is outside the product. Daimo's fiat rails are pay-in only, and its Withdrawals component sends stablecoins to a recipient address.",
        "burden": "institution",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.daimo.com/guides/fiat",
            "detail": "Fiat guide covers deposits from local bank and wallet rails only.",
            "checked_at": "2026-10-09",
            "quote": "Users in a country with no enabled fiat rail see crypto, exchange, and wallet",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-06-23",
            "block": 47696940,
            "what": "DepositAddressManager 0xfca1…09b6 on Base, deployed through CREATE3 factory 0x3792…5ffd by 0x723a…5227 (tx 0x7f2a…2a45)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/tx/0x7f2a98fd7979380aef79205e44839889e0b1f1beea9448c26b293f882adc2a45",
              "address": "0xfca14E46d74d7673168e95b5f625bf2847B009b6",
              "chain_id": 8453,
              "block_number": 47696940,
              "detail": "The receipt (status 1) carries the manager's OwnershipTransferred log; eth_getCode for the manager is empty at block 47696939 and non-empty at 47696940; block time 2026-06-23 02:53 UTC. Sourcify has no creation data for this address (runtime-only match).",
              "checked_at": "2026-10-09",
              "recheck": "cast code 0xfca14E46d74d7673168e95b5f625bf2847B009b6 --block 47696939 --rpc-url https://mainnet.base.org && cast receipt 0x7f2a98fd7979380aef79205e44839889e0b1f1beea9448c26b293f882adc2a45 --rpc-url https://mainnet.base.org"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/daimo-eth/sdk/blob/ac0a71453ac249aa991d71059c621e2424322d61/packages/contract/broadcast/DeployDepositAddressManager.s.sol/8453/run-latest.json#L1-L89",
              "commit": "ac0a71453ac249aa991d71059c621e2424322d61",
              "path": "packages/contract/broadcast/DeployDepositAddressManager.s.sol/8453/run-latest.json",
              "detail": "Foundry broadcast for Base records the deploy transaction hash and block 47696940.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "This is the current deposit-address system, the unit of assessment. Daimo ran earlier payment contracts (DaimoPay/PayIntent, then Universal Address) before it; those are not dated here.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Daimo, Inc.",
            "jurisdiction": "US"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/terms-of-use",
              "detail": "Terms name Daimo, Inc., give a Santa Monica, California address and choose California law.",
              "checked_at": "2026-10-09",
              "quote": "3101 Ocean Park Blvd Ste 100",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "From the terms only. The state of incorporation is not stated and no company-register entry was looked up, so there is no register URL.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/security-advisories",
              "detail": "The repository's published security advisories list is empty.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/daimo-eth/sdk/security-advisories --jq length"
            }
          ],
          "note": "Searched: GitHub security advisories, the docs, and status.daimo.com (UptimeRobot; history is client-rendered and was not read). No incident was found from a primary source.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-12-17",
              "summary": "Deposit-address contracts added to the repo (commit c990a190), replacing the Universal Address design.",
              "url": "https://github.com/daimo-eth/sdk/commit/c990a190af9b7cfbf7c922a0e8f0f9ad191f1dc5"
            },
            {
              "date": "2026-01-08",
              "summary": "Universal Address contracts, the only audited code (Nethermind NM-0585), deleted from the repo (commit 99c3f248).",
              "url": "https://github.com/daimo-eth/sdk/commit/99c3f248a7458106eafeb5eb7778db143115a6a8"
            },
            {
              "date": "2026-06-23",
              "summary": "Current DepositAddressManager deployed on Base at block 47696940.",
              "url": "https://basescan.org/tx/0x7f2a98fd7979380aef79205e44839889e0b1f1beea9448c26b293f882adc2a45"
            }
          ],
          "refs": [
            {
              "criterion": "S6",
              "index": 1
            }
          ],
          "note": "Dates of the two repo changes are commit dates read through the GitHub API. Earlier DaimoPay/PayIntent contracts remain in the repo but are not used by @daimo/sdk 1.8.x.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 8453,
          "addresses": [
            "0xfca14E46d74d7673168e95b5f625bf2847B009b6"
          ],
          "topic0": "0x4b27129020863e95e8f8f7cb9e957cce497bbc4b358e20fab274c20812f96cd6",
          "event": "SameChainFinish(address indexed depositAddress, DAParams params, address paymentToken, uint256 paymentAmount, uint256 outputAmount, uint256 paymentTokenPriceUsd, uint256 toTokenPriceUsd)",
          "token_word": 1,
          "amount_word": 2,
          "window_days": 30,
          "exclusions": "Same-chain Base settlements only. Cross-chain payments emit Start on the source chain and FastFinish or Claim on the destination and are not counted. paymentAmount (word 2) in paymentToken (word 1) is what the deposit address held; outputAmount to the payee is word 3. Word 0 is the offset of the dynamic DAParams tuple. Gross observed."
        },
        "note": "Spec checked against the live log in tx 0x8d3d…bd00 (topic0 equals keccak of the full tuple signature; word 1 USDC, word 2 = 30000000). Not computed; the maintainer runs scripts/volumes.mjs.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: eth_getLogs: request limit reached"
      },
      "facts": {
        "B1.4": {
          "status": "evidenced",
          "value": "Nethermind audit NM-0585 (2025-07) covers code that is no longer deployed; see CROPS S6.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            },
            {
              "criterion": "S6",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/contents/?ref=master",
              "detail": "daimo-eth/sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/terms-of-use",
              "detail": "The terms of use contain no patch or vulnerability-remediation commitment.",
              "checked_at": "2026-10-09",
              "quote": "We are Daimo, Inc.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S6",
              "index": 1
            }
          ],
          "note": "Searched: terms, privacy notice, docs.daimo.com, daimo.com/.well-known/security.txt (404) and the repo (no SECURITY file).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/contents/?ref=master",
              "detail": "daimo-eth/sdk: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/privacy",
              "detail": "The privacy notice's security section makes no incident-notification commitment, and the terms have none.",
              "checked_at": "2026-10-09",
              "quote": "We have organizational and technical processes and procedures in place to protect your personal information",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Status page at status.daimo.com (UptimeRobot); no post-mortem found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.daimo.com",
              "detail": "Public status page with uptime history and email subscription; its incident history is client-rendered and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Daimo Status",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "Browser calls use a per-session client secret (UUID) that grants access only to that session; no OAuth, OpenID Connect or JWT.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/api-reference/overview",
              "detail": "API overview, authentication section.",
              "checked_at": "2026-10-09",
              "quote": "Each session has its own client secret",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S5",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Server calls use one account-wide API key as a bearer token; webhooks are HMAC-SHA256 signed. No key scoping or rotation is documented.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/guides/sessions",
              "detail": "Sessions guide, credential model.",
              "checked_at": "2026-10-09",
              "quote": "Your account-wide API key",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S5",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "Client secrets are scoped to one session, and sessions carry an expiresAt and end in a terminal state; no expiry is documented for the account API key.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/guides/sessions",
              "detail": "Sessions guide lists terminal statuses including expired; the session object carries expiresAt.",
              "checked_at": "2026-10-09",
              "quote": "Terminal statuses",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Personal information is kept as long as necessary for the notice's purposes, then deleted or anonymised; no fixed periods. Termination is at Daimo's discretion without notice; funds already delivered are with the payee.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/privacy",
              "detail": "Section 3 of the privacy notice (last updated 2026-02-28).",
              "checked_at": "2026-10-09",
              "quote": "We will only keep your personal information for as long as it is necessary",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 2
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The privacy notice is issued by Daimo, Inc. for its own processing; controller and processor roles toward integrating merchants are not defined, and no DPIA is mentioned.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/privacy",
              "detail": "Opening of the privacy notice.",
              "checked_at": "2026-10-09",
              "quote": "This privacy notice for Daimo, Inc",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/privacy",
              "detail": "Neither the privacy notice nor the terms reference a data processing agreement.",
              "checked_at": "2026-10-09",
              "quote": "This privacy notice for Daimo, Inc",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Searched the privacy notice, terms and docs for processing agreement, DPA and addendum.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/contents/?ref=master",
              "detail": "daimo-eth/sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "rules: deletion, non_fast_forward"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/rules/branches/master",
              "detail": "daimo-eth/sdk: rules: deletion, non_fast_forward",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/contents/?ref=master",
              "detail": "daimo-eth/sdk: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/contents/?ref=master",
              "detail": "daimo-eth/sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/contents/?ref=master",
              "detail": "daimo-eth/sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/tags",
              "detail": "daimo-eth/sdk: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": true,
                "detail": "6 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/commits?per_page=10",
              "detail": "daimo-eth/sdk: 6 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/contents/?ref=master",
              "detail": "daimo-eth/sdk: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "daimo-eth/sdk",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/daimo-eth/sdk/contents/?ref=master",
              "detail": "daimo-eth/sdk: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Integration view only. The docs describe the session lifecycle and credential model; the contracts README covers building and testing; no logical or infrastructure architecture of the API, relayer, price signer or indexer is published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.daimo.com/guides/sessions",
              "detail": "Sessions guide with a status diagram and credential model.",
              "checked_at": "2026-10-09",
              "quote": "Terminal statuses",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "O3",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Daimo, Inc., Santa Monica, California, United States; terms governed by California law.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/terms-of-use",
              "detail": "Governing-law clause of the terms of use.",
              "checked_at": "2026-10-09",
              "quote": "governed by and construed in accordance with the laws of the State of California",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "unknown",
          "note": "No primary source on funding was found: no pricing page (daimo.com/pricing returns 404), no fee schedule in the docs, terms or privacy notice. Onchain, the relayer may keep a surplus within the session's slippage bound (see fees).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Daimo may deny access to anyone without notice or liability. Delivered funds sit with payees; undelivered deposits can be refunded by anyone after expiry if the session parameters are known (CROPS S4).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://daimo.com/terms-of-use",
              "detail": "Term and termination section.",
              "checked_at": "2026-10-09",
              "quote": "WITHOUT NOTICE OR LIABILITY, DENY ACCESS",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "unknown",
          "note": "The privacy notice says information is processed for fraud monitoring and prevention, and the closed API and relayer decide which deposits settle; whether that uses automated screening or AI is not stated and cannot be seen from public code. Searched the terms, privacy notice and docs for automated, machine learning, artificial intelligence and screening.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      }
    },
    "deblock-card": {
      "slug": "deblock-card",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found on deblock.com (legal notice, cards, pricing, about, press; /en/security returns 404), in the 274 public help articles (intercom.help/deblock) or in the Client Terms v12.3. The privacy policy loads only through Deblock's token-protected API and was not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "Same search as B1.1. The legal notice names Vercel Inc (servers in the European Union) as website host; the hosting of the app and ledger is not stated, and no certificate was found for either.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE 3402 statement found in the same search.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No independent code review report found; CROPS S6 is unknown for this provider.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report, attestation or bug bounty found (help centre keyword search for penetration, pentest, bug bounty returned nothing).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No patch timelines in the Client Terms v12.3 or the help centre.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No customer incident-notification time found. The Client Terms (s3.7) say Deblock will email or text the client if it suspects unauthorised access to that client's account, without a time limit.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "The Client Terms (s11.5) promise only best efforts for service continuity; no recovery plan is described.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Public status page (status.deblock.com, StatusPal) with per-service status and an incident and maintenance history back to 2024-10-07. Incident entries carry short cause statements (for example the 2026-09-04 Visa settlement issue); no separate post-mortem documents were found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/deblock/en/articles/14805793-service-status-outages",
              "detail": "Help article pointing customers to status.deblock.com, listing the services covered and the subscription option.",
              "checked_at": "2026-10-09",
              "quote": "this is your go-to page to check the real-time status of all Deblock services",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.deblock.com/incidents",
              "detail": "Incident and maintenance history, 30 entries from 2024-10-07 to 2026-10-02.",
              "checked_at": "2026-10-09",
              "quote": "Incident & maintenance history",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Access only through the app on the user's phone, with a passcode or device biometrics; sensitive operations (payments, transfers to external accounts, viewing card numbers and IBANs, crypto actions) require strong authentication with a 4-digit code or biometrics plus possession of the registered \"Key Smartphone\". A selfie check is required after reinstalling the app.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/deblock/en/articles/8921705-how-can-i-keep-my-account-safe",
              "detail": "Help article \"How can I keep my account safe?\".",
              "checked_at": "2026-10-09",
              "quote": "Your account can only be accessed through the app on your phone, there is no other way",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn1.deblock.com/terms/personal-terms/FR/20260223-v12.3-personal-terms-EN.pdf",
              "archive": "data/archive/deblock-card-ops-terms.txt",
              "detail": "Client Terms v12.3 s8.4 Strong Authentication (PDF; excerpt archived).",
              "checked_at": "2026-10-09",
              "quote": "the authentication via the 4-digit code can be replaced by a biometric authentication managed by their smartphone"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "note": "No idle-session timeout stated. The Terms (s8.3) only advise the client to close the app when not in use.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "No public API documentation found for personal or business accounts; the card product is used through Deblock's own apps.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "note": "Monthly statements download in the app (help article 14136786) and a transaction report is available on request (Terms s3.6); no API export, volume limit or export logging found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "No data classification or encryption-at-rest statement found (the privacy policy was not readable without Deblock's API token). Observed: deblock.com refuses TLS 1.1 and accepts TLS 1.2.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://deblock.com",
              "detail": "openssl s_client -tls1_1 to deblock.com:443 failed with alert protocol version; -tls1_2 negotiated ECDHE-RSA-CHACHA20-POLY1305. Run 2026-10-09 with LibreSSL 3.3.6.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect deblock.com:443 -servername deblock.com -tls1_1; echo | openssl s_client -connect deblock.com:443 -servername deblock.com -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "unknown",
          "note": "The Client Terms (s13) say data may be kept after closure \"for other legal reasons\" without periods, and funds left after closure can be claimed for six years (s9.3). Retention periods are in the privacy policy, which loads only through Deblock's token-protected API and was not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Deblock SAS is data controller, with a Data Protection Officer (dpo@deblock.com) and the CNIL as supervisory authority. No processor list (the KYC provider is unnamed in the provider file) and no DPIA statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://deblock.com/en/legal-notice",
              "detail": "Legal notice s5, Personal data protection.",
              "checked_at": "2026-10-09",
              "quote": "Deblock SAS processes personal data as a data controller",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "note": "The account-closure help article says closure decisions are recorded for audit and regulatory review; no statement on login or activity logging.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "unknown",
          "note": "No architecture documentation found. The Terms describe the crypto wallet's 2-of-2 key-shard design in prose (s3.3, s5.1); nothing covers the e-money ledger or card stack.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Deblock SAS, French société par actions simplifiée, SIREN 948 264 163 (RCS Lille Métropole), Lille; French law and French courts govern the Client Terms. Deblock is itself the EMI and card issuer (direct Visa member per its cards page).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn1.deblock.com/terms/personal-terms/FR/20260223-v12.3-personal-terms-EN.pdf",
              "archive": "data/archive/deblock-card-ops-terms.txt",
              "detail": "Client Terms v12.3 (23 Feb 2026) preamble naming the contracting entity (PDF; excerpt archived).",
              "checked_at": "2026-10-09",
              "quote": "registered under number 948 264 163 in the Trade and Companies Register of Lille"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://recherche-entreprises.api.gouv.fr/search?q=948264163",
              "detail": "French government company search API (annuaire-entreprises.data.gouv.fr data); active legal unit DEBLOCK, SIREN 948264163.",
              "checked_at": "2026-10-09",
              "quote": "\"siren\":\"948264163\",\"siren_conserve\":null,\"nom_complet\":\"DEBLOCK (DEBLOCK)\"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Customer fees and paid plans (Premium at 10 EUR a month; crypto buy, sell and swap fees of 1.99% on Standard and 0.49% on Premium; ATM and FX fees beyond allowances). No financial statements or funding disclosures found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://deblock.com/en/pricing-plans",
              "detail": "Pricing plans page.",
              "checked_at": "2026-10-09",
              "quote": "Premium 10€ /mo",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Client may close at any time for free. Deblock may terminate without giving reasons on two months' email notice, or immediately on listed grounds (missing source-of-funds information, false documents, abnormal use, suspected fraud, reputational harm, legal order). Balance is sent to the client's bank account; at least 60 days to withdraw, then a minimum 1 EUR fee per transfer, and funds can be claimed for six years. On closure Deblock hands over its key shard so the client keeps the self-custodial crypto wallet.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn1.deblock.com/terms/personal-terms/FR/20260223-v12.3-personal-terms-EN.pdf",
              "archive": "data/archive/deblock-card-ops-terms.txt",
              "detail": "Client Terms v12.3 s9.1 (initiated by Deblock).",
              "checked_at": "2026-10-09",
              "quote": "by notification via email, after the expiry of a two-month notice period"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn1.deblock.com/terms/personal-terms/FR/20260223-v12.3-personal-terms-EN.pdf",
              "archive": "data/archive/deblock-card-ops-terms.txt",
              "detail": "Client Terms v12.3 s9.3 and s9.5.",
              "checked_at": "2026-10-09",
              "quote": "we will give the Client at least 60 days to withdraw the money we hold for the Client"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "unknown",
          "note": "The Client Terms (s8.5) say Deblock may set up monitoring systems for anti-money-laundering checks, without saying whether they are automated or use AI. Automated decision-making would be disclosed in the privacy policy, which was not readable without Deblock's API token.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Standard plan free; Premium 10 EUR per month",
            "basis": "Pricing plans page; fees may change under the Client Terms s1.4 with 60 days to decline.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Virtual cards free; physical card delivery fee on Standard (shown in app); up to 3 physical cards free on Premium",
            "basis": "Help articles 8911205 and 8911216; Standard delivery fee amount not published.",
            "evidence_index": 1
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "First 500 EUR a month free of markup; then Standard 0.5% weekdays, 1% weekends; Premium 0%",
            "basis": "Help article 8911354. The cards page says 0% FX on card payments abroad, which conflicts for Standard users beyond the allowance.",
            "evidence_index": 2
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM: 1% (min 1 EUR) beyond the plan allowance, plus any ATM operator surcharge",
            "basis": "Help article 11093412 (allowance Standard 1 withdrawal or 100 EUR a month, Premium 5 or 1,000 EUR; limits 15,000 EUR a month Standard, 30,000 EUR Premium, 1,000 EUR a day).",
            "evidence_index": 3
          },
          {
            "kind": "cashout",
            "paid_by": "none",
            "amount": "SEPA and SEPA Instant transfers out free",
            "basis": "Help article 8913029; Terms s6.1 allow cross-border or SWIFT fees for other currencies.",
            "evidence_index": 4
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Crypto sell (crypto to EUR): 1.99% Standard, 0.49% Premium",
            "basis": "Pricing plans page; applies to the self-custodial wallet off-ramp into the e-money account.",
            "evidence_index": 0
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Each card payment capped at 10,000 EUR",
            "basis": "Help article 8911134; Deblock says the cap may change.",
            "evidence_index": 5
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://deblock.com/en/pricing-plans",
            "detail": "Pricing plans page (Standard and Premium columns).",
            "checked_at": "2026-10-09",
            "quote": "Premium 10€ /mo",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/8911216-are-there-any-fees-for-ordering-a-physical-card",
            "detail": "Help article on physical card fees.",
            "checked_at": "2026-10-09",
            "quote": "Standard plan subscribers will be charged a delivery fee when ordering a physical card",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/8911354-are-there-any-fees-for-making-card-payments",
            "detail": "Help article on card payment and FX fees.",
            "checked_at": "2026-10-09",
            "quote": "Standard: 0.5% on weekdays, 1% on weekends",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/11093412-what-are-the-limits-and-fees-for-atm-withdrawals",
            "detail": "Help article on ATM limits and fees.",
            "checked_at": "2026-10-09",
            "quote": "A 1% Deblock fee applies to the amount withdrawn, with a minimum of €1 per withdrawal",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/8913029-are-there-any-fees-to-send-transfers",
            "detail": "Help article on outgoing transfer fees.",
            "checked_at": "2026-10-09",
            "quote": "Sending transfers is completely free",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/8911134-are-there-any-limits-to-how-much-money-i-can-spend-on-my-cards",
            "detail": "Help article on card spending limits.",
            "checked_at": "2026-10-09",
            "quote": "each card payment you make is capped at €10,000",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Card top-ups into the account are free up to 2,000 EUR a month, then a fee shown in the app (help article 11087296); a funding fee, not recorded above. Insurance and cashback are plan benefits, not fees.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "The card spends a Deblock-issued e-money balance, safeguarded in client money accounts at banks (Terms s8.1). The separate crypto wallet is a 2-of-2 key-shard wallet with one shard on Deblock's backend; it is outside the card path, as in the S1 finding.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "Deblock SAS",
            "holder": "provider",
            "country": "FR",
            "regulator": "Autorité de contrôle prudentiel et de résolution (ACPR)",
            "type": "Electronic money institution (agrément)",
            "number": "CIB 17748",
            "activities": "Issuing and distributing e-money; authorised 2023-11-22, active; free-provision-of-services passports to 29 other EEA states from 2024-09-04",
            "register_url": "https://www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-autorisations/records?where=id_referentiel%3D%22732211%22",
            "evidence_index": 0
          },
          {
            "entity": "Deblock SAS",
            "holder": "provider",
            "country": "FR",
            "regulator": "Autorité des marchés financiers (AMF)",
            "type": "Crypto-asset service provider (MiCA)",
            "number": "A2025-001",
            "activities": "Exchange of crypto-assets for funds and for other crypto-assets, execution of orders; authorised 2025-05-23, notified for 29 other EEA states",
            "register_url": "https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-autorisations/records?where=id_referentiel%3D%22732211%22",
            "detail": "ACPR REGAFI register open-data API, authorisation record for DEBLOCK (id 732211, SIREN 948264163, CIB 17748, LEI 254900XTUI35BGIBXP21); category Établissement de Monnaie Électronique, nature Agrément. The entity record is in dataset prd-banque-entites and the 29 outbound passports in prd-banque-passeports-sortants.",
            "checked_at": "2026-10-09",
            "quote": "\"id_referentiel\": \"732211\", \"id_autorisation\": \"36579\", \"date_debut\": \"2023-11-22\", \"situation\": \"ACTIF\"",
            "recheck": "curl -s 'https://www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-entites/records?where=siren%3D%22948264163%22'",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv",
            "detail": "ESMA interim MiCA register of authorised CASPs; row for DEBLOCK SAS (AMF, authorised 23/05/2025).",
            "checked_at": "2026-10-09",
            "quote": "DEBLOCK SAS,254900XTUI35BGIBXP21",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The register lists DEBLOCK as an EMI with no card-issuing licence separate from the EMI authorisation; Deblock's cards page says it is a direct Visa member (provider statement, not checked against Visa).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "FR"
            ],
            "method": "card_spend",
            "partner": "Deblock SAS (issuer), Visa",
            "fee": "No card payment fee; FX markup beyond 500 EUR a month on Standard (0.5% weekdays, 1% weekends)",
            "limits": "10,000 EUR per card payment; card works at Visa merchants worldwide.",
            "evidence_index": 0
          },
          {
            "countries": [
              "FR"
            ],
            "method": "atm",
            "partner": "Deblock SAS (issuer), Visa",
            "fee": "Free allowance by plan, then 1% (min 1 EUR) plus operator surcharge",
            "limits": "15,000 EUR a month (Standard) or 30,000 EUR (Premium); 1,000 EUR a day; any Visa ATM, including abroad.",
            "evidence_index": 1
          },
          {
            "countries": [
              "FR"
            ],
            "method": "bank_transfer",
            "partner": "SEPA (Deblock SAS as EMI)",
            "fee": "Free (SEPA and SEPA Instant)",
            "limits": "Euro SEPA only; other international transfers not yet supported per help article 8912244.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/8899846-do-my-cards-work-in-all-countries",
            "detail": "Help article on card acceptance abroad.",
            "checked_at": "2026-10-09",
            "quote": "work globally in the Visa network",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/11093412-what-are-the-limits-and-fees-for-atm-withdrawals",
            "detail": "Help article on ATM limits and fees.",
            "checked_at": "2026-10-09",
            "quote": "Includes 1 free withdrawal or up to €100/month without any Deblock fees",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/deblock/en/articles/8913029-are-there-any-fees-to-send-transfers",
            "detail": "Help article on outgoing transfers.",
            "checked_at": "2026-10-09",
            "quote": "Sending transfers is completely free",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://cdn1.deblock.com/terms/personal-terms/FR/20260223-v12.3-personal-terms-EN.pdf",
            "archive": "data/archive/deblock-card-ops-terms.txt",
            "detail": "Client Terms v12.3 (French version, s3.5) require legal residence in France to open an account.",
            "checked_at": "2026-10-09",
            "quote": "The Client must be 18 or over and a legal resident in France to open a Deblock Account"
          }
        ],
        "note": "Countries: the only first-party eligibility statement found is the French Client Terms v12.3 (residence in France). The same Terms mention clients residing in Germany (PayPal top-ups), the ACPR register shows passports into 29 other EEA states, and the site has French Pacific locales, so other residents may be served under terms versions not read; the provider file has no availability block. Crypto off-ramp into the e-money account (fee in `fees`) precedes any of these routes.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2023-11-22",
            "what": "ACPR authorisation of Deblock SAS as an electronic money institution (regulator date); no dated public launch of the account or card was found."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-autorisations/records?where=id_referentiel%3D%22732211%22",
              "detail": "REGAFI authorisation record, date_debut 2023-11-22.",
              "checked_at": "2026-10-09",
              "quote": "\"date_debut\": \"2023-11-22\", \"situation\": \"ACTIF\"",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The card cannot have been issued to customers before the e-money authorisation; the earliest status-page entry is 2024-10-07, and the about page says the company was founded in October 2022.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Deblock SAS",
            "jurisdiction": "FR",
            "register_url": "https://recherche-entreprises.api.gouv.fr/search?q=948264163",
            "registration_number": "SIREN 948 264 163 (RCS Lille Métropole)"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://recherche-entreprises.api.gouv.fr/search?q=948264163",
              "detail": "French government company search API; legal unit created 2023-01-16, active, NAF 63.11Z, head office 612 rue de la Chaude Rivière, Lille.",
              "checked_at": "2026-10-09",
              "quote": "\"siren\":\"948264163\",\"siren_conserve\":null,\"nom_complet\":\"DEBLOCK (DEBLOCK)\"",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://deblock.com/en/legal-notice",
              "detail": "Legal notice naming the publisher and its registration.",
              "checked_at": "2026-10-09",
              "quote": "Deblock SAS is authorised as an electronic money institution by the French Prudential Supervision and Resolution Authority",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-12-19",
              "summary": "Platform outage affecting all services including card payments and SEPA transfers, 31 minutes (status page, major incident).",
              "funds_lost": "unknown",
              "url": "https://status.deblock.com/incidents/216835"
            },
            {
              "date": "2026-02-04",
              "summary": "Services down for 27 minutes; a fix was rolled out to all services (status page, major incident).",
              "funds_lost": "unknown",
              "url": "https://status.deblock.com/incidents/221752"
            },
            {
              "date": "2026-08-04",
              "summary": "Degraded performance affecting crypto transactions, card payments and app access (status page, major incident).",
              "funds_lost": "unknown",
              "url": "https://status.deblock.com/incidents/244780"
            },
            {
              "date": "2026-09-04",
              "summary": "All Deblock card transactions declined for about 3 hours because Visa's settlement system stopped registering the funds Deblock holds with Visa; Deblock states no customer funds were affected.",
              "funds_lost": "no",
              "url": "https://status.deblock.com/incidents/247956"
            },
            {
              "date": "2026-10-02",
              "summary": "Card payments declined for some customers despite sufficient funds, 13 minutes (status page, major incident).",
              "funds_lost": "unknown",
              "url": "https://status.deblock.com/incidents/250403"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.deblock.com/incidents/247956",
              "detail": "Status page incident entry for the 2026-09-04 Visa settlement issue.",
              "checked_at": "2026-10-09",
              "quote": "Visa's settlement system (VPS) stopped registering the funds we hold with them to cover card spending",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Selected from the 30 status-page entries (2024-10-07 to 2026-10-02) the major incidents touching card payments or all services; minor incidents and scheduled maintenance are omitted. No security incident or data breach notice was found on deblock.com or in the help centre.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2023-01-16",
              "summary": "Legal unit DEBLOCK (SIREN 948 264 163) created (French company register).",
              "url": "https://recherche-entreprises.api.gouv.fr/search?q=948264163"
            },
            {
              "date": "2023-11-22",
              "summary": "Authorised by the ACPR as an electronic money institution (CIB 17748).",
              "url": "https://www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-autorisations/records?where=id_referentiel%3D%22732211%22"
            },
            {
              "date": "2024-09-04",
              "summary": "E-money free-provision-of-services passports registered for 29 other EEA states.",
              "url": "https://www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-passeports-sortants/records?where=id_referentiel%3D732211&limit=50"
            },
            {
              "date": "2025-05-23",
              "summary": "Authorised as a crypto-asset service provider under MiCA by the AMF (A2025-001).",
              "url": "https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv"
            },
            {
              "date": "2026-02-23",
              "summary": "Client Terms and Conditions version 12.3 dated.",
              "url": "https://cdn1.deblock.com/terms/personal-terms/FR/20260223-v12.3-personal-terms-EN.pdf"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.regafi.fr/api/explore/v2.1/catalog/datasets/prd-banque-passeports-sortants/records?where=id_referentiel%3D732211&limit=50",
              "detail": "REGAFI outbound passport records for Deblock (29 rows, all Libre prestation de services from 2024-09-04).",
              "checked_at": "2026-10-09",
              "quote": "\"type_passeport\": \"Libre prestation de services\"",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv",
              "detail": "ESMA interim MiCA CASP register row for Deblock, authorisation date 23/05/2025.",
              "checked_at": "2026-10-09",
              "quote": "DEBLOCK SAS,254900XTUI35BGIBXP21",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "Closed e-money ledger and Visa card issuing with no listed contracts; card settlement is not on any public chain. Deblock publishes no transaction volumes that could be checked.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "ethena-pay": {
      "slug": "ethena-pay",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement, security page or trust centre found on pay.ethena.fi (/security returns 404; legal hub, FAQ, privacy, terms, disclaimers read). Rain and Third National not checked.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Sign-in uses passkeys with Face ID or fingerprint (the passkey is the wallet owner key per CROPS findings); no separate second factor is described.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/blog/introducing-ethena-pay",
              "detail": "Launch post, 3 September 2026.",
              "checked_at": "2026-10-09",
              "quote": "with sign-in secured by passkeys and Face ID or fingerprint and data encrypted end to end",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "The privacy policy states access controls, encryption \"where appropriate\", network security, monitoring and logging; the launch post claims data \"encrypted end to end\". No data classification and no TLS version stated; no TLS scan recorded.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/privacy",
              "detail": "Privacy Policy (last updated 18 May 2026), security section.",
              "checked_at": "2026-10-09",
              "quote": "These safeguards include, where appropriate, access controls, encryption, network security measures, monitoring, logging, and employee training",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Published retention table: KYC/CDD 5 years after the relationship ends; transactions 5 years; screening results relationship + 5 years; account profile account life + 1 year; device and usage data 12 months; support records 3 years; security incident records 5 years. Data is deleted or anonymised at the end of the period or on a valid deletion request, subject to exceptions.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/privacy",
              "detail": "Privacy Policy retention table.",
              "checked_at": "2026-10-09",
              "quote": "5 years after the end of the business relationship",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Ethena Pay Ltd. (Malta) is data controller under the GDPR, with a designated data protection contact; no DPIA statement and no processor list by name (categories only). Card data is shared with the issuer under the card terms.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/privacy",
              "detail": "Privacy Policy opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "acting as data controller for the purposes of the EU General Data Protection Regulation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Ethena Pay Ltd., Malta, company C 114576 (Terms of Use, Appendix 1 general provisions); the card agreement is with the issuer Third National, with Signify Holdings, Inc. d/b/a Rain as programme manager; ramps with Iron Network UAB or MoonPay USA LLC; KYC with Sumsub; wallet auth with Privy.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/legal",
              "detail": "Legal hub footer naming the company and registration number.",
              "checked_at": "2026-10-09",
              "quote": "private limited company incorporated in Malta (company number C 114576)",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/card-terms",
              "detail": "Spend Card Terms (effective 1 June 2026), Issuer section.",
              "checked_at": "2026-10-09",
              "quote": "The card program is managed by Signify Holdings, Inc. d/b/a Rain",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Ethena (the USDe issuer) presents Ethena Pay as its own distribution channel for USDe, funded on Ethena's economics (reserve yield on USDe, interchange); the Daily Boost is a discretionary Ethena Pay subsidy. No financial statements found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/blog/introducing-ethena-pay",
              "detail": "Launch post, section on why Ethena builds a neobank.",
              "checked_at": "2026-10-09",
              "quote": "Ethena Pay gives Ethena a direct route into that pool",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Ethena Pay may terminate with notice where practicable, or immediately without notice on legal, third-party-provider, fraud or breach grounds; after closure balances \"could remain in your control, could be returned to you, or could be frozen or locked\", which Ethena Pay says it does not control. The issuer may cancel the card at any time with or without notice. The user can close the account in the app.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/terms",
              "detail": "Terms of Use (22 September 2026) s8.3 and s8.5.",
              "checked_at": "2026-10-09",
              "quote": "could remain in your control, could be returned to you, or could be frozen or locked",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/card-terms",
              "detail": "Spend Card Terms, termination.",
              "checked_at": "2026-10-09",
              "quote": "we may suspend, revoke or cancel your Account privileges",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Yes. The privacy policy says automated decision-making and profiling (watchlist matching, risk-scoring models, behavioural analytics) are used for identity verification, sanctions screening, fraud detection, transaction monitoring and eligibility, and can suspend accounts or block transactions; some features use machine learning.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/privacy",
              "detail": "Privacy Policy s1.13-1.14 Automated decision-making (EEA/UK).",
              "checked_at": "2026-10-09",
              "quote": "We may use automated decision-making, including profiling, in connection with identity verification, sanctions screening, fraud detection, transaction monitoring, and access eligibility assessments",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "Only an override path is documented (EEA/UK users may request human review and contest a decision, except where the decision is needed for the contract or required by law). No monitoring, validation, decommissioning or bias evaluation documentation found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/privacy",
              "detail": "Privacy Policy s1.14.",
              "checked_at": "2026-10-09",
              "quote": "You have the right to request human review of any such decision",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "none",
            "amount": "Virtual card issuance, replacement and activation free; no account, monthly, inactivity or closure fee",
            "basis": "Pricing page (effective 1 September 2026, updated 30 September 2026); fees may change under Terms s6.2.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Visa's conversion fee passed through at cost (about 1%); no cross-border fee; USD purchases free",
            "basis": "Pricing page s2.2 and Spend Card Terms Important Disclosures.",
            "evidence_index": 0
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM 1.00 USD + 0.65% where ATM access is available, plus any operator surcharge",
            "basis": "Pricing page s2.2 and Spend Card Terms.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Bank off-ramp fees set by Iron / MoonPay and shown at the time of the transaction",
            "basis": "Pricing page s4 Third-Party Fees; the launch post says withdrawals cost a \"nominal\" amount without a figure.",
            "evidence_index": 2
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Late payment up to 40 USD; returned payment up to 29 USD",
            "basis": "Spend Card Terms penalty fees (secured card; collateral can be liquidated).",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/pricing",
            "detail": "Pricing page, account fees and card transaction fees.",
            "checked_at": "2026-10-09",
            "quote": "Typically around 1.0%, passed through directly from the applicable card network with no markup",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/pricing",
            "detail": "Pricing page, ATM fee.",
            "checked_at": "2026-10-09",
            "quote": "If ATM access is available: $1.00 plus 0.65% of the withdrawal amount",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/pricing",
            "detail": "Pricing page s4, funding partners.",
            "checked_at": "2026-10-09",
            "quote": "Fees for onramp and offramp services, currency conversion, and bank transfers, as disclosed by the applicable provider at the time of the transaction",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Network gas for the card spend is paid by Ethena Pay's relayer (CROPS C2/S3 findings), not shown as a user fee. Rewards (cashback in AVAX, Daily Boost in USDe) are not fees and are not recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S1",
            "index": 2
          }
        ],
        "note": "Balances sit in the user's own wallet contract, but Ethena Pay's executor key can move up to 10,000 USDe and 10,000 USDC per wallet per day to any address, and card spends pass into a Rain-controlled collateral pool. Agrees with the S1 finding (score 0, disputed against the FAQ's \"no access\" claim).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "unknown",
        "note": "No licence found for any party in the card path. Ethena Pay's Terms say it is not licensed by any financial regulator in the user's country and rely on third parties' home authorisations. The Spend Card Terms name Third National as issuer and Rain (Signify Holdings, Inc.) as programme manager, without a regulator or licence number; FDIC BankFind lists no active institution named Third National. Iron Network UAB and MoonPay USA LLC (ramps) were not checked against the Lithuanian or US registers.",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/terms",
            "detail": "Terms of Use Appendix 1, General Provisions, regulatory status.",
            "checked_at": "2026-10-09",
            "quote": "Ethena Pay Ltd. is not licensed, registered, authorized, or otherwise approved by any financial services, banking, payments, securities, or crypto asset regulator",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Third National (issuer), Rain (programme manager), Visa",
            "fee": "Visa FX at cost (about 1%); no cross-border fee",
            "limits": "Virtual card; non-US persons only; secured by wallet collateral (daily allowance 10,000 USDe / 10,000 USDC by default).",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Third National (issuer), Visa",
            "fee": "1.00 USD + 0.65%, plus operator surcharge",
            "limits": "Only where the card, device and country allow; \"availability is limited and outside our control\". Not eligible for cashback.",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Iron Network UAB / MoonPay USA LLC",
            "fee": "set by the provider at the time of the transaction",
            "limits": "Withdrawal to a bank via the virtual IBAN account; outbound wire transfers not offered.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/card-terms",
            "detail": "Spend Card Terms (effective 1 June 2026), issuer and programme manager.",
            "checked_at": "2026-10-09",
            "quote": "References in these Card Terms to the \" Issuer \" refer to Third National",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/pricing",
            "detail": "Pricing page s7, services not currently available.",
            "checked_at": "2026-10-09",
            "quote": "Wire transfers (outbound)",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://pay.ethena.fi/terms",
            "detail": "Terms of Use, conventional payment infrastructure provided by MoonPay or other Third-Party Providers (Iron Customer Terms, Exhibit G).",
            "checked_at": "2026-10-09",
            "quote": "These features are provided by Moonpay or other applicable Third-Party Providers",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Per-country off-ramp currencies are not listed in any public page; the availability list in the provider file applies.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-06-02",
            "block": 87002584,
            "what": "Rain collateral BeaconProxy 0x6070848b... on Avalanche, which receives card spends; the wallet factory 0xAc66ca9A... followed at block 87652557 (2026-06-10)"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getcontractcreation&contractaddresses=0x6070848bd19C37488d0516058f2933Dd992733dE,0xAc66ca9A79fb0D3C64cBa44cd29610CD58602D6f",
              "address": "0x6070848bd19C37488d0516058f2933Dd992733dE",
              "block_number": 87002584,
              "detail": "Creation tx 0x0ebf2458...4a0e (creator 0x21ebc2f2..., via factory 0x154f9755...); code size 0 at block 87002583 and 1345 at 87002584 (2026-06-02 14:53:40 UTC). Wallet factory proxy creation tx 0x062bcda8...409c at block 87652557 (2026-06-10 11:29:34 UTC), code size 0 at the block before.",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0x6070848bd19C37488d0516058f2933Dd992733dE --block 87002583 --rpc-url https://api.avax.network/ext/bc/C/rpc; cast codesize 0x6070848bd19C37488d0516058f2933Dd992733dE --block 87002584 --rpc-url https://api.avax.network/ext/bc/C/rpc"
            }
          ],
          "note": "Attribution of these contracts to Ethena Pay is inferred in the provider file (judgment call in primary_chain.basis). Public launch was 3 September 2026 (launch post).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Ethena Pay Ltd.",
            "jurisdiction": "MT",
            "registration_number": "C 114576"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/legal",
              "detail": "Legal hub footer; the Terms of Use Appendix 1 names the same entity as contracting party.",
              "checked_at": "2026-10-09",
              "quote": "private limited company incorporated in Malta (company number C 114576)",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Not checked in the Malta Business Registry (its search is an interactive web app), so no register_url.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident report found on pay.ethena.fi (legal hub, FAQ, support, insights launch post) or docs.ethena.fi; the product launched on 3 September 2026. Ethena Pay has no public repository.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-06-01",
              "summary": "Ethena Pay Spend Card Terms take effect (issuer Third National, programme manager Rain).",
              "url": "https://pay.ethena.fi/card-terms"
            },
            {
              "date": "2026-09-01",
              "summary": "Pricing page takes effect (last updated 30 September 2026).",
              "url": "https://pay.ethena.fi/pricing"
            },
            {
              "date": "2026-09-03",
              "summary": "Ethena Pay publicly launched.",
              "url": "https://pay.ethena.fi/blog/introducing-ethena-pay"
            },
            {
              "date": "2026-09-22",
              "summary": "Terms of Use last updated.",
              "url": "https://pay.ethena.fi/legal"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/card-terms",
              "detail": "Spend Card Terms header.",
              "checked_at": "2026-10-09",
              "quote": "Effective as of June 1, 2026",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://pay.ethena.fi/pricing",
              "detail": "Pricing page header.",
              "checked_at": "2026-10-09",
              "quote": "Effective Date: September 1, 2026",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "A card spend emits AllowanceSpent from each user's wallet proxy (about 12,300 wallets, not listed) and a USDe Transfer from the USDe token into Rain collateral 0x6070848b...; the listed BatchExecutor's event carries only call counts, and the spec cannot filter token transfers by recipient. Card spends cannot be summed over listed contracts alone.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "etherfi-cash": {
      "slug": "etherfi-cash",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/contents/?ref=master",
              "detail": "etherfi-protocol/cash-v3: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/contents/?ref=master",
              "detail": "etherfi-protocol/cash-v3: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/contents/?ref=master",
              "detail": "etherfi-protocol/cash-v3: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": true,
                "detail": "rules: copilot_code_review, pull_request, deletion, non_fast_forward, non_fast_forward"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/rules/branches/master",
              "detail": "etherfi-protocol/cash-v3: rules: copilot_code_review, pull_request, deletion, non_fast_forward, non_fast_forward",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": true,
                "detail": "3 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/contents/?ref=master",
              "detail": "etherfi-protocol/cash-v3: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/contents/?ref=master",
              "detail": "etherfi-protocol/cash-v3: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/contents/?ref=master",
              "detail": "etherfi-protocol/cash-v3: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": true,
                "detail": "latest tags: v3.0.0"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/tags",
              "detail": "etherfi-protocol/cash-v3: latest tags: v3.0.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/commits?per_page=10",
              "detail": "etherfi-protocol/cash-v3: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": true,
                "detail": "1 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/contents/?ref=master",
              "detail": "etherfi-protocol/cash-v3: 1 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "etherfi-protocol/cash-v3",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/etherfi-protocol/cash-v3/contents/?ref=master",
              "detail": "etherfi-protocol/cash-v3: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement for ether.fi (Ether.Fi SEZC or Ether.Fi Cash Inc./Ltd.) found in the GitBook docs (full-text llms-full.txt), Security & Risks section, Terms of Use or Privacy Policy. The only ISO 27001 mentions are for third-party staking node operators. Issuer Third National not checked.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No hosting or support organisation certification found; the docs do not name the hosting provider for the Cash app or backend.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found for ether.fi; the SOC 2 mentions in the docs concern staking node operators.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "Smart-contract audits (Certora, Paladin, Nethermind) pinned to cash-v3 commits with per-finding fix commits, plus an Immunefi bounty. No independent review of the closed app, card backend or Turnkey integration was found.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            },
            {
              "criterion": "S6",
              "index": 2
            }
          ],
          "note": "Cross-reference CROPS S6 (score 2). The audits cover contracts only.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or attestation found for the Cash app, web app or backend.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "note": "The incident playbook describes 24/7 onchain monitoring by Hypernative, not vulnerability scanning of the platform or application; no scanning cadence is stated.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "The incident playbook sets containment and signer-replacement SLAs (containment within 1 h for SEV-1, compromised signer replaced within 24 h) but no patch timelines for known vulnerabilities.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "evidenced",
          "value": "Published playbook commits to an initial public acknowledgment within 4 hours of a confirmed SEV-1 (active or imminent loss of user funds) and status updates until resolution. No per-customer notification period for data incidents is stated in the Privacy Policy or cardholder agreements.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/security/security-and-risks/incident-management/incident-response-playbook",
              "detail": "Incident Response Playbook, Communications section; scope is protocol contracts, keys, oracles, bridges and user-facing infrastructure.",
              "checked_at": "2026-10-09",
              "quote": "initial public acknowledgment within",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "note": "No statement on backups or restore testing for cardholder records found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "evidenced",
          "value": "Published incident response playbook (since Nov 2024, revised July 2026) with runbooks for contract exploit, key compromise, signer loss, oracle and bridge anomalies. It covers the contracts and frontends; no recovery plan for the card backend or card programme is published. For the non-custodial part see CROPS S4.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/security/security-and-risks/incident-management/incident-response-playbook",
              "detail": "Playbook purpose and scope paragraph and the runbooks section.",
              "checked_at": "2026-10-09",
              "quote": "It is the published version of the internal incident response policy in effect since November 24, 2024",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "note": "The playbook is not stated to be tested; testing is not evidenced.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Public incident log with post-mortems (domain account takeover attempt, Kelp rsETH fallout Apr 2026, legacy AtomicQueue exploit Sep 2026); the playbook commits to a post-mortem for every SEV-1 and SEV-2. No public status page found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/security/security-and-risks/incident-management/incident-response-playbook",
              "detail": "Post-incident section of the playbook.",
              "checked_at": "2026-10-09",
              "quote": "Post-mortem published for every SEV-1 and SEV-2",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/security/security-and-risks/incident-management/sep-11-incident-legacy-atomicqueue-exploit",
              "detail": "Post-mortem for the 11 Sep 2026 legacy AtomicQueue exploit with timeline, exposure conditions and transaction hashes.",
              "checked_at": "2026-10-09",
              "quote": "an attacker exploited a missing authorization check in the legacy Veda AtomicQueue contract",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Sign-in and approvals use a device passkey with no password; email one-time codes are used for account actions such as deletion.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/quickstart",
              "detail": "Quickstart, \"Set up a passkey\" step.",
              "checked_at": "2026-10-09",
              "quote": "You use it to sign in and to approve actions. There is no password.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Whether a passkey is mandatory for every account is not stated; the MCP connector page says some accounts may have no passkey yet.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "evidenced",
          "value": "Stated only for key platforms after the 2024 domain incident (hardware authentication required); no general statement on privileged-access MFA or separate admin accounts.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/security/security-and-risks/incident-management/sep-24-incident-attempted-domain-account-takeover",
              "detail": "Incident note, prevention steps.",
              "checked_at": "2026-10-09",
              "quote": "We preemptively upgraded our key platforms to require hardware authentication as an authentication method",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "The only documented API surface is the read-only MCP connector (mcp.ether.fi), which uses OAuth 2.1 with PKCE and passkey consent. The app's own browser-to-server API is not documented.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/mcp-server",
              "detail": "MCP Server page, section 6 \"How it works\" (OAuth 2.1 facade, authorize plus PKCE).",
              "checked_at": "2026-10-09",
              "quote": "Connect an AI assistant to your ether.fi Cash account. Read-only, scope by scope, approved with your passkey.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "MCP connector access tokens last one hour; the grant (refresh) lasts 90 days and can be revoked, with access re-checked on every read.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/mcp-server",
              "detail": "MCP Server page, section 5 \"Lifetime and revocation\".",
              "checked_at": "2026-10-09",
              "quote": "Within that window the assistant holds a one-hour access token and quietly renews it",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Privacy Policy states encryption of sensitive personal information among its security measures; no data classification scheme or TLS version is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/privacy-policy",
              "detail": "Privacy Policy, Security section.",
              "checked_at": "2026-10-09",
              "quote": "including encryption of sensitive personal information",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Data kept as long as necessary for the purpose and as legally required; after account termination the user has 30 days to remove data before the account is deleted, and data may be retained after deletion for legal, tax or regulatory reasons. Self-service account deletion has a 14-day waiting period.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/privacy-policy",
              "detail": "Privacy Policy, Personal Information Retention section.",
              "checked_at": "2026-10-09",
              "quote": "you will have 30 days to remove your data before we delete your account",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Controller is Ether.Fi SEZC (Cayman Islands), with an EU representative (Instant EU GDPR Representative Ltd.) and a UK representative (GDPR Local Ltd.). No DPIA is mentioned.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/privacy-policy",
              "detail": "Privacy Policy, Controller Details and representatives.",
              "checked_at": "2026-10-09",
              "quote": "we have appointed an EU Representative to act as our data protection agent",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "The Privacy Policy says ether.fi enters into data processing agreements and standard contractual clauses for EEA/UK/Swiss/Brazil transfers, but no customer-facing DPA or statement that one is available to customers was found. The corporate agreement (international) was not read.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Cash Technical Documentation and Cash Modules pages cover the logical architecture (Vault, modules, hooks, roles) and integration (universal cross-chain addresses, Turnkey enclave, bridges). No infrastructure view of the closed backend.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/technical-documentation",
              "detail": "Technical Documentation sections 1-3 with ownership, cross-chain and modular-design diagrams.",
              "checked_at": "2026-10-09",
              "quote": "Effortless Cross-chain via Universal Address",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Three parties: Ether.Fi SEZC (Cayman Islands special economic zone company) under the Terms of Use; Ether.Fi Cash Inc. or Ether.Fi Cash Ltd. as programme manager under the cardholder agreements; and the issuer Third National. Cardholder agreements are governed by Puerto Rico law.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/terms-of-use",
              "detail": "Terms of Use section 1(a).",
              "checked_at": "2026-10-09",
              "quote": "a Special Economic Zone Company, organized under the laws of Cayman Islands",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international",
              "detail": "Cardholder Agreement - Inc. (International), opening paragraph and section 18 (governing law).",
              "checked_at": "2026-10-09",
              "quote": "Ether.Fi Cash Inc. and its affiliates",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No company-register entry was checked; the Cayman register is not publicly searchable without an account, and the jurisdiction of Ether.Fi Cash Inc. and Ether.Fi Cash Ltd. is not stated in the documents.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Either side may terminate the card terms on 30 days' notice; ether.fi and the issuer may also suspend or cancel at any time with or without notice. Amounts owed survive termination; prepaid subscriptions are refunded pro rata unless termination follows a breach. Funds in the Vault stay in the user's Safe (see CROPS S4).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international",
              "detail": "Cardholder Agreement - Inc. (International), section 14 Termination.",
              "checked_at": "2026-10-09",
              "quote": "We may terminate your access to the Card Services and the Card Terms without cause",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "No statement that AI decides card authorisations or screening. The Privacy Policy allows machine-learning use of personal data for research and product development and lists device fingerprinting and behavioural biometrics for fraud prevention; a read-only AI connector (MCP) can read account data but has no write path.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/privacy-policy",
              "detail": "Privacy Policy, \"How We Use Your Personal Information\", research and development purposes.",
              "checked_at": "2026-10-09",
              "quote": "testing, research, analysis, product development, and machine learning",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/mcp-server",
              "detail": "MCP Server page, section 3, no write path.",
              "checked_at": "2026-10-09",
              "quote": "There is no write path anywhere in the system",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Whether the fraud-prevention signals feed an automated model is not stated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "1% base plus up to 0.5% (Core) or up to 0.25% (Luxe); no added margin for Pinnacle and VIP",
            "basis": "International cardholder agreement section 10 (fee schedule dated 5 Feb 2026) and help-centre limits page; ether.fi may change fees on 30 days' notice.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "10 USD for the first virtual card in 14 listed countries; otherwise one free virtual card for Core",
            "basis": "Help-centre regional pricing article; shown in the app before ordering.",
            "evidence_index": 2
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Bank withdrawal: USD ACH 0.50 USD + 0.20%, Fedwire 20 USD + 0.20%, SWIFT 20 USD + 0.12%, EUR SEPA 0.90 EUR + FX",
            "basis": "Help-centre bank transfer FAQ; other payout routes are quoted in the app before confirmation.",
            "evidence_index": 3
          },
          {
            "kind": "limit",
            "paid_by": "payer",
            "amount": "ATM 1,000 USD per withdrawal, at most 5 per rolling 24 h; ATM fee not stated",
            "basis": "Help-centre limits page. The membership page lists ATM withdrawals as free up to 10 per month for Pinnacle and VIP only.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international",
            "detail": "Cardholder Agreement - Inc. (International), section 10 Foreign Currency Transactions.",
            "checked_at": "2026-10-09",
            "quote": "This includes a base 1% foreign transaction fee",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.ether.fi/en/articles/303623-what-are-the-transaction-limits-and-fees-for-personal-cash-credit-cards",
            "archive": "data/archive/etherfi-cash-ops-limits-and-fees.txt",
            "detail": "Help-centre article on limits and fees per membership level (ATM limits, added FX margin table).",
            "checked_at": "2026-10-09",
            "quote": "Maximum of five(5) ATM withdrawals in any rolling 24 hour period",
            "confirmed_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.ether.fi/en/articles/833743-why-is-there-a-10-fee-for-my-first-virtual-cash-card",
            "archive": "data/archive/etherfi-cash-ops-first-card-fee.txt",
            "detail": "Help-centre article listing the 14 countries where the first virtual card costs 10 USD.",
            "checked_at": "2026-10-09",
            "quote": "regional pricing means the first virtual Cash card has a $10 fee instead",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.ether.fi/en/articles/758758-bank-transfers-faqs",
            "archive": "data/archive/etherfi-cash-ops-bank-transfer-faq.txt",
            "detail": "Bank transfers FAQ, funding fee table and outgoing USD bank-transfer fee table.",
            "checked_at": "2026-10-09",
            "quote": "Outgoing USD bank-transfer fees",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No issuance, monthly or annual fee is stated for Core; membership levels above Core are unlocked by loyalty points (Luxe 5K, Pinnacle 25K) or invitation. The U.S. cardholder agreements reserve an annual fee and a foreign transaction fee whose amounts sit in Account Opening Disclosures that are not public. Judgment call: first-party help-centre pricing pages are treated as documented for fees here, while the CROPS seed cited the same help centre as claimed.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S1",
            "index": 2
          }
        ],
        "note": "Funds rest in the user's beacon-proxy Safe (owner key in a Turnkey enclave); card spends move to an ether.fi-controlled, upgradeable settlement dispatcher that the 8 h timelock can redirect, and ether.fi plus a third party can recover a Safe after 3 days unless the owner cancels. Agrees with the S1 finding (score 1).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "unknown",
        "note": "The cardholder agreements name Third National as issuer under a Visa licence and choose Puerto Rico law, but no first-party document states Third National's regulator, licence type or number. The FDIC BankFind API lists no active institution named Third National (only closed Tennessee banks), which suggests it is not a US insured bank; the Puerto Rico OCIF licence verification site (concesionarios.ocif.pr.gov) failed the TLS handshake from this environment, so the register could not be checked. The provider file context mentions BANEX Microfinance Bank (Nigeria) without a first-party source. ether.fi's risks page says ether.fi itself is not a regulated financial institution.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_withdrawal",
            "partner": "Third National (issuer), Visa",
            "fee": "FX 1% plus tier margin on non-USD spend",
            "limits": "Card spend at merchants (the schema has no card-spend value); limits set by ether.fi and the issuer.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Third National (issuer), Visa",
            "fee": "not stated for Core and Luxe; free up to 10 per month for Pinnacle and VIP",
            "limits": "1,000 USD per withdrawal, 5 per rolling 24 h; not allowed in North Korea, Iran, Myanmar",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "unnamed banking provider",
            "fee": "USD ACH 0.50 USD + 0.20%; SWIFT 20 USD + 0.12%; SEPA 0.90 EUR + FX; others quoted in app",
            "limits": "Rails per currency: USD ACH/Fedwire/SWIFT, EUR SEPA, GBP FPS, BRL PIX, INR UPI, ~25 local routes. Excluded in 24 jurisdictions (no card country); Puerto Rico not listed.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/ether.fi-cash-cardholder-agreement-inc.-international",
            "detail": "Cardholder Agreement - Inc. (International), sections 2 and 6; also says cash advances are not available under the international card terms.",
            "checked_at": "2026-10-09",
            "quote": "Cash advances and balance transfers are not available under these Card Terms",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.ether.fi/en/articles/303623-what-are-the-transaction-limits-and-fees-for-personal-cash-credit-cards",
            "archive": "data/archive/etherfi-cash-ops-limits-and-fees.txt",
            "detail": "Help-centre limits page, ATM withdrawal limits and FATF-country exclusions.",
            "checked_at": "2026-10-09",
            "quote": "ATM withdrawals are not allowed due to platform integrity and global compliance",
            "confirmed_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.ether.fi/en/articles/759961-supported-payment-methods-deposits-withdrawals",
            "archive": "data/archive/etherfi-cash-ops-payment-methods.txt",
            "detail": "Supported payout methods by currency.",
            "checked_at": "2026-10-09",
            "quote": "You can withdraw funds from your Vault using the following supported payment methods",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.ether.fi/en/articles/860027-in-which-countries-are-bank-transfers-not-available",
            "archive": "data/archive/etherfi-cash-ops-bank-transfer-excluded.txt",
            "detail": "The 24 jurisdictions where bank transfers are not available.",
            "checked_at": "2026-10-09",
            "quote": "Bank transfers are not available in the jurisdictions listed below",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Contradiction: the international card terms say cash advances are not available, while the help centre lists ATM withdrawal limits per membership level and the U.S. agreements treat ATM use as a Cash Advance where enabled. Recorded as listed by the help centre; a reviewer should confirm ATM access outside the US.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-03-27",
            "block": 149521158,
            "what": "CashModule proxy 0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0 on Optimism (core chain since the April 2026 account upgrade)"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/tx/0x96728edf8f7350ffa63384a2cd36f099f3fedc740a45a7c23a10d406909cf240",
              "address": "0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0",
              "block_number": 149521158,
              "detail": "Creation tx 0x96728edf...f240 via deployer factory 0x59B5c9c09327b3Ed6a801BD035eA970f7a28b7ed; the CashModule proxy has code size 0 at block 149521157 and 122 bytes at 149521158 (timestamp 1774641093, 2026-03-27 19:51:33 UTC).",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0 --block 149521157 --rpc-url https://mainnet.optimism.io; cast codesize 0x7Ca0b75E67E33c0014325B739A8d019C4FE445F0 --block 149521158 --rpc-url https://mainnet.optimism.io"
            }
          ],
          "note": "This dates the current core-chain deployment only. ether.fi Cash ran earlier on Scroll (same CashModule address in cash-v3 deployments/mainnet/534352, and before that the archived cash-contracts repo); those earlier deployments were not dated here.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Ether.Fi SEZC",
            "jurisdiction": "KY"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/legal/ether.fi-legal/terms-of-use",
              "detail": "Terms of Use section 1(a) names Ether.Fi SEZC, a Cayman Islands special economic zone company; the Privacy Policy gives its address at Strathvale House, George Town.",
              "checked_at": "2026-10-09",
              "quote": "a Special Economic Zone Company, organized under the laws of Cayman Islands",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The card programme is contracted through Ether.Fi Cash Inc. or Ether.Fi Cash Ltd. (cardholder agreements), whose jurisdictions are not stated. No company-register entry was checked (the Cayman General Registry has no free public search).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/security/security-and-risks/incident-management/sep-11-incident-legacy-atomicqueue-exploit",
              "detail": "The 11 Sep 2026 legacy AtomicQueue exploit hit Liquid token holders; the post-mortem states Cash accounts were not exploitable.",
              "checked_at": "2026-10-09",
              "quote": "Gnosis Safe and ether.fi Cash accounts were not exploitable through this path",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Searched ether.fi's incident log (three entries), the Risks page and the S6 audit evidence. None of the logged incidents affected Cash funds: the Sep 2026 AtomicQueue exploit excluded Cash accounts, the Apr 2026 Kelp rsETH fallout paused Liquid vaults only, and the domain account takeover attempt (dated 'Sep 24' with no year on the page) caused no loss.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-04-01",
              "summary": "Account upgrade: the Cash core chain moves from Scroll to Optimism; a Safe is deployed for each user on Optimism and Scroll becomes a top-up chain. The page says April 2026 without a day; the date here is the month.",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/account-upgrade"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://etherfi.gitbook.io/etherfi/products/cash/account-upgrade",
              "detail": "Account upgrade page.",
              "checked_at": "2026-10-09",
              "quote": "the core chain for Cash is updating in Apr 2026",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 10,
          "addresses": [
            "0x380B2e96799405be6e3D965f4044099891881acB"
          ],
          "topic0": "0x244f4cc0665ad7ee4709aa59b30d3ea581cecde1b0430a3f23a5dc609d4890fc",
          "event": "Spend(address indexed safe, bytes32 indexed txId, uint8 indexed binSponsor, address[] tokens, uint256[] amounts, uint256[] amountInUsd, uint256 totalUsdAmt, uint8 mode)",
          "amount_word": 3,
          "decimals": 6,
          "symbol": "USD",
          "window_days": 30,
          "exclusions": "Sums totalUsdAmt (USD value at spend, 6 decimals) of every Spend event from the CashEventEmitter on Optimism, all BIN sponsors and both direct and borrow modes. Refunds and cashback are not subtracted; legacy Scroll spends are excluded. Word layout checked on sample tx 0xdb50399e...f565 (word 3 = 0x5222a5 = 5.38 USD)."
        },
        "note": "Card spends are recorded as Spend events by the listed CashEventEmitter, so they can be separated from ordinary transfers. Not yet computed; the maintainer runs scripts/volumes.mjs.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: eth_getLogs: backend response too large"
      }
    },
    "exa-card": {
      "slug": "exa-card",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "exactly/protocol",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "exactly/docs",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/contents/?ref=main",
              "detail": "exactly/exa: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/contents/?ref=main",
              "detail": "exactly/webauthn-owner-plugin: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/contents/?ref=main",
              "detail": "exactly/protocol: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/contents/?ref=main",
              "detail": "exactly/docs: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "exactly/protocol",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "exactly/docs",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/contents/?ref=main",
              "detail": "exactly/exa: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/contents/?ref=main",
              "detail": "exactly/webauthn-owner-plugin: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/contents/?ref=main",
              "detail": "exactly/protocol: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/contents/?ref=main",
              "detail": "exactly/docs: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "exactly/protocol",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "exactly/docs",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/contents/?ref=main",
              "detail": "exactly/exa: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/contents/?ref=main",
              "detail": "exactly/webauthn-owner-plugin: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/contents/?ref=main",
              "detail": "exactly/protocol: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/contents/?ref=main",
              "detail": "exactly/docs: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, creation, required_linear_history, required_signatures, pull_request, required_status_checks, copilot_code_review"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "exactly/protocol",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "exactly/docs",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/rules/branches/main",
              "detail": "exactly/exa: rules: deletion, non_fast_forward, creation, required_linear_history, required_signatures, pull_request, required_status_checks, copilot_code_review",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/rules/branches/main",
              "detail": "exactly/webauthn-owner-plugin: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/rules/branches/main",
              "detail": "exactly/protocol: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/rules/branches/main",
              "detail": "exactly/docs: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": false,
                "detail": "12 workflow file(s)"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": true,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "exactly/protocol",
                "ok": true,
                "detail": "2 workflow file(s)"
              },
              {
                "repo": "exactly/docs",
                "ok": true,
                "detail": "1 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/contents/?ref=main",
              "detail": "exactly/exa: 12 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/contents/?ref=main",
              "detail": "exactly/webauthn-owner-plugin: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/contents/?ref=main",
              "detail": "exactly/protocol: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/contents/?ref=main",
              "detail": "exactly/docs: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "exactly/protocol",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "exactly/docs",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/contents/?ref=main",
              "detail": "exactly/exa: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/contents/?ref=main",
              "detail": "exactly/webauthn-owner-plugin: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/contents/?ref=main",
              "detail": "exactly/protocol: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/contents/?ref=main",
              "detail": "exactly/docs: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "exactly/protocol",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "exactly/docs",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/contents/?ref=main",
              "detail": "exactly/exa: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/contents/?ref=main",
              "detail": "exactly/webauthn-owner-plugin: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/contents/?ref=main",
              "detail": "exactly/protocol: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/contents/?ref=main",
              "detail": "exactly/docs: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": false,
                "detail": "latest tags: @exactly/substreams@0.1.0, @exactly/server@0.2.129, @exactly/server@0.2.128"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "exactly/protocol",
                "ok": true,
                "detail": "latest tags: v0.2.24, v0.2.23, v0.2.22"
              },
              {
                "repo": "exactly/docs",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/tags",
              "detail": "exactly/exa: latest tags: @exactly/substreams@0.1.0, @exactly/server@0.2.129, @exactly/server@0.2.128",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/tags",
              "detail": "exactly/webauthn-owner-plugin: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/tags",
              "detail": "exactly/protocol: latest tags: v0.2.24, v0.2.23, v0.2.22",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/tags",
              "detail": "exactly/docs: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "exactly/protocol",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              },
              {
                "repo": "exactly/docs",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/commits?per_page=10",
              "detail": "exactly/exa: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/commits?per_page=10",
              "detail": "exactly/webauthn-owner-plugin: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/commits?per_page=10",
              "detail": "exactly/protocol: 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/commits?per_page=10",
              "detail": "exactly/docs: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "exactly/protocol",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "exactly/docs",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/contents/?ref=main",
              "detail": "exactly/exa: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/contents/?ref=main",
              "detail": "exactly/webauthn-owner-plugin: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/contents/?ref=main",
              "detail": "exactly/protocol: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/contents/?ref=main",
              "detail": "exactly/docs: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "exactly/exa",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "exactly/webauthn-owner-plugin",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "exactly/protocol",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "exactly/docs",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/exa/contents/?ref=main",
              "detail": "exactly/exa: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/webauthn-owner-plugin/contents/?ref=main",
              "detail": "exactly/webauthn-owner-plugin: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/protocol/contents/?ref=main",
              "detail": "exactly/protocol: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/exactly/docs/contents/?ref=main",
              "detail": "exactly/docs: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement for EXA LABS S.A.S. found in the help centre (sitemap, security and compliance collection), exactly/docs or the exa repository.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No hosting or support organisation certification found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found. The help article \"How secure is your card?\" only says the card is issued and certified by Visa.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "Quantstamp audits of the Exa App Plugin (Mar 2025, Oct 2025 update) and WebAuthn plugin (Jul 2024), plus many Exactly Protocol audits; the deployed OP plugin is 23 commits past the Mar 2025 fix review. No review of the server or app found.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            },
            {
              "criterion": "S6",
              "index": 1
            }
          ],
          "note": "Cross-reference CROPS S6 (score 1). The Exactly Protocol bug bounty (Immunefi) is described in exactly/docs security/bug-bounty-program.md; its scope for the Exa plugin is not stated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or attestation found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "note": "No vulnerability-scanning cadence stated; exactly/docs describes Hypernative onchain monitoring and Codecov coverage for the protocol, not platform scanning.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No patch service levels found in the terms, help centre or docs.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "evidenced",
          "value": "No time-bound notification commitment. The published emergency procedure says to communicate internally and externally \"as appropriate\" and to assign a security disclosure report; the Privacy Policy has no breach-notification clause.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/docs/blob/fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b/security/emergency-procedure.md#L115-L131",
              "commit": "fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b",
              "path": "security/emergency-procedure.md",
              "detail": "Emergency checklist; communication step has no deadline.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "note": "No statement on backups or restore testing found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "evidenced",
          "value": "Published emergency procedure (roles, war room, checklist) for loss-of-funds incidents in the protocol and contracts; not stated to be tested, and no recovery plan for the card backend. For the user exit path see CROPS S4.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/docs/blob/fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b/security/emergency-procedure.md#L1-L21",
              "commit": "fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b",
              "path": "security/emergency-procedure.md",
              "detail": "Emergency procedure introduction and emergency definitions.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page and no post-mortem found (help centre sitemap, exactly/docs tree, GitHub code search in the exactly org for post-mortem or exploit). Exactly's Medium and Mirror pages return 403 to curl and were not read; a reviewer should check whether Exactly published post-mortems there.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "The account is owned by a device passkey (WebAuthn owner plugin); sign-in uses the passkey with no password. SIWE sign-in is also accepted.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/8977188-what-is-a-passkey-why-are-they-better-than-passwords",
              "detail": "Help article on passkeys in the Exa App.",
              "checked_at": "2026-10-09",
              "quote": "instead of typing a password, your device will communicate with the service to prove your identity",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "evidenced",
          "value": "Server session cookie expires 24 hours after sign-in (absolute expiry); no idle timeout found in the server code.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/common/AUTH_EXPIRY.ts#L1-L1",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "common/AUTH_EXPIRY.ts",
              "detail": "AUTH_EXPIRY = 24 * 60 * 60_000 ms.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/api/auth/authentication.ts#L454-L463",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/api/auth/authentication.ts",
              "detail": "After WebAuthn or SIWE verification the server sets a signed, httpOnly, secure credential_id cookie expiring at now + AUTH_EXPIRY.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "Browser-to-server calls are authenticated with a signed httpOnly cookie issued after WebAuthn (passkey) or SIWE verification; not OAuth or OIDC.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/middleware/auth.ts#L6-L16",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/middleware/auth.ts",
              "detail": "Auth middleware rejects requests without a valid signed credential_id cookie (401).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/api/auth/authentication.ts#L454-L463",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/api/auth/authentication.ts",
              "detail": "Cookie set after verifyAuthenticationResponse (WebAuthn) or SIWE validation.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Card-issuer (Rain, \"panda\") webhooks are authenticated by a signature header checked against a comma-separated list of signing keys, which allows key rotation; outbound calls to Rain, Persona and Sardine use API keys from environment variables.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/hooks/panda.ts#L110-L119",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/hooks/panda.ts",
              "detail": "Webhook handler verifies the signature header against each configured key and returns 401 otherwise.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "F3",
              "index": 0
            }
          ],
          "note": "Cross-reference CROPS S5. Key scoping is not visible from the code.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "Session cookie lifetime 24 hours; no shorter token for sensitive data.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/common/AUTH_EXPIRY.ts#L1-L1",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "common/AUTH_EXPIRY.ts",
              "detail": "AUTH_EXPIRY = 24 * 60 * 60_000 ms.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Privacy Policy states only \"appropriate technical and organizational security measures\"; no data classification, encryption-at-rest or TLS statement.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/9945134-privacy-policy",
              "detail": "Privacy Policy section 4 Data Security.",
              "checked_at": "2026-10-09",
              "quote": "We use appropriate technical and organizational security measures to protect your personal data",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Retained only as long as necessary for the stated purposes, with periods set by record type and legal requirements; no fixed periods and no deletion-on-termination clause.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/9945134-privacy-policy",
              "detail": "Privacy Policy section 5 Duration of Data Processing.",
              "checked_at": "2026-10-09",
              "quote": "Retention periods are determined based on the type of record",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "EXA LABS S.A.S. (Uruguay) is named as the company processing user data; KYC is run by Persona as a third-party provider. The policy does not use controller/processor terms and mentions no DPIA.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/9945134-privacy-policy",
              "detail": "Privacy Policy opening paragraph and KYC section.",
              "checked_at": "2026-10-09",
              "quote": "a company incorporated under the laws of Uruguay",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No customer DPA found; the Privacy Policy says international transfers are made \"on the basis of a previous agreement with the third-party processor\".",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "note": "exactly/docs describes Hypernative real-time monitoring of protocol contracts with automated pause; the server reports errors to Sentry. No SIEM or endpoint-detection statement found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "The Exa tech-stack page gives a three-layer logical view (Exactly Protocol, Alchemy modular account with WebAuthn and Exa plugins, Exa App); the full server and app source is public. No infrastructure or integration view of Rain, Persona and Sardine.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/docs/blob/fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b/exa-app/the-exa-tech-stack.md#L5-L20",
              "commit": "fd734e9c1bb2c6c91a6d1e4e5c51ced447b4404b",
              "path": "exa-app/the-exa-tech-stack.md",
              "detail": "Tech-stack page with a layer diagram.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "EXA LABS S.A.S., incorporated in Uruguay, under the App Terms; the card terms are between the user, Exa Labs SAS and the issuer Third National, governed by Puerto Rico law. Ramps add Bridge Ventures Inc. (USD/EUR) and Sixalime S.A.S. (Manteca, deposits).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/9942510-exa-app-terms-and-conditions",
              "archive": "data/archive/exa-card-app-terms.txt",
              "detail": "App Terms opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "a corporation incorporated under the laws of Uruguay",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions",
              "detail": "Card terms, definitions (Issuer) and section 14 Governing Law.",
              "checked_at": "2026-10-09",
              "quote": "The issuer for this card program is Third National.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No Uruguayan company-register entry was checked.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Exa and the issuer may suspend, revoke or cancel the card at any time with or without notice; Exa may terminate app access for any reason without notice. Amounts owed survive. Funds stay in the user's self-custodial account and can be withdrawn through the contract path (CROPS S4).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions",
              "detail": "Card terms section 9 Termination.",
              "checked_at": "2026-10-09",
              "quote": "we may suspend, revoke or cancel your Account privileges",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Every card authorisation and refund is sent to Sardine for an automated risk level and score, but at 4fba32b the result only raises an error alert for high or very high risk; it does not decline the payment in code. Whether Sardine's scoring is machine-learning based is not stated by Exa.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/hooks/panda.ts#L192-L215",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/hooks/panda.ts",
              "detail": "assess() posts each transaction (amount, merchant, MCC, country) to Sardine's /v1/issuing/risks endpoint.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/exactly/exa/blob/4fba32be1803f15c0db9f39a055bda4740c1fdf1/server/hooks/panda.ts#L271-L277",
              "commit": "4fba32be1803f15c0db9f39a055bda4740c1fdf1",
              "path": "server/hooks/panda.ts",
              "detail": "The authorization assessment runs in a detached span; a high or very_high level only calls captureException.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "note": "No documentation of monitoring, override or bias evaluation for the Sardine risk scoring was found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Up to 1.5% foreign exchange fee plus up to 1.5% cross-border fee (card terms); help centre states 1.5% FX",
            "basis": "Card terms Important Disclosures (effective 12 Nov 2024); Exa may change fees on 30 days' notice.",
            "evidence_index": 0
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM 1 USD + 0.65% per withdrawal, plus any ATM operator charge",
            "basis": "Help-centre ATM article.",
            "evidence_index": 2
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Bank off-ramp via Bridge: USD ACH 0.4%, US wire 1.0%, EUR SEPA 0.7% after the sponsored quota",
            "basis": "Help-centre ramp fees article; Exa sponsors fees up to 3,000 USD or 60 transactions; wires are never sponsored.",
            "evidence_index": 3
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Origination fee on loans (pay-later installments), included in the interest; 0% APR on card purchases",
            "basis": "Help-centre fees article and card terms Important Disclosures.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions",
            "detail": "Exa Labs Spend Card Terms, Important Disclosures, Fees.",
            "checked_at": "2026-10-09",
            "quote": "Foreign Exchange Fee (non USD): up to 1.5%",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/9055779-exa-card-associated-fees-and-costs",
            "archive": "data/archive/exa-card-ops-card-fees.txt",
            "detail": "Help article \"Exa Card associated fees and costs\" (Oct 2024).",
            "checked_at": "2026-10-09",
            "quote": "We may charge an origination fee whenever you make a loan",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/11758961-how-to-withdraw-cash-from-an-atm-with-your-exa-card",
            "archive": "data/archive/exa-card-ops-atm.txt",
            "detail": "ATM article, Limits & Fees.",
            "checked_at": "2026-10-09",
            "quote": "Fees: $1 + 0.65% per transaction"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/14093183-onramping-offramping-fees-limits",
            "archive": "data/archive/exa-card-ops-ramp-fees.txt",
            "detail": "Onramping and offramping fees and limits (Bridge and Manteca).",
            "checked_at": "2026-10-09",
            "quote": "Fees are deducted from the fiat amount after USDC conversion, prior to the bank transfer",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No issuance, monthly or annual fee is stated; the card is virtual only (no physical card). Card terms and help centre differ on FX: the terms allow up to 1.5% FX plus up to 1.5% cross-border, the help centre says 1.5%. Judgment call: first-party help-centre pricing pages are treated as documented here.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S1",
            "index": 2
          }
        ],
        "note": "Funds rest in the user's own passkey-owned modular account as exaUSDC, but Exa's issuer signature plus keeper can debit any amount to a collector the admin Safe can repoint without a timelock. Agrees with the S1 finding (score 0, provider can redirect funds); the spend path is unbounded, which is the weakest form of hybrid.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "unknown",
        "note": "The card terms name Third National as issuer under a Visa licence with Puerto Rico governing law, and the help centre says the card is issued in the US with Rain's address in San Juan, PR. No first-party document states Third National's regulator, licence type or number. FDIC BankFind lists no active institution named Third National; the OCIF licence verification site failed the TLS handshake from this environment. Ramp partners Bridge Ventures Inc. and Sixalime S.A.S. (Manteca) were not checked against registers.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_withdrawal",
            "partner": "Third National (issuer), Rain, Visa",
            "fee": "FX up to 1.5% (+ up to 1.5% cross-border) on non-USD spend",
            "limits": "Card spend at merchants (the schema has no card-spend value); 10,000 USD weekly purchase limit before source-of-funds checks; not usable in CU, IR, KP, RU, SY, UA, VE.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Third National (issuer), Visa",
            "fee": "1 USD + 0.65% per withdrawal",
            "limits": "250 USD per withdrawal, 4 per day; contactless ATMs via Apple Pay or Google Wallet only (no physical card).",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Bridge Ventures Inc.",
            "fee": "USD ACH 0.4%, US wire 1.0%, EUR SEPA 0.7% after sponsored quota",
            "limits": "USDC converted to USD (ACH, wire) or EUR (SEPA) to an account in the user's name; Bridge may restrict by jurisdiction.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions",
            "detail": "Card terms, purchases and restrictions; cash advances are not available under the card terms.",
            "checked_at": "2026-10-09",
            "quote": "Cash advances and balance transfers are not available",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/11758961-how-to-withdraw-cash-from-an-atm-with-your-exa-card",
            "archive": "data/archive/exa-card-ops-atm.txt",
            "detail": "ATM article; withdrawal by tapping a phone wallet at a contactless ATM.",
            "checked_at": "2026-10-09",
            "quote": "Up to $250 per withdrawal",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.exactly.app/en/articles/13862897-bridge-terms-and-conditions",
            "archive": "data/archive/exa-card-ops-bridge-terms.txt",
            "detail": "Bridge Particular Terms, section 2.2 Offramp Service.",
            "checked_at": "2026-10-09",
            "quote": "The Offramp Service enables users to send funds from their Exa Account to bank accounts",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Contradiction: the card terms say cash advances are not available while the help centre documents ATM withdrawals with fees. Recorded as the help centre states. Manteca (ARS, USD, BRL) is a deposit service only in its Exa terms and is not listed as a cash-out route.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2025-04-08",
            "block": 134272952,
            "what": "IssuerChecker 0x59A644E490E48235adF8ba9b814A4f666C4fEb3A on OP Mainnet (current settlement path; ExaPlugin 0x3d73...7f3e followed at block 134273180)"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://explorer.optimism.io/tx/0xce519a2e7a8118af0be6598c4e19739b354a85ddd20fc46aab06e42924ce3fb5",
              "address": "0x59A644E490E48235adF8ba9b814A4f666C4fEb3A",
              "block_number": 134272952,
              "detail": "IssuerChecker has code size 0 at block 134272951 and 4241 at 134272952 (2025-04-08 20:38:01 UTC), creation tx 0xce519a2e...3fb5. ExaPlugin 0x3d73D0fb9e63c49ba8e9cd738964D5E08C047f3e goes from 0 to 24567 bytes at block 134273180 (2025-04-08 20:45:37 UTC), tx 0x23fa401b...a9ba.",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0x59A644E490E48235adF8ba9b814A4f666C4fEb3A --block 134272951 --rpc-url https://mainnet.optimism.io; cast codesize 0x59A644E490E48235adF8ba9b814A4f666C4fEb3A --block 134272952 --rpc-url https://mainnet.optimism.io"
            }
          ],
          "note": "Dates the deployed contracts scored in CROPS. The card existed before this (card terms effective 12 Nov 2024, fee article Oct 2024) on earlier plugin versions; the exa repo keeps only run-latest broadcasts, so earlier deployments were not dated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "EXA LABS S.A.S.",
            "jurisdiction": "UY"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/9942510-exa-app-terms-and-conditions",
              "archive": "data/archive/exa-card-app-terms.txt",
              "detail": "App Terms opening paragraph names EXA LABS S.A.S., incorporated under the laws of Uruguay.",
              "checked_at": "2026-10-09",
              "quote": "a corporation incorporated under the laws of Uruguay",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No company-register entry checked.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No primary-source incident report found in the help centre, exactly/docs, exactly/audits or a GitHub code search of the exactly org (post-mortem, exploit). Exactly's Medium and Mirror return 403 to curl and were not read. A reviewer should check for incidents on the underlying Exactly Protocol markets before the card launch.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2024-11-12",
              "summary": "Card terms Important Disclosures take effect (0% APR on purchases, FX and cross-border fees up to 1.5%); the terms were revised on 2 Oct 2025.",
              "url": "https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions"
            },
            {
              "date": "2025-04-08",
              "summary": "New IssuerChecker and ExaPlugin deployed on OP Mainnet (the versions currently installed on user accounts).",
              "url": "https://explorer.optimism.io/tx/0x23fa401bbb4e594a974cdb6d0771caf6e66a59a331d011590cabec7fff2ca9ba"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.exactly.app/en/articles/10707672-exa-card-terms-and-conditions",
              "detail": "Card terms Important Disclosures effective date.",
              "checked_at": "2026-10-09",
              "quote": "Effective as of November 12th, 2024",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 10,
          "addresses": [
            "0x59A644E490E48235adF8ba9b814A4f666C4fEb3A"
          ],
          "topic0": "0x8f0c3d4726e2d22ccf850efced91f2d0c1bea40229449223d795a6cff3276236",
          "event": "Collected(address indexed account, uint256 amount, uint256 timestamp)",
          "amount_word": 0,
          "token": "0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85",
          "decimals": 6,
          "symbol": "USDC",
          "window_days": 30,
          "exclusions": "Sums the amount of every Collected event from the listed IssuerChecker (debit, credit and installment collections signed by Exa's issuer key). Refunds (Refunded event) are not subtracted. Word layout checked on sample debit tx 0x906cb586...e79b (word 0 = 43150000 = 43.15 USDC)."
        },
        "note": "Card collections are recorded as Collected events on the listed IssuerChecker, so they can be separated from ordinary transfers. Not yet computed; the maintainer runs scripts/volumes.mjs. The amount is USD-denominated USDC per the plugin; the token is fixed to native USDC on OP.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: eth_getLogs: Your IP has exceeded its requests per second capacity. Please consider using a dedicated API provider: https://community.optimism.io/docs/useful-tools/providers"
      }
    },
    "fluidkey": {
      "slug": "fluidkey",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/contents/?ref=main",
              "detail": "fluidkey/fluidkey-stealth-account-kit: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/contents/?ref=main",
              "detail": "fluidkey/fluidkey-earn-module: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/contents/?ref=main",
              "detail": "fluidkey/sara: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/contents/?ref=main",
              "detail": "fluidkey/fluidkey-hydrator: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/contents/?ref=main",
              "detail": "fluidkey/fluidkey-stealth-account-kit: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/contents/?ref=main",
              "detail": "fluidkey/fluidkey-earn-module: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/contents/?ref=main",
              "detail": "fluidkey/sara: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/contents/?ref=main",
              "detail": "fluidkey/fluidkey-hydrator: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/contents/?ref=main",
              "detail": "fluidkey/fluidkey-stealth-account-kit: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/contents/?ref=main",
              "detail": "fluidkey/fluidkey-earn-module: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/contents/?ref=main",
              "detail": "fluidkey/sara: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/contents/?ref=main",
              "detail": "fluidkey/fluidkey-hydrator: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/rules/branches/main",
              "detail": "fluidkey/fluidkey-stealth-account-kit: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/rules/branches/main",
              "detail": "fluidkey/fluidkey-earn-module: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/rules/branches/main",
              "detail": "fluidkey/sara: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/rules/branches/main",
              "detail": "fluidkey/fluidkey-hydrator: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": true,
                "detail": "3 workflow file(s)"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "1 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/contents/?ref=main",
              "detail": "fluidkey/fluidkey-stealth-account-kit: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/contents/?ref=main",
              "detail": "fluidkey/fluidkey-earn-module: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/contents/?ref=main",
              "detail": "fluidkey/sara: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/contents/?ref=main",
              "detail": "fluidkey/fluidkey-hydrator: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/contents/?ref=main",
              "detail": "fluidkey/fluidkey-stealth-account-kit: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/contents/?ref=main",
              "detail": "fluidkey/fluidkey-earn-module: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/contents/?ref=main",
              "detail": "fluidkey/sara: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/contents/?ref=main",
              "detail": "fluidkey/fluidkey-hydrator: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/contents/?ref=main",
              "detail": "fluidkey/fluidkey-stealth-account-kit: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/contents/?ref=main",
              "detail": "fluidkey/fluidkey-earn-module: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/contents/?ref=main",
              "detail": "fluidkey/sara: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/contents/?ref=main",
              "detail": "fluidkey/fluidkey-hydrator: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": true,
                "detail": "latest tags: v1.1.1, v1.1.0, v1.0.1"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/tags",
              "detail": "fluidkey/fluidkey-stealth-account-kit: latest tags: v1.1.1, v1.1.0, v1.0.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/tags",
              "detail": "fluidkey/fluidkey-earn-module: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/tags",
              "detail": "fluidkey/sara: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/tags",
              "detail": "fluidkey/fluidkey-hydrator: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": false,
                "detail": "1 of 10 recent commits signed"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "1 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/commits?per_page=10",
              "detail": "fluidkey/fluidkey-stealth-account-kit: 1 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/commits?per_page=10",
              "detail": "fluidkey/fluidkey-earn-module: 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/commits?per_page=10",
              "detail": "fluidkey/sara: 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/commits?per_page=10",
              "detail": "fluidkey/fluidkey-hydrator: 1 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/contents/?ref=main",
              "detail": "fluidkey/fluidkey-stealth-account-kit: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/contents/?ref=main",
              "detail": "fluidkey/fluidkey-earn-module: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/contents/?ref=main",
              "detail": "fluidkey/sara: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/contents/?ref=main",
              "detail": "fluidkey/fluidkey-hydrator: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "fluidkey/fluidkey-stealth-account-kit",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "fluidkey/fluidkey-earn-module",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "fluidkey/sara",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "fluidkey/fluidkey-hydrator",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-stealth-account-kit/contents/?ref=main",
              "detail": "fluidkey/fluidkey-stealth-account-kit: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-earn-module/contents/?ref=main",
              "detail": "fluidkey/fluidkey-earn-module: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/sara/contents/?ref=main",
              "detail": "fluidkey/sara: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fluidkey/fluidkey-hydrator/contents/?ref=main",
              "detail": "fluidkey/fluidkey-hydrator: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        }
      }
    },
    "fuse-card": {
      "slug": "fuse-card",
      "facts": {
        "B2.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": true,
                "detail": "security policy file: SECURITY.md"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/contents/?ref=main",
              "detail": "Squads-Protocol/v4: security policy file: SECURITY.md",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/contents/?ref=main",
              "detail": "Squads-Protocol/public-v4-client: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/contents/?ref=main",
              "detail": "Squads-Protocol/v4: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/contents/?ref=main",
              "detail": "Squads-Protocol/public-v4-client: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/contents/?ref=main",
              "detail": "Squads-Protocol/v4: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/contents/?ref=main",
              "detail": "Squads-Protocol/public-v4-client: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/rules/branches/main",
              "detail": "Squads-Protocol/v4: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/rules/branches/main",
              "detail": "Squads-Protocol/public-v4-client: rules: deletion, non_fast_forward, pull_request",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": true,
                "detail": "5 workflow file(s)"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": false,
                "detail": "1 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/contents/?ref=main",
              "detail": "Squads-Protocol/v4: 5 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/contents/?ref=main",
              "detail": "Squads-Protocol/public-v4-client: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/contents/?ref=main",
              "detail": "Squads-Protocol/v4: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/contents/?ref=main",
              "detail": "Squads-Protocol/public-v4-client: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/contents/?ref=main",
              "detail": "Squads-Protocol/v4: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/contents/?ref=main",
              "detail": "Squads-Protocol/public-v4-client: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": false,
                "detail": "latest tags: release-0.1.0"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": true,
                "detail": "latest tags: v1.4.1, v1.4.0, v1.3.0"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/tags",
              "detail": "Squads-Protocol/v4: latest tags: release-0.1.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/tags",
              "detail": "Squads-Protocol/public-v4-client: latest tags: v1.4.1, v1.4.0, v1.3.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/commits?per_page=10",
              "detail": "Squads-Protocol/v4: 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/commits?per_page=10",
              "detail": "Squads-Protocol/public-v4-client: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": true,
                "detail": "CHANGELOG file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/contents/?ref=main",
              "detail": "Squads-Protocol/v4: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/contents/?ref=main",
              "detail": "Squads-Protocol/public-v4-client: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Squads-Protocol/v4",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Squads-Protocol/public-v4-client",
                "ok": true,
                "detail": "contribution section in README"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/v4/contents/?ref=main",
              "detail": "Squads-Protocol/v4: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Squads-Protocol/public-v4-client/contents/?ref=main",
              "detail": "Squads-Protocol/public-v4-client: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "The Squads Trust Center (trust.squads.xyz) lists one framework, SOC 2 Type 1, and no ISO 27001 certificate. Not recorded as absent because a trust-centre listing is not a certifier search; no certifier directory entry was found for Squads, Bridge or Lead Bank.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "attested",
          "value": "Squads Trust Center shows SOC 2 Type 1 as \"Compliant\" (Type 1, not Type II); no report is published and documents are behind a \"Request Access\" form. Bridge and Lead Bank reports not found.",
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://trust.squads.xyz",
              "detail": "Squads Trust Center (Comp AI) compliance overview listing SOC 2 Type 1 as the only framework, with a security questionnaire and documents on request.",
              "checked_at": "2026-10-09",
              "quote": "SOC 2 Type 1",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "The Squads v4 settlement program has ten published audits (OtterSec, Neodyme, Certora, Trail of Bits) pinned to commit 64af733; no audit of the Fuse app, Fuse backend or Bridge card integration is published.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "attested",
          "value": "A \"Vulnerability & Patch Management\" policy is listed on the Squads Trust Center; its patch timelines are not public.",
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://trust.squads.xyz",
              "detail": "Policy titles listed on the Squads Trust Center; policy text available only on request.",
              "checked_at": "2026-10-09",
              "quote": "Vulnerability & Patch Management",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "attested",
          "value": "An \"Incident Response & Breach Notification\" policy is listed on the Squads Trust Center; no notification deadline is published in it, the Fuse Terms, the Squads Terms or the privacy policy.",
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://trust.squads.xyz",
              "detail": "Policy titles listed on the Squads Trust Center; policy text available only on request.",
              "checked_at": "2026-10-09",
              "quote": "Incident Response & Breach Notification",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "attested",
          "value": "A \"Disaster Recovery Policy\" is listed on the Squads Trust Center (text on request). For the user's funds, the walkaway path is the onchain withdrawal from the Card Account (CROPS S4).",
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://trust.squads.xyz",
              "detail": "Policy titles listed on the Squads Trust Center; policy text available only on request.",
              "checked_at": "2026-10-09",
              "quote": "Disaster Recovery Policy",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page or post-mortem found on fusewallet.com (sitemap read in full), squads.xyz or trust.squads.xyz; status.squads.so did not resolve.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Every Fuse wallet has a Device Key (Face ID) and a 2FA Key (iCloud, or a Ledger); the threshold is 1-of-2 until a Recovery Key is added, then 2-of-n, so a second factor is mandatory only after onboarding completes. Card controls (freeze, limit) sit in the same app.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/support/fuse-security",
              "detail": "Fuse security overview, key roles and thresholds.",
              "checked_at": "2026-10-09",
              "quote": "these keys operate on a 1/2 threshold",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/support/fuse-security",
              "detail": "Fuse security overview, 2FA Key.",
              "checked_at": "2026-10-09",
              "quote": "A 2FA Key that adds two-factor authentication for all transactions",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Squads keeps personal information for as long as the user uses the Services or as needed for stated purposes (disputes, audits, legal defence); no fixed period and no deletion-on-termination commitment. KYC data is also held by Bridge and Lead Bank under their own policies (not read).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://squads.xyz/legal/privacy-policy",
              "detail": "Squads privacy policy (covers Fuse), section 7 Retention of Personal Information.",
              "checked_at": "2026-10-09",
              "quote": "We retain the personal information we collect as described in this Privacy Policy for as long as you use the Services",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Selimor Investments Limited d/b/a Squads (BVI) is named as the party processing personal information; Bridge and Lead Bank are named as financial-services partners that collect KYC data. The policy does not use controller/processor terms; no DPIA statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://squads.xyz/legal/privacy-policy",
              "detail": "Squads privacy policy, opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "processing of personal information by Selimor Investments Limited d/b/a Squads",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical view only: Fuse posts describe the Main Account (Squads v4 multisig with Device, 2FA and Recovery keys), the separate Card Account with the Main Account as sole signer, and Bridge's daily Spending Limit. No infrastructure or integration architecture is published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/blog/fuse-pay",
              "detail": "Fuse Pay announcement describing the Card Account and the Bridge spending limit.",
              "checked_at": "2026-10-09",
              "quote": "You can set a daily Spending Limit for Bridge",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Three parties: Squads Inc. under the Fuse Wallet and Card Terms (which form part of the Squads Terms with Selimor Investments Limited, BVI law); Lead Bank (Missouri) as card issuer under the cardholder agreement; Bridge Ventures LLC as programme manager. No company-register entry was checked for the Squads entities.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/legal/terms-of-service",
              "detail": "Fuse Wallet and Card Terms of Service, opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "entered into by and between Squads Inc.",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.bridge.xyz/card-agreements/fuse-card",
              "detail": "Lead Bank Prepaid Visa Cardholder Agreement for Fuse Card.",
              "checked_at": "2026-10-09",
              "quote": "issued to you by Lead Bank",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "On card closure the remaining balance is returned as stablecoin to the user's Fuse wallet at no fee, but the bank may refuse to return balances under 1 USD. Squads may end the platform agreement without reason on 30 days' notice, or sooner where regulators, third parties or risk require. Funds outside the card stay in the user's own Squads accounts.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.bridge.xyz/card-agreements/fuse-card",
              "detail": "Cardholder agreement, termination clause.",
              "checked_at": "2026-10-09",
              "quote": "such amounts will be credited to your Platform Provider wallet in the form of Stablecoin",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://squads.xyz/legal/terms-of-service",
              "detail": "Squads Terms s10.2 Termination.",
              "checked_at": "2026-10-09",
              "quote": "Squads may terminate this Agreement at any time, with or without reason, upon thirty (30) days notice",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "none",
            "amount": "0 USD to obtain the card; no monthly, annual, inactivity or replacement fee",
            "basis": "Cardholder agreement fee schedule (Lead Bank); the bank may change fees on notice by posting or email.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "none",
            "amount": "0% on transactions with merchants outside the US",
            "basis": "Cardholder agreement long-form disclosure (international transaction fee).",
            "evidence_index": 1
          },
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "No top-up fee or card transaction fee",
            "basis": "Fuse support page; top-up is a transfer from the Main Account to the Card Account on Solana (network fee paid via Fuse's paymaster, not quantified).",
            "evidence_index": 2
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Bank transfer: 1 USD ACH fee or 1 USD SEPA fee; no Fuse fee",
            "basis": "Fuse support page on bank transfers.",
            "evidence_index": 3
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Daily card spending limit up to 2,000 USD by default (user-adjustable; may rise with usage)",
            "basis": "Fuse support page; enforced onchain as the Bridge spending limit.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.bridge.xyz/card-agreements/fuse-card",
            "detail": "Lead Bank Prepaid Visa Card long-form fee disclosure.",
            "checked_at": "2026-10-09",
            "quote": "There are no fees to purchase a Card.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.bridge.xyz/card-agreements/fuse-card",
            "detail": "Long-form disclosure, using the card outside the U.S.",
            "checked_at": "2026-10-09",
            "quote": "A fee of 0% applies to the U.S. dollar amount of each transaction conducted with merchants outside of the U.S.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fusewallet.com/support/fuse-visa-card",
            "detail": "Fuse Card support page, card overview and FAQ.",
            "checked_at": "2026-10-09",
            "quote": "No top-up fees or card transaction fees",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fusewallet.com/support/bank-transfers",
            "detail": "Fuse bank transfer options and fees.",
            "checked_at": "2026-10-09",
            "quote": "Fee: Zero Fuse fees. $1 ACH fees still apply.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The cardholder agreement leaves the annual-fee and per-transaction rows blank in its long-form table and says Platform Provider or Program Manager fees may apply to stablecoin sales; Fuse's pages state none. Spread on the USDC-to-USD conversion by Bridge is not stated.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Funds rest in the user's own Squads v4 Card Account (sole member is the user's Main Account); Bridge's key can pull up to the daily limit (default 2,000 USDC) to any destination and settles with merchants off-chain. Agrees with the S1 finding (score 0, bounded ability to redirect funds).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "Lead Bank",
            "holder": "partner",
            "country": "US",
            "regulator": "FDIC (primary federal regulator); state charter, Missouri",
            "type": "State-chartered commercial bank, FDIC-insured, non-member (BKCLASS NM)",
            "number": "FDIC certificate 8283",
            "activities": "Issuer of the Fuse Card (Lead Bank Prepaid Visa Card); Kansas City, MO; active.",
            "register_url": "https://banks.data.fdic.gov/bankfind-suite/bankfind/details/8283",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://api.fdic.gov/banks/institutions?filters=CERT:8283&fields=NAME,CERT,CITY,STNAME,REGAGNT,ACTIVE,BKCLASS,CHRTAGNT,ESTYMD,FED_RSSD&limit=1",
            "archive": "data/archive/fuse-card-ops-fdic-lead-bank.txt",
            "detail": "FDIC BankFind API record for certificate 8283, Lead Bank, Kansas City, Missouri; active, state charter, regulator FDIC, class NM.",
            "checked_at": "2026-10-09",
            "quote": "\"NAME\":\"Lead Bank\"",
            "recheck": "curl -s 'https://api.fdic.gov/banks/institutions?filters=CERT:8283&fields=NAME,ACTIVE,REGAGNT,BKCLASS'",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fusewallet.com/legal/terms-of-service",
            "detail": "Fuse Terms name Lead Bank as the issuing FDIC member bank.",
            "checked_at": "2026-10-09",
            "quote": "issued by Lead Bank, FDIC member bank",
            "confirmed_at": "2026-10-12"
          }
        ],
        "note": "Only the issuer is register-checked. Bridge Ventures LLC (programme manager) holds no stated licence for the card; Bridge's legal page says US account services are provided by Bridge Building Inc. (NMLS ID 2450917), which was not checked in NMLS Consumer Access. Squads says it is not a bank or a digital asset custodian. The cardholder agreement says card funds are not FDIC insured.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Lead Bank (issuer), Bridge (programme manager), Visa",
            "fee": "none stated; 0% international",
            "limits": "Virtual card only (Apple Pay in store); daily limit up to 2,000 USD by default. Available where the card is offered (see availability).",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "none",
            "fee": "n/a",
            "limits": "Not available; the cardholder agreement says ATM withdrawals are not available and the support page says the card cannot be used at ATMs.",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "not named on the page (Fuse's virtual bank accounts are powered by Bridge)",
            "fee": "1 USD ACH or 1 USD SEPA; no Fuse fee",
            "limits": "To ACH or SEPA accounts; not for residents of New York or Alaska or of 35 listed countries (incl. CN, CU, IR, KP, RU, UA, KE, SI).",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fusewallet.com/support/fuse-visa-card",
            "detail": "Fuse Card support page, fees and international use.",
            "checked_at": "2026-10-09",
            "quote": "There are no fees associated with using your Fuse Card.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.bridge.xyz/card-agreements/fuse-card",
            "detail": "Cardholder agreement long-form disclosure, Get cash.",
            "checked_at": "2026-10-09",
            "quote": "ATM withdrawals are not available.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fusewallet.com/support/bank-transfers",
            "detail": "Fuse bank transfer page with fees and the list of restricted countries of residence.",
            "checked_at": "2026-10-09",
            "quote": "Bank transfers are not available for those with a primary residence in a country listed below",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fusewallet.com/blog/fuse-off-ramp",
            "detail": "Fuse Off-Ramp announcement, eligibility.",
            "checked_at": "2026-10-09",
            "quote": "Fuse Off-Ramp is accessible to most users across the US and Europe.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The off-ramp announcement says US and Europe; the support page lists residence-based exclusions instead of an allowlist. Recorded as ALL with the exclusions in limits.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2023-03-20",
            "block": 183693695,
            "what": "Squads v4 program SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf first deployed on Solana mainnet (slot); Bridge's first card SpendingLimitUse followed on 2025-01-15"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/tx/5bwAnr48sKGak6BDpCMngxyyWugJR2qCzfhWDumJgZEqqi5WJQQedBXxnPkYGb1aR9rsgRXZY6uhwSHj6UrZHaqj",
              "address": "SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 183693695,
              "detail": "The oldest of the 23 transactions touching programData Fy3YMJCv... is a System createAccount of SQDS4ep... plus BPF upgradeable loader deployWithMaxDataLen (authority HM5y4mz3...), slot 183693695, 2023-03-20 17:14:36 UTC.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type:application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getSignaturesForAddress\",\"params\":[\"Fy3YMJCvwbAXUgUM5b91ucUVA3jYzwWLHL3MwBqKsh8n\",{\"limit\":1000}]}' | jq '.result[-1]'"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/tx/4h2Wi1By8vB9Z9GNb3ijGWb6HdaF5gQZtZN7Pix2zaDhAq8bkNFMubyb1rD8hj6cqeygBFQGspr2rMphuJsSKYfh",
              "address": "AE2RGS1hhdmMMFrM6HAaZx8XmZL4TuSfQX8wjCpDXv2p",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 314054836,
              "eoa": true,
              "detail": "Paging getSignaturesForAddress back to the start for Bridge's spender key AE2RGS1h... (49,500 signatures) ends at this SpendingLimitUse + TransferChecked, slot 314054836, 2025-01-15 01:38:07 UTC, fee payer 7kEydiJ9....",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "The settlement program predates the card; the date recorded is the program's. The first observed card debit by Bridge's key (2025-01-15) dates the card programme onchain. The current bytecode is from the upgrade of 2024-11-20; the program has been immutable since 2024-11-21 (see changes).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Selimor Investments Limited (d/b/a Squads)",
            "jurisdiction": "VG"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://squads.xyz/legal/terms-of-service",
              "detail": "Squads Terms (of which the Fuse Terms form part) name Selimor Investments Limited, governed by BVI law; the privacy policy gives 19 Waterfront Drive, Road Town, Tortola.",
              "checked_at": "2026-10-09",
              "quote": "Selimor Investments Limited",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fusewallet.com/legal/terms-of-service",
              "detail": "The Fuse Wallet and Card Terms name Squads Inc. as counterparty, with no jurisdiction.",
              "checked_at": "2026-10-09",
              "quote": "entered into by and between Squads Inc.",
              "confirmed_at": "2026-10-12"
            }
          ],
          "note": "Judgment call. Three names appear: Squads Inc. (Fuse Terms counterparty), Squads Labs Inc. (card disclosures) and Selimor Investments Limited d/b/a Squads (Squads Terms and privacy policy, BVI). Selimor is recorded because it is the only one with a stated jurisdiction and the Fuse Terms form part of its terms. The BVI register is not publicly searchable; no register entry was checked.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No primary-source incident report found on fusewallet.com (all blog and support pages in the sitemap), the Squads Trust Center, or the Squads-Protocol/v4 repository (README, SECURITY.md). Not recorded as an empty list because these sources would not necessarily disclose an incident.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2024-01-27",
              "summary": "Squads v4 program upgraded through its upgrade-authority multisig (3YNUB5PL...).",
              "url": "https://solana.fm/tx/422SuJwPQFKsAqpNUYNBq7Gov6tjN1H5pNpkXkq5oqWGrpHqDUAQ4RjWvYQiuSCMpUzg5wFj2KMozNS3TTvudH2E"
            },
            {
              "date": "2024-10-11",
              "summary": "Squads v4 relicensed from BUSL-1.1 to AGPL-3.0 (commit 316913ad, \"Open sourced!\").",
              "url": "https://github.com/Squads-Protocol/v4/commit/316913ad"
            },
            {
              "date": "2024-10-22",
              "summary": "Squads v4 program upgraded.",
              "url": "https://solana.fm/tx/4NfPUWhL6B4D5SR7RLmyCmpzrJZ9pyz25doSzerCXiTHFh2pg5aPS5dxf7fZwvn4eBumYGDRQavNCzMLysKexKpm"
            },
            {
              "date": "2024-11-20",
              "summary": "Squads v4 program upgraded to the bytecode now deployed.",
              "url": "https://solana.fm/tx/2C8c1t748F3gDpmdTNXMws9ofPNr2Vvjsuo9PXn3TgoEQWoVHKHJisjgqr6E7ayZX2u2ZcD7Tag8j1xrB27B839"
            },
            {
              "date": "2024-11-21",
              "summary": "Upgrade authority set to none; the program is immutable from this slot (302808455).",
              "url": "https://solana.fm/tx/2Qikw7Xm2usk2VkdHvKDwecDLZnxzxxag92xtDmHAn4MSk7MSwSA2J6Gy3XaLkAgyeX9qYUMvatE9Yy95kUftPc8"
            },
            {
              "date": "2025-01-15",
              "summary": "First observed Fuse card debit (SpendingLimitUse) by Bridge's spender key.",
              "url": "https://solana.fm/tx/4h2Wi1By8vB9Z9GNb3ijGWb6HdaF5gQZtZN7Pix2zaDhAq8bkNFMubyb1rD8hj6cqeygBFQGspr2rMphuJsSKYfh"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://solana.fm/tx/2Qikw7Xm2usk2VkdHvKDwecDLZnxzxxag92xtDmHAn4MSk7MSwSA2J6Gy3XaLkAgyeX9qYUMvatE9Yy95kUftPc8",
              "address": "SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf",
              "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
              "block_number": 302808455,
              "detail": "The programData transaction list holds upgrades at slots 244446274, 297082331 and 302582236 (inner BPF loader upgrade, authority 3YNUB5PL...) and a setAuthority to null at slot 302808455 (2024-11-21 21:45 UTC).",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://api.mainnet-beta.solana.com -X POST -H 'content-type:application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"getTransaction\",\"params\":[\"2Qikw7Xm2usk2VkdHvKDwecDLZnxzxxag92xtDmHAn4MSk7MSwSA2J6Gy3XaLkAgyeX9qYUMvatE9Yy95kUftPc8\",{\"encoding\":\"jsonParsed\",\"maxSupportedTransactionVersion\":0}]}' | jq '.result.meta.innerInstructions'"
            }
          ],
          "refs": [
            {
              "criterion": "F2",
              "index": 0
            }
          ],
          "note": "Fuse-side changes (card availability widened from US-only at launch to the 18 countries now listed) are not dated in any first-party page and are not listed.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "note": "Card debits are observable on Solana: each is a SpendingLimitUse signed by Bridge's key AE2RGS1h... moving USDC out of a Card Account vault (about 49,500 signatures from 2025-01-15 to 2026-10-09). The volume spec takes an EVM chain_id, log topic and contract list only, so no spec can be written for this Solana rail and the figure is not computed.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "gnosis-pay": {
      "slug": "gnosis-pay",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "gnosispay/ui",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/contents/?ref=main",
              "detail": "gnosispay/account-kit: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/contents/?ref=main",
              "detail": "gnosispay/ui: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/contents/?ref=main",
              "detail": "gnosispay/pse-react-native: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-delay: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-roles: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/contents/?ref=main",
              "detail": "safe-global/safe-smart-account: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "gnosispay/ui",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/contents/?ref=main",
              "detail": "gnosispay/account-kit: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/contents/?ref=main",
              "detail": "gnosispay/ui: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/contents/?ref=main",
              "detail": "gnosispay/pse-react-native: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-delay: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-roles: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/contents/?ref=main",
              "detail": "safe-global/safe-smart-account: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "gnosispay/ui",
                "ok": true,
                "detail": "deployment configuration: Dockerfile.pse-backend"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/contents/?ref=main",
              "detail": "gnosispay/account-kit: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/contents/?ref=main",
              "detail": "gnosispay/ui: deployment configuration: Dockerfile.pse-backend",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/contents/?ref=main",
              "detail": "gnosispay/pse-react-native: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-delay: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-roles: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/contents/?ref=main",
              "detail": "safe-global/safe-smart-account: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, required_linear_history, pull_request"
              },
              {
                "repo": "gnosispay/ui",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/rules/branches/main",
              "detail": "gnosispay/account-kit: rules: deletion, non_fast_forward, required_linear_history, pull_request",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/rules/branches/main",
              "detail": "gnosispay/ui: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/rules/branches/main",
              "detail": "gnosispay/pse-react-native: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/rules/branches/main",
              "detail": "gnosisguild/zodiac-modifier-delay: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/rules/branches/main",
              "detail": "gnosisguild/zodiac-modifier-roles: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/rules/branches/main",
              "detail": "safe-global/safe-smart-account: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": true,
                "detail": "2 workflow file(s)"
              },
              {
                "repo": "gnosispay/ui",
                "ok": true,
                "detail": "8 workflow file(s)"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": true,
                "detail": "2 workflow file(s)"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": true,
                "detail": "3 workflow file(s)"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": true,
                "detail": "2 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/contents/?ref=main",
              "detail": "gnosispay/account-kit: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/contents/?ref=main",
              "detail": "gnosispay/ui: 8 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/contents/?ref=main",
              "detail": "gnosispay/pse-react-native: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-delay: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-roles: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/contents/?ref=main",
              "detail": "safe-global/safe-smart-account: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "gnosispay/ui",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/contents/?ref=main",
              "detail": "gnosispay/account-kit: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/contents/?ref=main",
              "detail": "gnosispay/ui: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/contents/?ref=main",
              "detail": "gnosispay/pse-react-native: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-delay: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-roles: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/contents/?ref=main",
              "detail": "safe-global/safe-smart-account: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "gnosispay/ui",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": true,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/contents/?ref=main",
              "detail": "gnosispay/account-kit: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/contents/?ref=main",
              "detail": "gnosispay/ui: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/contents/?ref=main",
              "detail": "gnosispay/pse-react-native: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-delay: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-roles: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/contents/?ref=main",
              "detail": "safe-global/safe-smart-account: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": true,
                "detail": "latest tags: v5.1.1, v5.1.0, v5.0.1"
              },
              {
                "repo": "gnosispay/ui",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": true,
                "detail": "latest tags: v1.0.7, v1.0.6, v1.0.5"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": true,
                "detail": "latest tags: v1.1.0, v1.0.1"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": false,
                "detail": "latest tags: zodiac-roles-sdk-v4.1.3, zodiac-roles-sdk-v4.1.2, zodiac-roles-sdk-v4.1.1"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": true,
                "detail": "latest tags: v1.5.0, v1.5.0-base, v1.4.1"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/tags",
              "detail": "gnosispay/account-kit: latest tags: v5.1.1, v5.1.0, v5.0.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/tags",
              "detail": "gnosispay/ui: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/tags",
              "detail": "gnosispay/pse-react-native: latest tags: v1.0.7, v1.0.6, v1.0.5",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/tags",
              "detail": "gnosisguild/zodiac-modifier-delay: latest tags: v1.1.0, v1.0.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/tags",
              "detail": "gnosisguild/zodiac-modifier-roles: latest tags: zodiac-roles-sdk-v4.1.3, zodiac-roles-sdk-v4.1.2, zodiac-roles-sdk-v4.1.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/tags",
              "detail": "safe-global/safe-smart-account: latest tags: v1.5.0, v1.5.0-base, v1.4.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "gnosispay/ui",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/commits?per_page=10",
              "detail": "gnosispay/account-kit: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/commits?per_page=10",
              "detail": "gnosispay/ui: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/commits?per_page=10",
              "detail": "gnosispay/pse-react-native: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/commits?per_page=10",
              "detail": "gnosisguild/zodiac-modifier-delay: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/commits?per_page=10",
              "detail": "gnosisguild/zodiac-modifier-roles: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/commits?per_page=10",
              "detail": "safe-global/safe-smart-account: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": true,
                "detail": "7 release(s) with notes"
              },
              {
                "repo": "gnosispay/ui",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": true,
                "detail": "2 release(s) with notes"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": true,
                "detail": "CHANGELOG file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/contents/?ref=main",
              "detail": "gnosispay/account-kit: 7 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/contents/?ref=main",
              "detail": "gnosispay/ui: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/contents/?ref=main",
              "detail": "gnosispay/pse-react-native: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-delay: 2 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-roles: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/contents/?ref=main",
              "detail": "safe-global/safe-smart-account: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "gnosispay/account-kit",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "gnosispay/ui",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "gnosispay/pse-react-native",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-delay",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "gnosisguild/zodiac-modifier-roles",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "safe-global/safe-smart-account",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/account-kit/contents/?ref=main",
              "detail": "gnosispay/account-kit: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/ui/contents/?ref=main",
              "detail": "gnosispay/ui: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosispay/pse-react-native/contents/?ref=main",
              "detail": "gnosispay/pse-react-native: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-delay/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-delay: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/gnosisguild/zodiac-modifier-roles/contents/?ref=main",
              "detail": "gnosisguild/zodiac-modifier-roles: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safe-global/safe-smart-account/contents/?ref=main",
              "detail": "safe-global/safe-smart-account: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "Published audits cover the Safe, Delay and Roles code that holds funds (CROPS S6); no independent review of Gnosis Pay's own Spender or Bouncer contracts, backend or app was found.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Public status page at status.gnosispay.com (Upptime, open source in gnosispay/gnosispay-uptime) and a formal closure notice. No post-mortem for the June 2026 security incident was found; the help centre article on it gives recovery steps only.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.gnosispay.com",
              "detail": "Upptime status page for Gnosis Pay services, source in github.com/gnosispay/gnosispay-uptime.",
              "checked_at": "2026-10-09",
              "quote": "Check the availability for GnosisPay services",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/1452055581-formal-notice-closure-of-the-gnosis-pay-web-app-and-card-21-september-2026",
              "archive": "data/archive/gnosis-pay-closure-notice.txt",
              "detail": "Closure notice naming the licensed issuers and their regulator references.",
              "checked_at": "2026-10-09",
              "quote": "Please read this notice carefully and keep a copy",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/8765952539-recovering-funds-after-the-2026-security-incident",
              "archive": "data/archive/gnosis-pay-ops-incident-recovery.txt",
              "detail": "Help centre article on the June 2026 incident; it explains how to withdraw from pre-incident Safes and gives no cause, timeline or loss figure.",
              "checked_at": "2026-10-09",
              "quote": "In June 2026 we migrated everyone to a new card Safe following a security incident",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Sign-in is a Sign-In with Ethereum signature from the wallet that owns the Safe, exchanged for a JWT; no separate second factor is documented. Funds at rest also need that wallet's signature plus the Delay cooldown.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/auth.mdx#L6-L31",
              "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
              "path": "auth.mdx",
              "detail": "Authentication flow: nonce, SIWE signature from an EOA or EIP-1271 account that owns a Gnosis Pay account, then a JWT.",
              "checked_at": "2026-10-09"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "Sign-In with Ethereum (SIWE) issues a JWT sent as a Bearer token; partner SIWE domains must be whitelisted.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/auth.mdx#L58-L73",
              "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
              "path": "auth.mdx",
              "detail": "Domain whitelisting for SIWE and the Authorization Bearer jwt header.",
              "checked_at": "2026-10-09"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Partners get a Partner ID and an App ID from the Partners Dashboard; the App ID authenticates a mutual-TLS connection for Partner Secure Elements. Webhooks are Ed25519-signed (CROPS S5). Key scoping and rotation are not documented.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/integration-model.mdx#L50-L55",
              "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
              "path": "integration-model.mdx",
              "detail": "Partner ID and APP_ID; APP_ID authenticates with PSE over mTLS.",
              "checked_at": "2026-10-09"
            }
          ],
          "refs": [
            {
              "criterion": "S5",
              "index": 0
            },
            {
              "criterion": "S5",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "JWT validity is set per sign-in between 1 and 24 hours (ttlInSeconds); anything above 2 hours exceeds the partner's 120-minute cap. Expired tokens need a new signed SIWE message.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/auth.mdx#L35-L41",
              "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
              "path": "auth.mdx",
              "detail": "JWT length validity: minimum 1 hour, maximum 24 hours.",
              "checked_at": "2026-10-09"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "note": "Cardholders can export card transactions as CSV (CROPS O4); no export limits or export logging were found.",
          "refs": [
            {
              "criterion": "O4",
              "index": 2
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "evidenced",
          "value": "No separation is stated: the privacy policy lists system administration, operation and testing as a purpose for all categories of personal data.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/7638555831",
              "archive": "data/archive/gnosis-pay-privacy.txt",
              "detail": "Privacy and Cookie Policy (last updated 13 February 2026), purposes table, \"Conducting system testing\".",
              "checked_at": "2026-10-09",
              "quote": "Conducting system testing We collect, analyse, use and store your personal data for the purposes of system administration, operation, testing and support",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Identification, biometric, contact, financial, transaction, device and support data kept up to 7 years for partner and legal obligations (privacy policy); KYC and transaction records 5 years after closure per the data article (CROPS P2). After the card closes, dispute and chargeback support runs to 12 June 2028 and Monavate keeps transaction records for the legally required period.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/7638555831",
              "archive": "data/archive/gnosis-pay-privacy.txt",
              "detail": "Privacy and Cookie Policy section 11, How long we retain your personal data.",
              "checked_at": "2026-10-09",
              "quote": "for a period of up to a maximum of 7 years",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/1452055581-formal-notice-closure-of-the-gnosis-pay-web-app-and-card-21-september-2026",
              "archive": "data/archive/gnosis-pay-closure-notice.txt",
              "detail": "Closure notice naming the licensed issuers and their regulator references.",
              "checked_at": "2026-10-09",
              "quote": "disputes and chargebacks ends 23:59 UTC, 12 June 2028",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 2
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Controller is Gnosis P. Tech, Unipessoal Lda (Lisbon) for EEA residents and Gnosis Pay Co Ltd (London) for non-EEA residents; KYC is run by Sumsub as a service provider. DPIA availability not found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/7638555831",
              "archive": "data/archive/gnosis-pay-privacy.txt",
              "detail": "Privacy and Cookie Policy section 2 defines \"Gnosis Pay\" per residence.",
              "checked_at": "2026-10-09",
              "quote": "where you are resident in a non-EEA country, Gnosis Pay Co Ltd",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Integration and part of the logical architecture are documented in the public docs repo (SIWE auth, partner model, PSE, webhooks, and the Safe with Delay, Roles and Bouncer modules); infrastructure architecture is not published.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/gp-onchain/overview.mdx#L6-L24",
              "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
              "path": "gp-onchain/overview.mdx",
              "detail": "Onchain overview naming the Safe, Delay, Roles and Bouncer modules and the Account Kit SDK.",
              "checked_at": "2026-10-09"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Platform agreement: Gnosis Pay Co Ltd (England and Wales, 14919639) for non-EEA residents or Gnosis P. Tech, Unipessoal Lda (Portugal, 517 666 898) for EEA residents. Card agreement: Monavate (UAB Monavate for EEA, Monavate Ltd for UK and non-EEA), with Gnosis Pay as technical services provider and programme manager.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/2178874711",
              "archive": "data/archive/gnosis-pay-terms.txt",
              "detail": "Terms of Service section 1 name the two Gnosis Pay contracting entities with company numbers and registered offices.",
              "checked_at": "2026-10-09",
              "quote": "Gnosis Pay Co Ltd is a company registered in England and Wales under company number 14919639",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/14919639",
              "detail": "Companies House record for GNOSIS PAY CO LTD., active private limited company, incorporated 7 June 2023.",
              "checked_at": "2026-10-09",
              "quote": "Incorporated on 7 June 2023",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/1452055581-formal-notice-closure-of-the-gnosis-pay-web-app-and-card-21-september-2026",
              "archive": "data/archive/gnosis-pay-closure-notice.txt",
              "detail": "Closure notice naming the licensed issuers and their regulator references.",
              "checked_at": "2026-10-09",
              "quote": "Gnosis Pay acts as a technical services provider",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The Portuguese entity was not checked in a Portuguese company register.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "The consumer card and web app end at 23:59 UTC on 20 December 2026; the cardholder agreement then ends, refunds and chargeback rights survive, and assets stay in the user's self-custodial Safe with a withdrawal page kept open. Card closure or suspension otherwise follows Monavate's cardholder terms.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/1452055581-formal-notice-closure-of-the-gnosis-pay-web-app-and-card-21-september-2026",
              "archive": "data/archive/gnosis-pay-closure-notice.txt",
              "detail": "Closure notice sections 5 and 6.",
              "checked_at": "2026-10-09",
              "quote": "neither Gnosis Pay nor Monavate can take them or prevent you from moving them",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "absent",
          "value": "The privacy policy states that no automated decision making is used.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/7638555831",
              "archive": "data/archive/gnosis-pay-privacy.txt",
              "detail": "Privacy and Cookie Policy section 10 (Your rights as a data subject).",
              "checked_at": "2026-10-09",
              "quote": "We do not make use of any automated decision making",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Gnosis Pay's own statement. Screening by Sumsub and by the issuer Monavate is outside this statement and was not found described.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "not_applicable",
          "reason": "B12.1 is absent on the provider's own statement, so there is no AI control to document.",
          "burden": "none",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "no transaction fee on purchases; spends debit stablecoin 1:1",
            "basis": "Gnosis Pay fee and limits article (legacy help centre); Gnosis Pay may change fees with notice under Terms section 17.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Visa exchange rate, no Gnosis Pay mark-up",
            "basis": "Same article; the rate is Visa's.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "card order free; replacement 4.99 EURe/GBPe/USDCe",
            "basis": "Same article; the Terms allow an Admin Fee for physical cards shown at order time.",
            "evidence_index": 0
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM free for 5 withdrawals or 200 EURe/GBPe/USDCe a month, then 2% per withdrawal",
            "basis": "Same article (ATM fair usage policy); ATM operators may add their own charges.",
            "evidence_index": 0
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "spend 8,000 a day, 5,000 per transaction; ATM 500 a day, 250 per withdrawal (EURe/GBPe/USDCe)",
            "basis": "Same article.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "no gas on card spends; gas (xDAI) on onchain transfers from the Safe",
            "basis": "Same article and Terms (third-party charges).",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/6104401027",
            "archive": "data/archive/gnosis-pay-ops-fees.txt",
            "detail": "Fee and limits article (Understanding Your Card's Fees and Limits), linked from the Terms (section 7) as the Fee Schedule and kept published for reference after the closure notice.",
            "checked_at": "2026-10-09",
            "quote": "Card Replacement 4.99 EURe/GBPe/USDCe",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/2178874711",
            "archive": "data/archive/gnosis-pay-terms.txt",
            "detail": "Terms of Service section 7, Charges; Monavate fees under the cardholder terms are third-party charges.",
            "checked_at": "2026-10-09",
            "quote": "you will be liable for certain fees associated with your use of the Card which are charged to you by Monavate",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Consumer card fees as published for the programme that closes at 23:59 UTC on 20 December 2026; partner card programmes set their own fees. Monerium charges for IBAN redemption were not checked.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 2
          },
          {
            "criterion": "S1",
            "index": 4
          }
        ],
        "note": "Funds sit in the user's own Safe; card spends are pulled through a Gnosis Pay-controlled spend path bounded by a daily allowance to a fixed settlement address (S1 = 1).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "UAB Monavate",
            "holder": "partner",
            "country": "LT",
            "regulator": "Bank of Lithuania",
            "type": "Electronic money institution licence (non-limited activity)",
            "number": "LB002139",
            "activities": "E-money issuance, card issuing and acquiring, payment transactions, cash withdrawals; valid from 2022-03-31",
            "register_url": "https://www.lb.lt/en/sfi-financial-market-participants/uab-monavate",
            "evidence_index": 0
          },
          {
            "entity": "Monavate Ltd",
            "holder": "partner",
            "country": "GB",
            "regulator": "Financial Conduct Authority",
            "type": "Authorised Electronic Money Institution",
            "number": "901097",
            "activities": "Issue e-money and provide payment services; authorised since 04/11/2020",
            "register_url": "https://register.fca.org.uk/s/firm?id=0014G00002UyCbDQAV",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.lb.lt/en/sfi-financial-market-participants/uab-monavate",
            "detail": "Bank of Lithuania register entry for UAB Monavate (company code 305628001), authorisation code LB002139, e-money institution licence valid from 2022-03-31; also lists a sanction of 2025-11-25 (fine EUR 270,000) under the AML/CTF law and e-money and safeguarding rules.",
            "checked_at": "2026-10-09",
            "quote": "Electronic money institution licence",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://register.fca.org.uk/s/firm?id=0014G00002UyCbDQAV",
            "archive": "data/archive/gnosis-pay-ops-fca-monavate.txt",
            "detail": "FCA Register firm page for reference 901097 (client-rendered; text read in a browser and archived), Companies House number 12472532.",
            "checked_at": "2026-10-09",
            "quote": "Authorised Electronic Money Institution"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/1452055581-formal-notice-closure-of-the-gnosis-pay-web-app-and-card-21-september-2026",
            "archive": "data/archive/gnosis-pay-closure-notice.txt",
            "detail": "Closure notice names which Monavate entity issues the card for EEA and for UK and other non-EEA cardholders.",
            "checked_at": "2026-10-09",
            "quote": "regulated by the Bank of Lithuania (authorisation code LB002139)",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Both licences are held by the issuer partner; Gnosis Pay itself holds none and describes itself as a technical services provider. The Bank of Lithuania register records an enforcement measure against UAB Monavate dated 2025-11-25: a EUR 270,000 fine for breaches of the AML/CTF law and of e-money institution governance and safeguarding rules. EURe and the IBAN service come from Monerium, an e-money institution regulated in Iceland (CROPS context); not checked in a register here.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_withdrawal",
            "partner": "Monavate (issuer), Visa",
            "fee": "none from Gnosis Pay; Visa FX rate",
            "limits": "Card spend at merchants (the schema has no card-spend value); 8,000 a day, 5,000 per transaction. Card stops at 23:59 UTC on 20 December 2026.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Monavate (issuer), Visa",
            "fee": "5 withdrawals or 200 a month free, then 2%",
            "limits": "500 a day, 250 per withdrawal; ends with the card on 20 December 2026.",
            "evidence_index": 0
          },
          {
            "countries": [
              "EU",
              "CH"
            ],
            "method": "bank_transfer",
            "partner": "Monerium (EURe issuer, SEPA)",
            "fee": "not stated by Gnosis Pay",
            "limits": "EUR cards only; funds leave the Safe onchain to the user's own wallet, which Monerium redeems to a SEPA account. Continues after the card closes.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/6104401027",
            "archive": "data/archive/gnosis-pay-ops-fees.txt",
            "detail": "Fee and limits article covering purchases, ATM withdrawals and limits.",
            "checked_at": "2026-10-09",
            "quote": "After allowance is exceeded: 2% fee per additional withdrawal",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.gnosispay.com/articles/5556167633-getting-money-to-a-bank-account",
            "archive": "data/archive/gnosis-pay-ops-bank-cashout.txt",
            "detail": "Help centre article on the Monerium IBAN off-ramp.",
            "checked_at": "2026-10-09",
            "quote": "IBANs are only available on EUR cards",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/gnosispay/docs/blob/b0b8c668d044b543f794e6a91065045ec03c6cbb/on-off-ramps/iban-integration.mdx#L6-L14",
            "commit": "b0b8c668d044b543f794e6a91065045ec03c6cbb",
            "path": "on-off-ramps/iban-integration.mdx",
            "detail": "IBAN via Monerium for users in the EU and Switzerland; it operates independently of the GP Safe.",
            "checked_at": "2026-10-09"
          }
        ],
        "note": "ALL means every country in the availability list (EEA, CH, GB, AR, BO, BR, CO, MX). The withdrawal page for moving assets out of the Safe onchain stays open after 20 December 2026. No cash agents.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2023-12-13",
            "block": 31420289,
            "what": "Gnosis Pay settlement Safe 0x4822521E...72EE on Gnosis Chain (receiver of every card spend, CROPS S1)"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://gnosisscan.io/tx/0x74f6c12fa5bc4c9a77dbb280ea98ade4a6a1c704df59384cd5e4391cda878ec2",
              "address": "0x4822521E6135CD2599199c83Ea35179229A172EE",
              "block_number": 31420289,
              "detail": "Settlement Safe has code size 0 at block 31420288 and 171 at 31420289 (2023-12-13 11:44:00 UTC); creation tx 0x74f6c12f...8ec2 from 0xa6B71E26C5e0845f74c812102Ca7114b6a896AB2 (Safe proxy factory).",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0x4822521E6135CD2599199c83Ea35179229A172EE --block 31420288 --rpc-url https://rpc.gnosischain.com; cast codesize 0x4822521E6135CD2599199c83Ea35179229A172EE --block 31420289 --rpc-url https://rpc.gnosischain.com"
            }
          ],
          "note": "Dates the settlement address scored in CROPS. The spend-path modifiers in use today were redeployed after the June 2026 incident (account-kit f4b92878); earlier settlement or spender addresses, if any, were not traced.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Gnosis Pay Co Ltd",
            "jurisdiction": "GB",
            "register_url": "https://find-and-update.company-information.service.gov.uk/company/14919639",
            "registration_number": "14919639"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/14919639",
              "detail": "Companies House, GNOSIS PAY CO LTD., active, registered office 12 New Fetter Lane, London EC4A 1JP.",
              "checked_at": "2026-10-09",
              "quote": "Incorporated on 7 June 2023",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/2178874711",
              "archive": "data/archive/gnosis-pay-terms.txt",
              "detail": "Terms of Service section 1 name Gnosis Pay Co Ltd (non-EEA residents) and Gnosis P. Tech, Unipessoal Lda (EEA residents, Portugal 517 666 898).",
              "checked_at": "2026-10-09",
              "quote": "Gnosis P. Tech, Unipessoal Lda is a company registered in Portugal under company number 517 666 898",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Recorded entity is the non-EEA contracting party, checked in Companies House. EEA residents contract with Gnosis P. Tech, Unipessoal Lda (Portugal, 517 666 898, per the Terms; not checked in a Portuguese register). The card itself is a contract with Monavate.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-06-03",
              "summary": "Security incident; users migrated to new Safes and all three modifier mastercopies replaced (account-kit f4b92878). Gnosis Pay's help centre confirms the incident and keeps a withdraw-legacy page for funds left in pre-incident Safes; no cause or loss figure is published.",
              "funds_lost": "unknown",
              "url": "https://help.gnosispay.com/articles/8765952539-recovering-funds-after-the-2026-security-incident"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/8765952539-recovering-funds-after-the-2026-security-incident",
              "archive": "data/archive/gnosis-pay-ops-incident-recovery.txt",
              "detail": "Help centre article on the June 2026 incident (recovery instructions only).",
              "checked_at": "2026-10-09",
              "quote": "If your old Safe was affected by the incident, anything sent there is lost",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S6",
              "index": 1
            }
          ],
          "note": "No public post-mortem was found; funds_lost is unknown although the frontend's recovery list carries a balance_if_not_hacked field. The date is the account-kit commit date; Gnosis Pay gives the month only.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-12-01",
              "summary": "Revised Terms of Service (published 18 November 2025) take effect for existing customers.",
              "url": "https://help.gnosispay.com/articles/2178874711"
            },
            {
              "date": "2026-09-21",
              "summary": "Consumer card programme closes: card and web app stop at 23:59 UTC on 20 December 2026; withdrawals remain open; dispute support ends 12 June 2028; Gnosis Pay moves to partner card programmes.",
              "url": "https://help.gnosispay.com/articles/1452055581-formal-notice-closure-of-the-gnosis-pay-web-app-and-card-21-september-2026"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/1452055581-formal-notice-closure-of-the-gnosis-pay-web-app-and-card-21-september-2026",
              "archive": "data/archive/gnosis-pay-closure-notice.txt",
              "detail": "Closure notice dated 21 September 2026.",
              "checked_at": "2026-10-09",
              "quote": "Your card and the web app will stop working at 23:59 UTC on 20 December 2026",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.gnosispay.com/articles/2178874711",
              "archive": "data/archive/gnosis-pay-terms.txt",
              "detail": "Terms of Service header with publication and effective dates.",
              "checked_at": "2026-10-09",
              "quote": "1st December 2025 for existing customers onboarded prior to the date stated above",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "Card spends settle as EURe (or GBPe, USDCe) transfers from each user Safe to one settlement Safe; the transfer event carries no card data, and spends cannot be separated from ordinary transfers to that address without the provider's records.",
        "note": "The consumer card stops on 20 December 2026.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "hesabpay": {
      "slug": "hesabpay",
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "monthly maintenance, 15 points (active accounts) or AFN 15 (inactive accounts)",
            "basis": "Terms s4.1; HesabPay may adjust with reasonable notice.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "no issuance, periodic, 3DS or SMS fee on the Visa Card",
            "basis": "HesabPay Visa Card FAQ.",
            "evidence_index": 1
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "about 1% when converting AFN to USD for card use",
            "basis": "HesabPay Visa Card FAQ; terms s1.4 says card currency exchange is at Da Afghanistan Bank rates.",
            "evidence_index": 1
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Visa Card 20,000 AFN per week, 80,000 AFN per month",
            "basis": "HesabPay Visa Card FAQ, which says these limits are set by the Central Bank.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hesab.com/terms",
            "quote": "HesabPay reserves the right to adjust maintenance fees with reasonable notice.",
            "detail": "Terms and Conditions (effective 2026-04-06) s4.1 Monthly Maintenance Charges; s2.2 says statements carry no fee.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hesab.com/visa/FAQs",
            "quote": "An approximately 1% foreign-exchange fee may apply when converting funds from AFN to USD",
            "detail": "HesabPay Visa Card FAQ items 05 (fees) and 06 (limits).",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No published tariff for transfers, E-Hawala cash-out or agent cash-in was found on hesab.com (sitemap read 2026-10-09; /fees and /pricing return 404). Those components are unknown, not zero.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "C2",
            "index": 0
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "Zinzir Ltd (HesabPay)",
            "holder": "provider",
            "country": "AF",
            "regulator": "Da Afghanistan Bank",
            "type": "Electronic money institution licence",
            "number": "EMI101005",
            "activities": "Electronic money institution; licence date 5 June 2023",
            "register_url": "https://www.dab.gov.af/non-banking-financial-institutions",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.dab.gov.af/non-banking-financial-institutions",
            "quote": "Zinzir Ltd",
            "detail": "Da Afghanistan Bank list of licensed electronic money institutions: HesabPay, Name of EMI: Zinzir Ltd, license No: EMI101005, License Date: 5 June 2023, website https://hesab.com/.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The terms and privacy policy name HesabPay, Inc. (Delaware) as the contracting party. Neither document states how it relates to the licensee Zinzir Ltd. HesabPay's September 2026 security post says the official app is published under the Zinzir Ltd. brand. No US money-transmitter licence was looked for.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "AF"
            ],
            "method": "cash_agent",
            "partner": "HesabPay agents (1,200+, E-Hawala)",
            "evidence_index": 0
          },
          {
            "countries": [
              "AF"
            ],
            "method": "bank_transfer",
            "partner": "Linked bank accounts",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "HesabPay Visa Card (partner-issued), any Visa-enabled ATM",
            "limits": "20,000 AFN per week, 80,000 AFN per month on the card",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hesab.com/terms",
            "quote": "Recipients receive an SMS notification and can collect cash from any of HesabPay",
            "detail": "Terms s2.4 E-Hawala (cash-out transfers), also usable by recipients without a HesabPay account.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hesab.com/terms",
            "quote": "Sending and receiving money from linked bank accounts.",
            "detail": "Terms s1.2 services.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hesab.com/terms",
            "quote": "ATM cash withdrawals from any Visa-enabled ATM globally",
            "detail": "Terms s1.4 HesabPay Visa Card. HesabPay's July 2026 announcement describes the card as virtual, so ATM use may depend on a physical card or a wallet-enabled ATM; this was not checked.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No cash-out fees are published. ALL for ATM follows the terms' \"globally\"; the card itself is offered only to HesabPay account holders.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "unknown",
          "note": "No primary source dating the service launch was found. HesabPay's own July 2026 press release says Hesab was founded in 2018 (company, not service). The Da Afghanistan Bank EMI licence is dated 5 June 2023 (see changes).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "HesabPay, Inc.",
            "jurisdiction": "US-DE"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "quote": "where HesabPay, Inc. is incorporated in Delaware",
              "detail": "Privacy Policy s8; terms s9 put the agreement under Delaware law; contact address 2093 Philadelphia Pike, Claymont, DE.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The Delaware company register was not read (its entity search sits behind a challenge page, which was not bypassed), so no registration number is recorded. The licensed entity in Afghanistan is Zinzir Ltd (see licences).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No primary-source incident notice was found on hesab.com (sitemap and blog read 2026-10-09). HesabPay's 2026-09-01 security post warns about phishing and tampered APKs but reports no incident. No status page found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2023-06-05",
              "summary": "Da Afghanistan Bank EMI licence EMI101005 granted to Zinzir Ltd (HesabPay).",
              "url": "https://www.dab.gov.af/non-banking-financial-institutions"
            },
            {
              "date": "2026-07-24",
              "summary": "HesabPay announced the launch of Visa virtual cards in Afghanistan (own press release).",
              "url": "https://hesab.com/resources/blog/hesabpay-launches-visa-cards-what-users-should-know"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.dab.gov.af/non-banking-financial-institutions",
              "quote": "EMI101005",
              "detail": "DAB licensed EMI list entry for HesabPay.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/resources/blog/hesabpay-launches-visa-cards-what-users-should-know",
              "quote": "today announced the launch of Hesab Visa Pay virtual cards in Afghanistan",
              "detail": "HesabPay press release dated Kabul, July 24, 2026.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "Closed custodial ledger. HesabPay describes using Algorand, but no HesabPay document links a settlement address or asset, so nothing can be read and attributed from a chain. Reported figures are not recorded.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement or certificate found on hesab.com, the terms or the privacy policy.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "attested",
          "value": "The privacy policy states regular security audits and penetration testing; no report, date or tester is named.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "quote": "Regular security audits and penetration testing.",
              "detail": "Privacy Policy s4.2 Security Measures (also states PCI DSS compliance for card data).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "The privacy policy commits to notify users of material policy changes, not of incidents.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page linked from hesab.com.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "The policy states multi-factor authentication for account access and high-value transactions; the September 2026 security post refers to PIN and OTP.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "quote": "Multi-factor authentication for account access and high-value transactions.",
              "detail": "Privacy Policy s4.2.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "The API reference at developers.hesab.com is a client-rendered app whose docs routes need a login; its public bundle shows no auth scheme.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Policy states encryption at rest and in transit. Observed: hesab.com refuses TLS 1.1 and accepts TLS 1.2. No data classification found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "quote": "Your data is stored on secure servers with encryption at rest and in transit.",
              "detail": "Privacy Policy s4.1.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://hesab.com",
              "detail": "openssl s_client -tls1_1 to hesab.com:443 failed with alert protocol version; -tls1_2 negotiated ECDHE-ECDSA-AES128-GCM-SHA256. Run 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect hesab.com:443 -servername hesab.com -tls1_1; echo | openssl s_client -connect hesab.com:443 -servername hesab.com -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Personal data kept while the account is active or as needed; transaction records at least 5 years; account deletion on request except where law requires retention.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/privacy",
              "quote": "Transaction records are retained for a minimum of 5 years as required by financial regulations.",
              "detail": "Privacy Policy s4.3 Data Retention.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "unknown",
          "note": "The privacy policy speaks as HesabPay, Inc. but does not use controller or processor terms, and no DPIA is mentioned.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "note": "The policy describes \"blockchain-secured audit trails\" for transaction records; no account-change or login logging statement was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "unknown",
          "note": "No public architecture document found; developer docs need a login.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "HesabPay, Inc. (Delaware, US), per the terms; Delaware law governs. Licensee in Afghanistan is Zinzir Ltd.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "quote": "This Agreement shall be governed by the laws of the State of Delaware, United States.",
              "detail": "Terms s9; s6 and the footer name HesabPay, Inc.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Customer fees (monthly maintenance charges, card FX); no other funding source was read.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "quote": "HesabPay reserves the right to adjust maintenance fees with reasonable notice.",
              "detail": "Terms s4.1.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Terms list termination grounds (fraud, breach, unregistered phone, court or government order) with no notice period and no statement of what happens to balances on termination; s2.3 says funds can be withdrawn at any time.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "quote": "Court or government orders mandating termination.",
              "detail": "Terms s7 Termination.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Yes: the Ask HesabPay AI assistant initiates transactions from natural-language commands (standard authentication still applies), and inputs go to third-party language-model providers. The policy also states automated fraud detection and real-time transaction monitoring.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hesab.com/terms",
              "quote": "is an AI-powered payment assistant that allows users to initiate transactions",
              "detail": "Terms s2.1 Ask HesabPay; privacy policy s3 names AI processing partners.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "note": "The policy says AI inputs are not used to train third-party models; no monitoring, override or bias-evaluation documentation found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      }
    },
    "hinkal": {
      "slug": "hinkal",
      "facts": {
        "B2.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": true,
                "detail": "security policy file: SECURITY.md"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-go: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/contents/?ref=main",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: security policy file: SECURITY.md",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-go: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/contents/?ref=main",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-go: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/contents/?ref=main",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/rules/branches/main",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/rules/branches/main",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/rules/branches/main",
              "detail": "Hinkal-Protocol/hinkal-go: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/rules/branches/main",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/rules/branches/main",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/rules/branches/main",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-go: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/contents/?ref=main",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-go: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/contents/?ref=main",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-go: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/contents/?ref=main",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "latest tags: v20261015-1e529ff, v20261012-c49808e, v20261008-bab6aa1"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": true,
                "detail": "latest tags: v0.1.0"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": true,
                "detail": "latest tags: 0.1.4, 0.1.3, 0.1.2"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": true,
                "detail": "latest tags: v0.0.4"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/tags",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/tags",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: latest tags: v20261015-1e529ff, v20261012-c49808e, v20261008-bab6aa1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/tags",
              "detail": "Hinkal-Protocol/hinkal-go: latest tags: v0.1.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/tags",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: latest tags: 0.1.4, 0.1.3, 0.1.2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/tags",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: latest tags: v0.0.4",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/tags",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "2 of 6 recent commits signed"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": false,
                "detail": "0 of 5 recent commits signed"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": false,
                "detail": "3 of 10 recent commits signed"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "3 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/commits?per_page=10",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: 2 of 6 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/commits?per_page=10",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/commits?per_page=10",
              "detail": "Hinkal-Protocol/hinkal-go: 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/commits?per_page=10",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: 0 of 5 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/commits?per_page=10",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: 3 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/commits?per_page=10",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: 3 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": true,
                "detail": "2 release(s) with notes"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-go: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: 2 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/contents/?ref=main",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Hinkal-Protocol/Hinkal-Contracts-Circuits",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-API-Enclave",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-go",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "Hinkal-Protocol/hinkal-ios-sdk",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Hinkal-Protocol/wdk-wallet-evm-hinkal",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Hinkal-Protocol/Hinkal-Demo-App",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Contracts-Circuits: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-API-Enclave/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-API-Enclave: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-go/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-go: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/hinkal-ios-sdk/contents/?ref=main",
              "detail": "Hinkal-Protocol/hinkal-ios-sdk: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/wdk-wallet-evm-hinkal/contents/?ref=main",
              "detail": "Hinkal-Protocol/wdk-wallet-evm-hinkal: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Demo-App/contents/?ref=main",
              "detail": "Hinkal-Protocol/Hinkal-Demo-App: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found for Novelty Today, Inc. in the docs (security audits, compliance, WaaS enclave pages), terms or privacy policy.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "The docs say the enclave runs in a GCP Confidential VM; no certification of Hinkal's own hosting and support organisation was found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "Contracts and circuits reviewed by zkSecurity, Zokyo, Quantstamp, Secure3, Hexens and Neodyme (reports mostly as Google Drive links, not read); Immunefi boost completed and HackenProof bounty ongoing. No review of the hosted backend, relayer or enclave service is listed.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration test of the hosted API, enclave or apps found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "The privacy policy (effective 21 July 2026) and terms contain no commitment to notify users or customers of security or data incidents.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "status.hinkal.io does not resolve and no status page or post-mortem is linked from the docs.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "Hosted API calls use a session (created by a wallet signature, bound to the address) plus a secp256k1 request signature per call bound to the route; no passwords, OAuth or JWT. Partner publishable keys work only from allowlisted Origins and are for attribution and fees, not authentication.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-api/description/authentication",
              "detail": "Hinkal API authentication page.",
              "checked_at": "2026-10-09",
              "quote": "no passwords, and no API key is needed to authenticate",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-partner/api-keys",
              "detail": "Partner API keys page, publishable and secret keys and origin checks.",
              "checked_at": "2026-10-09",
              "quote": "Each API key is a publishable and secret pair",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Applies only to the hosted API; the self-submitted contract path needs no API.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Server-side partner calls use a secret key (hk_sk_live_ plus 64 hex) with no origin check; keys can be turned off, renamed or revoked (effective within a minute), 10 per company, no scopes, no expiry or rotation schedule, and no test keys.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-partner/api-keys",
              "detail": "Partner API keys page, lifecycle and limits.",
              "checked_at": "2026-10-09",
              "quote": "Revoke permanently disables both halves of the pair",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "API sessions are valid for 24 hours by default, with a caller-set expiry; partner API keys do not expire; partner portal sign-ins last 12 hours, with a 10-minute recent sign-in for sensitive actions.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-api/description/authentication",
              "detail": "Authentication page, sessions.",
              "checked_at": "2026-10-09",
              "quote": "valid for 24 hours by default",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-partner/settings-and-security",
              "detail": "Partner settings and security, sessions.",
              "checked_at": "2026-10-09",
              "quote": "A sign-in lasts 12 hours.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "evidenced",
          "value": "Partner transaction CSV exports are capped at 10,000 rows and rate-limited per company; logging of exports is not stated. Users get viewing keys and a downloadable history (O4).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-partner/errors-and-limits",
              "detail": "Partner errors and limits page, limits and rate-limit tables.",
              "checked_at": "2026-10-09",
              "quote": "CSV export",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "O4",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "The privacy policy states encryption in transit, access controls and least-privilege access; the enclave behind the API and WaaS runs in a GCP Confidential VM (AMD SEV memory encryption) in a separate GCP project. No data classification, encryption at rest for other systems or TLS version is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/privacy-policy",
              "detail": "Privacy policy, security section.",
              "checked_at": "2026-10-09",
              "quote": "We use encryption in transit, access controls, and least-privilege access",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-waas/overview/secure-enclave",
              "detail": "WaaS secure enclave page.",
              "checked_at": "2026-10-09",
              "quote": "GCP Confidential VM",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Google Analytics 14 months from last visit; Microsoft Clarity recordings 30 days and saved data 9 months; visitor identification 12 months; contact details until unsubscribe or deletion request (email kept on a suppression list); on-chain data permanent. Deletion on request; no customer-termination clause.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/privacy-policy",
              "detail": "Privacy policy (effective 21 July 2026), how long we keep it.",
              "checked_at": "2026-10-09",
              "quote": "until you unsubscribe or ask us to delete them",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The privacy policy is issued by Novelty Today, Inc. (Delaware) for its site, apps, SDK and API and names Chainalysis, analytics and hosting providers; it does not use controller or processor roles and mentions no DPIA. EEA/UK transfers use standard contractual clauses.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/privacy-policy",
              "detail": "Privacy policy, contact paragraph.",
              "checked_at": "2026-10-09",
              "quote": "Novelty Today, Inc., Delaware, United States",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "The docs cover the logical view (core concepts, cryptographic setup, circuits, EVM/TRON contracts, Solana program) and the integration view (API, SDKs, WaaS); infrastructure is described only for the enclave (GCP Confidential VM). Not versioned in a repository.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/protocol/core-concepts",
              "detail": "Protocol core concepts page and its sub-pages.",
              "checked_at": "2026-10-09",
              "quote": "Core Concepts",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "O4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Novelty Today, Inc., Delaware, United States; terms under Delaware law with binding individual arbitration. Only relevant to the hosted interface, apps, SDK and API.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/tos",
              "detail": "Terms of Service, governing law.",
              "checked_at": "2026-10-09",
              "quote": "governed by the laws of the State of Delaware",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/privacy-policy",
              "detail": "Privacy policy contact.",
              "checked_at": "2026-10-09",
              "quote": "Novelty Today, Inc., Delaware, United States",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The Delaware Division of Corporations search requires a CAPTCHA and was not used, so no register entry is cited.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Per-transaction privacy fees on the hosted apps (25 to 35 bps) and a 10 bps Hinkal fee plus flat relay fee on API traffic, part of which is shared with partners. No treasury or annual report was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-partner/fees-and-revenue-share",
              "detail": "Partner fees and revenue share.",
              "checked_at": "2026-10-09",
              "quote": "Hinkal fee: 10 bps",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Novelty Today may suspend or terminate interface access at any time without notice; users cancel by email. Funds stay in the Hinkal contract, which accepts self-submitted withdrawals, but proving still needs Hinkal-hosted zkeys (S4 = 0).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/tos",
              "detail": "Terms section 9, termination.",
              "checked_at": "2026-10-09",
              "quote": "We may suspend or terminate your access to and use of the Interface at our sole discretion, at any time and without notice to you",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            },
            {
              "criterion": "S4",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Automated Chainalysis screening of depositing addresses before funds enter the private balance, with continuous re-screening; failing funds stay public and can only leave publicly. No statement on whether AI or a learned model is used.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/security-and-compliance/security-audits",
              "detail": "Security page, KYT screening section.",
              "checked_at": "2026-10-09",
              "quote": "Every deposit is screened against Chainalysis before it enters the private balance",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C4",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "Screening outcomes are documented (funds failing screening remain public under the owner's control); no appeal or override, monitoring, validation, decommissioning or bias evaluation is documented.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-compliance-gateway/screening-outcomes",
              "detail": "Compliance Gateway screening outcomes.",
              "checked_at": "2026-10-09",
              "quote": "Funds that do not pass screening never enter the private balance.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Hinkal Pay and Prime 25 bps on sends and unshield; shielding free",
            "basis": "Hinkal Pay fees page; deducted by the hosted relayer; Hinkal can change it.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Hinkal Wallet 25 bps (shield, unshield, private sends), 35 bps swaps and bridges",
            "basis": "Hinkal Wallet fees page.",
            "evidence_index": 1
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "API 10 bps Hinkal fee plus 0 to 100 bps partner fee, plus a flat relay fee",
            "basis": "Partner fees page; deposits are free; on EVM the fee is grossed up so the recipient gets the full amount.",
            "evidence_index": 2
          },
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "None in the contract when the user submits the call (relay = 0)",
            "basis": "Hinkal.sol charges a relay fee only when a relayer is used.",
            "evidence_index": 3
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Ethereum gas, paid directly or folded into the relay fee",
            "basis": "Fees pages say network gas is separate; varies with gas price.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-pay/fees",
            "detail": "Hinkal Pay fees table.",
            "checked_at": "2026-10-09",
            "quote": "Depositing funds into a private balance is free",
            "confirmed_at": "2026-10-12",
            "drift": true
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-wallet/fees",
            "detail": "Hinkal Wallet fees table.",
            "checked_at": "2026-10-09",
            "quote": "Public send bridge (cross-chain send)",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hinkal-team.gitbook.io/hinkal/hinkal-partner/fees-and-revenue-share",
            "detail": "Partner fees and revenue share.",
            "checked_at": "2026-10-09",
            "quote": "covers network and relaying costs",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/Hinkal-Protocol/Hinkal-Contracts-Circuits/blob/61b6839aa80fc0c33bfdcde0323753c83cb2ce67/contracts/Hinkal.sol#L172-L230",
            "commit": "61b6839aa80fc0c33bfdcde0323753c83cb2ce67",
            "path": "contracts/Hinkal.sol",
            "detail": "_internalTransact pays the relay fee only when relay is non-zero.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Three fee regimes. The self-submitted contract path (the CROPS unit) charges no protocol fee; the hosted apps and API charge per operation. The flat relay fee amount comes from GET /get-fee and is not published.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with S1 (score 1): funds sit in the non-upgradeable Hinkal pool and only the note owner's proof releases them; the terms say Novelty Today has no custody. The disclosed risk is that the timelock (6 h, 2-of-3 Safe) can swap the helper or verifiers, and withdrawals need Hinkal-hosted proving keys (S4 = 0). WaaS managed wallets, which hold keys in Hinkal's enclave, are outside the unit.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://msb.fincen.gov/",
            "archive": "data/archive/hinkal-ops-fincen-msb-search.txt",
            "detail": "FinCEN MSB registrant search by legal name for \"Novelty Today\" and \"Hinkal\" returned no match (registry updated 10/05/2026).",
            "checked_at": "2026-10-09",
            "quote": "System could not find matching data."
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hinkal.io/tos",
            "detail": "Terms describe the company as a platform provider that does not hold, send or receive funds, and cite no licence.",
            "checked_at": "2026-10-09",
            "quote": "we do not store, send, or receive any funds or cryptoassets",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Searched: FinCEN MSB registry (two names), the terms, privacy policy and compliance and security docs (no licence or regulator named). Not searched: state money-transmitter registers (NMLS), and registers outside the US. Integrity Check partners (zkMe, Galxe, AiPrise and others) were not looked up.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "Withdrawals send tokens to an address the user chooses; converting them to local currency is outside the protocol and outside Hinkal's hosted services.",
        "burden": "institution",
        "refs": [
          {
            "criterion": "C2",
            "index": 1
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-07-16",
            "block": 25543753,
            "what": "Hinkal pool 0x7cb6…Cfa4 on Ethereum, created by factory 0x0c61…923c in tx 0x85f1ad3b…3284 (sender 0x0a0e…445c)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/tx/0x85f1ad3bc33e75b4ad2f487f3976012c288343bbba7ff19c504546cc2c433284",
              "address": "0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4",
              "chain_id": 1,
              "block_number": 25543753,
              "detail": "Blockscout shows tx 0x85f1ad3b…3284 in block 25543753 at 2026-07-16 07:32:11 UTC, a call to factory 0x0c61…923c whose internal create produced 0x7cb6…Cfa4; Sourcify's creation data gives the same transaction and block.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://sourcify.dev/server/v2/contract/1/0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4?fields=deployment\" && curl -s https://eth.blockscout.com/api/v2/transactions/0x85f1ad3bc33e75b4ad2f487f3976012c288343bbba7ff19c504546cc2c433284 | jq .timestamp"
            }
          ],
          "note": "This is the deployment in the unit of assessment. Hinkal ran earlier contract versions; those are outside the unit and were not dated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Novelty Today, Inc.",
            "jurisdiction": "US-DE"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/privacy-policy",
              "detail": "Privacy policy names Novelty Today, Inc., Delaware, United States.",
              "checked_at": "2026-10-09",
              "quote": "Novelty Today, Inc., Delaware, United States",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hinkal.io/tos",
              "detail": "Terms name Novelty Today Inc. as the company providing the site, apps, SDK and API, under Delaware law.",
              "checked_at": "2026-10-09",
              "quote": "governed by the laws of the State of Delaware",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No company register entry; the Delaware search is CAPTCHA-protected.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/security-advisories",
              "detail": "The contracts repository's published security advisories list is empty.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/Hinkal-Protocol/Hinkal-Contracts-Circuits/security-advisories --jq length"
            }
          ],
          "note": "Searched: GitHub advisories, the docs (security audits, risks pages), terms and privacy policy. No incident affecting the Ethereum deployment found. Third-party incident databases were not used.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-08-25",
              "summary": "HinkalTimelockController accepts ownership of the Hinkal pool (tx 0x3edad43a…fdaa) and its delay is set to 180 s.",
              "url": "https://eth.blockscout.com/tx/0x3edad43af4d9d5e3d18e116ecacd5e43ae94e7a9403465d75bb11467b942fdaa"
            },
            {
              "date": "2026-09-10",
              "summary": "Timelock minimum delay raised from 180 s to 21,600 s (6 h), tx 0x406f2509…5681.",
              "url": "https://eth.blockscout.com/tx/0x406f2509ce69313639c2c11b4a12f716d010bc13e400f0bd935055c4034f5681"
            },
            {
              "date": "2026-09-24",
              "summary": "Relayer allowlist changed through the timelock, addRelay 0xe6bd…ca5e and removeRelay of the deployer 0x0a0e…445c (txs 0x28dffe7c…b14d and 0xbc815985…491a).",
              "url": "https://eth.blockscout.com/tx/0x28dffe7c0e8d73f8f74d4c502eaf9be2273b22cbfd55f72c276f99571459b14d"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/address/0xF04310839973454155d9886a4023451F8D3Db7D0",
              "address": "0xF04310839973454155d9886a4023451F8D3Db7D0",
              "chain_id": 1,
              "detail": "Timelock logs since block 25500000. MinDelayChange events at blocks 25830061 (0 to 180) and 25948466 (180 to 21600). CallExecuted events decode to acceptOwnership() on Hinkal (25830662), updateDelay(21600) (25948466), acceptOwnership() on 0x7958…17a1 (25997086), and addRelay and removeRelay on the helper (26048813, 26048968).",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://eth.blockscout.com/api?module=logs&action=getLogs&fromBlock=25500000&toBlock=latest&address=0xF04310839973454155d9886a4023451F8D3Db7D0&topic0=$(cast keccak 'CallExecuted(bytes32,uint256,address,uint256,bytes)')\""
            }
          ],
          "note": "The helper swap from 0x62Af…03F5 to 0x5f91…7C1b (S1) happened before the timelock took ownership and was not dated. Docs and terms changes are not versioned except the privacy policy date (21 July 2026).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "Hinkal's emitted events carry no public amount. NewCommitment has encrypted outputs and Nullified only a nullifier; NewTransaction and NewUtxo, which carry amounts, are declared in the ABI but no such logs exist from the pool since deployment (Blockscout, 2026-10-09). Deposit and withdrawal amounts appear only as ERC-20 Transfer logs on token contracts, which the spec cannot filter by counterparty.",
        "note": "Event topics counted from Blockscout getLogs over the pool since block 25543753 (NewCommitment 412, Nullified 343, BlockedUtxosCreated 99, VerifierRegistered 123, others administrative).",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "holyheld-card": {
      "slug": "holyheld-card",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/contents/?ref=master",
              "detail": "holyheld/hh-v1-sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/contents/?ref=master",
              "detail": "holyheld/hh-v1-sdk: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/contents/?ref=master",
              "detail": "holyheld/hh-v1-sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/rules/branches/master",
              "detail": "holyheld/hh-v1-sdk: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/contents/?ref=master",
              "detail": "holyheld/hh-v1-sdk: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/contents/?ref=master",
              "detail": "holyheld/hh-v1-sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/contents/?ref=master",
              "detail": "holyheld/hh-v1-sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": true,
                "detail": "latest tags: 4.1.5, 4.1.4, 4.1.3"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/tags",
              "detail": "holyheld/hh-v1-sdk: latest tags: 4.1.5, 4.1.4, 4.1.3",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": false,
                "detail": "4 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/commits?per_page=10",
              "detail": "holyheld/hh-v1-sdk: 4 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": true,
                "detail": "CHANGELOG file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/contents/?ref=master",
              "detail": "holyheld/hh-v1-sdk: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "holyheld/hh-v1-sdk",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/holyheld/hh-v1-sdk/contents/?ref=master",
              "detail": "holyheld/hh-v1-sdk: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "Holyheld's homepage says it is PCI DSS Level 1 compliant and undergoes independent security audits yearly. That is a card-data standard, not a SOC 2 or ISAE report, and no report or attestation of compliance is offered.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No audit or independent code review of the top-up contract or the backend was found (CROPS S6 unknown); the deployed implementation is unverified.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "evidenced",
          "value": "Holyheld will notify the Swiss FDPIC and, where required, affected users of a data security breach where legally required; no notification time is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/privacy-policy",
              "detail": "Privacy Policy (last updated 01.07.2026), data security section.",
              "checked_at": "2026-10-09",
              "quote": "will notify the Federal Data Protection and Information Commissioner (FDPIC)",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No public status page or post-mortem was found on holyheld.com (sitemap, legal pages, FAQ).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Authenticator-app MFA protects all accounts and sensitive actions.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/",
              "detail": "Holyheld homepage, Security section.",
              "checked_at": "2026-10-09",
              "quote": "All accounts and sensitive actions protected by authenticator app MFA",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "The SDK authenticates integrators with a Holyheld API key; the reference browser example ships it client-side (CROPS S5). Scoping and rotation are not documented.",
          "refs": [
            {
              "criterion": "S5",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Personal data is kept while the account exists and then deleted or de-identified once no longer needed, subject to legal retention of transaction and account records; no period is stated (see CROPS P2 for what is collected).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/privacy-policy",
              "detail": "Privacy Policy, \"For how long do we keep your data?\".",
              "checked_at": "2026-10-09",
              "quote": "We retain your Personal Data as long as you maintain an Account on the Platform",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Holyheld Labs AG is the controller under the Swiss FADP; ID verification partners Sumsub and Idenfy supply verification data. The card issuer's role is not stated. DPIA availability not found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/privacy-policy",
              "detail": "Privacy Policy, opening paragraph and third-party sources.",
              "checked_at": "2026-10-09",
              "quote": "is the data controller responsible for the collection of your personal data",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Holyheld Labs AG, Zug, Switzerland (CHE-207.939.735) for the platform; the card and e-money account are contracts with an issuer partner the Terms do not name.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/terms-and-conditions",
              "detail": "Terms and Conditions (last updated 01.07.2026), opening paragraph and clause 2.2.",
              "checked_at": "2026-10-09",
              "quote": "Holyheld Labs AG is a member of a Self-Regulatory Organisation (SRO)",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE207939735",
              "detail": "Swiss UID register, Holyheld Labs AG, Aktiengesellschaft, Bahnhofstrasse 20, 6300 Zug; commercial register status active.",
              "checked_at": "2026-10-09",
              "quote": "CHE-207.939.735",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Customer fees. Individual membership is CHF 0 a year with 1% on-ramp and off-ramp fees and per-transfer fees; business membership is CHF 500 a year with 0.5% ramp fees.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/pricing/individual",
              "detail": "Individual pricing page.",
              "checked_at": "2026-10-09",
              "quote": "Membership CHF 0 /YR",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/pricing",
              "detail": "Business pricing page.",
              "checked_at": "2026-10-09",
              "quote": "CHF 500 /YR",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Holyheld may suspend, terminate or deactivate an account, including partner card services, at any time without notice, justification or liability. A user may close the account, including after a terms change within the 60-day notice period. Treatment of remaining balances is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/terms-and-conditions",
              "detail": "Terms and Conditions clause 17 (Termination).",
              "checked_at": "2026-10-09",
              "quote": "You agree that Holyheld reserves the right to suspend, terminate and deactivate your Holyheld Account",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/terms-and-conditions",
              "detail": "Terms and Conditions clause 19 (changes and closing the account).",
              "checked_at": "2026-10-09",
              "quote": "You acknowledge that you may close your Account without making any trades",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Automated fraud monitoring is listed as a feature; whether it uses AI and whether it can decline payments is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/pricing/individual",
              "detail": "Individual pricing page, Security and Support features.",
              "checked_at": "2026-10-09",
              "quote": "Automated fraud monitoring",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "1% off-ramp (stablecoin to fiat) and 1% on-ramp transfers",
            "basis": "Individual pricing page; Terms clause 13 lets Holyheld change fees at any time with notice on the platform.",
            "evidence_index": 0
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "outgoing SEPA 1 EUR, same-day ACH 1 USD, wire 20 USD, FedNow and Faster Payments 0",
            "basis": "Individual pricing page.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "membership CHF 0 a year (individual)",
            "basis": "Individual pricing page; membership is by invitation. No card issuance, card FX or ATM fees are published.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "gas and any swap costs on the top-up transaction",
            "basis": "Terms clause 8.10 make the user responsible for fees to complete the transaction; the SDK's gasless options were not assessed.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://holyheld.com/pricing/individual",
            "detail": "Holyheld individual pricing page (accounts, transfers and ramp fees).",
            "checked_at": "2026-10-09",
            "quote": "1% off-ramp transfers",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://holyheld.com/legal/terms-and-conditions",
            "detail": "Terms and Conditions clause 8.10.",
            "checked_at": "2026-10-09",
            "quote": "You are the sole responsible for executing the transaction correctly, which may include paying fees to complete the transaction",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Card fees (issuance, FX on non-base-currency spend, ATM) are not published on holyheld.com or in the Terms. Business pricing differs: CHF 500 a year, 0.5% ramp fees, wire 10 USD, SEPA 0 EUR. Whether the top-up into the card balance (CROPS S1) carries the 1% off-ramp fee is not stated.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S1",
            "index": 2
          }
        ],
        "note": "A top-up sells the user's tokens to Holyheld; they go to a Holyheld EOA and the card balance is fiat held by the issuing partner (S1 = 0).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "Holyheld Labs AG",
            "holder": "provider",
            "country": "CH",
            "regulator": "VQF (self-regulatory organisation recognised by FINMA)",
            "type": "Financial intermediary, SRO member for AML/CTF supervision",
            "activities": "Financial-intermediary activity under the Swiss Anti-Money Laundering Act",
            "register_url": "https://www.finma.ch/en/authorisation/self-regulatory-organisations-sros/sro-member-search/",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.finma.ch/en/authorisation/self-regulatory-organisations-sros/sro-member-search/",
            "archive": "data/archive/holyheld-card-ops-finma-sro-search.txt",
            "detail": "FINMA SRO member search for \"Holyheld\" (client-rendered; result read in a browser and archived) lists Holyheld Labs AG, Zug, financial intermediary, SRO VQF.",
            "checked_at": "2026-10-09",
            "quote": "Self-regulatory organisation: VQF, Zug"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://holyheld.com/legal/terms-and-conditions",
            "detail": "Terms and Conditions opening paragraph on SRO membership and AML/CTF supervision.",
            "checked_at": "2026-10-09",
            "quote": "Holyheld Labs AG is a member of a Self-Regulatory Organisation (SRO)",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "SRO membership is AML supervision, not a banking, payment or e-money licence. The card and e-money account come from a \"licensed payment-instrument issuer\" that the Terms, privacy policy, pricing and FAQ pages do not name, so its licence and regulator could not be checked. The pricing page also states PCI DSS Level 1, which is not a licence.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_withdrawal",
            "partner": "Unnamed licensed card issuer",
            "fee": "not published",
            "limits": "Card spend at merchants from the fiat balance created by a top-up (the schema has no card-spend value); limits not published.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Holyheld's e-money partners (personal IBAN)",
            "fee": "1% off-ramp; SEPA 1 EUR, ACH 1 USD, wire 20 USD",
            "limits": "Not published.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://holyheld.com/legal/terms-and-conditions",
            "detail": "Terms definition of Card (debit card issued by the partnered payment-instrument issuer).",
            "checked_at": "2026-10-09",
            "quote": "issued by the licensed payment-instrument issuer partnered with us",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://holyheld.com/legal/terms-and-conditions",
            "detail": "Terms clause 3.5, bank transfer from the personal IBAN.",
            "checked_at": "2026-10-09",
            "quote": "initiate a bank transfer to send Funds from your personal IBAN directly to other bank accounts",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ALL means every country in the availability list (CH only, the scope of the published Terms). ATM withdrawal is not documented. Fees are from the individual pricing page (see fees).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2023-03-12",
            "block": 16810662,
            "what": "Card top-up proxy 0x6fC79dDD...3d13 (TransparentUpgradeableProxy) on Ethereum"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/tx/0x05a9db2ba6842b60849608a661ff7e6b7c765c46fbf3e07fb8cd869fe1710e10",
              "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "block_number": 16810662,
              "detail": "eth_getCode for the proxy returns 0x at block 16810661 and the proxy bytecode at 16810662 (2023-03-12 08:09:47 UTC); creation tx 0x05a9db2b...0e10 from deployer EOA 0xa1391419CC2fEc5235161d7A6Deb988cB9A1d043, which emits the first Upgraded event.",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0x6fC79dDD0379Fd11d67dD73056465e822b843d13 --block 16810661 --rpc-url https://eth.drpc.org; cast codesize 0x6fC79dDD0379Fd11d67dD73056465e822b843d13 --block 16810662 --rpc-url https://eth.drpc.org"
            }
          ],
          "note": "Read on an archive-capable public RPC (eth.drpc.org) because ethereum-rpc.publicnode.com refuses historical state without a token.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Holyheld Labs AG",
            "jurisdiction": "CH-ZG",
            "register_url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE207939735",
            "registration_number": "CHE-207.939.735"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE207939735",
              "detail": "Swiss UID register (Federal Statistical Office), Holyheld Labs AG, Aktiengesellschaft, Bahnhofstrasse 20, 6300 Zug; UID and commercial register status active, register reference CH-170.3.047.396-4.",
              "checked_at": "2026-10-09",
              "quote": "Holyheld Labs AG",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/terms-and-conditions",
              "detail": "Terms and Conditions name the operator and its UID.",
              "checked_at": "2026-10-09",
              "quote": "Holyheld Labs AG is a member of a Self-Regulatory Organisation (SRO)",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident notice, status page or post-mortem was found on holyheld.com (sitemap including guides and case studies, legal pages, FAQ) or in the hh-v1-sdk repository.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2023-06-04",
              "summary": "Top-up proxy implementation upgraded to 0x49982cf8...eb17 (Upgraded event, block 17405136).",
              "url": "https://etherscan.io/tx/0x668cd053091a50d79df152c7525c3ed91099ca93826c6c3203541d0d44109355"
            },
            {
              "date": "2023-08-18",
              "summary": "Top-up proxy implementation upgraded to 0x177ad381...760d (block 17940103).",
              "url": "https://etherscan.io/tx/0x48588e8221c7d2e949cdd8798ed0fc526cd62423059b98c049983c2733a085d3"
            },
            {
              "date": "2023-11-16",
              "summary": "Top-up proxy implementation upgraded to 0x4ba2c617...e3a9 (block 18582243).",
              "url": "https://etherscan.io/tx/0x958030fe857d1097cd5b6ea0bb81723d00deb3266081ded004d93feb4e35e7cc"
            },
            {
              "date": "2024-07-11",
              "summary": "Top-up proxy implementation upgraded to 0xef84faa1...0972 (block 20281063).",
              "url": "https://etherscan.io/tx/0x4680b0d2fa6aff0c3cd65742b3013fc65d87fe4d519d974e57a895e14f60e698"
            },
            {
              "date": "2025-09-16",
              "summary": "Top-up proxy implementation upgraded to 0xa7dd4d0a...daab (block 23373807).",
              "url": "https://etherscan.io/tx/0x5a3ee8ca718953934136e24d7a6b2e15d6c01790cd5089b5ecdda503c7e7d6b0"
            },
            {
              "date": "2026-04-02",
              "summary": "Top-up proxy implementation upgraded to the current, unverified 0x1Fd0FB3F...A94a (block 24794076).",
              "url": "https://etherscan.io/tx/0xc7f491d8a7b184e5ebfbde4a71469de20a31f580a4820c43ee63d6a89e1df802"
            },
            {
              "date": "2026-07-01",
              "summary": "Terms and Conditions and Privacy Policy updated (last update 01.07.2026).",
              "url": "https://holyheld.com/legal/terms-and-conditions"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/address/0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "address": "0x6fC79dDD0379Fd11d67dD73056465e822b843d13",
              "block_number": 24794076,
              "detail": "The proxy has emitted seven Upgraded(address) events (topic 0xbc7cd75a...2d3b), one at deployment (block 16810662) and six later upgrades listed here; upgrades go through ProxyAdmin 0xaf3d7e4c... whose owner is EOA 0xa1391419... (CROPS research log).",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://eth.blockscout.com/api?module=logs&action=getLogs&address=0x6fC79dDD0379Fd11d67dD73056465e822b843d13&topic0=0xbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b&fromBlock=0&toBlock=latest\" | jq -r '.result[] | [(.blockNumber|tonumber), .topics[1], .transactionHash] | @tsv'"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://holyheld.com/legal/terms-and-conditions",
              "detail": "Terms and Conditions header.",
              "checked_at": "2026-10-09",
              "quote": "Last Update 01.07.2026",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 1,
          "addresses": [
            "0x6fC79dDD0379Fd11d67dD73056465e822b843d13"
          ],
          "topic0": "0x9ceec115c2a45921e2600d2b755ebc616954095419bc7f65758e65de024dbd33",
          "event": "CardTopup(address indexed, address token, uint256, uint256, bytes32)",
          "amount_word": 2,
          "token": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
          "decimals": 6,
          "symbol": "USDC",
          "window_days": 30,
          "exclusions": "Sums data word 2 of every CardTopup event from the listed proxy, read as the USDC amount credited after any swap. Word layout inferred from the 73 events since block 25,500,000 (word 0 = input token, word 1 = input amount, word 2 = USDC amount; words 1 and 2 are equal on all 45 USDC top-ups and word 2 is 6-decimal on ETH, USDT, stETH and AAVE top-ups). The implementation is unverified, so the field meaning is not confirmed by source. Base and Solana top-ups are not included."
        },
        "note": "Top-ups into the card balance are logged as CardTopup events on the listed Ethereum proxy, so they can be separated from ordinary transfers. This counts value moved into card balances, not card spend. Not yet computed; the maintainer runs scripts/volumes.mjs.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: eth_getLogs: Archive requests require a personal token. Get one at: https://www.allnodes.com/publicnode"
      }
    },
    "houdini-swap": {
      "slug": "houdini-swap",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/contents/?ref=main",
              "detail": "HoudiniSwap/houdiniswap-agent: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/contents/?ref=main",
              "detail": "HoudiniSwap/houdini-api-examples: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/contents/?ref=main",
              "detail": "HoudiniSwap/houdiniswap-agent: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/contents/?ref=main",
              "detail": "HoudiniSwap/houdini-api-examples: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/contents/?ref=main",
              "detail": "HoudiniSwap/houdiniswap-agent: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/contents/?ref=main",
              "detail": "HoudiniSwap/houdini-api-examples: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/rules/branches/main",
              "detail": "HoudiniSwap/houdiniswap-agent: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/rules/branches/main",
              "detail": "HoudiniSwap/houdini-api-examples: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": true,
                "detail": "2 workflow file(s)"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/contents/?ref=main",
              "detail": "HoudiniSwap/houdiniswap-agent: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/contents/?ref=main",
              "detail": "HoudiniSwap/houdini-api-examples: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/contents/?ref=main",
              "detail": "HoudiniSwap/houdiniswap-agent: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/contents/?ref=main",
              "detail": "HoudiniSwap/houdini-api-examples: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/contents/?ref=main",
              "detail": "HoudiniSwap/houdiniswap-agent: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/contents/?ref=main",
              "detail": "HoudiniSwap/houdini-api-examples: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/tags",
              "detail": "HoudiniSwap/houdiniswap-agent: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/tags",
              "detail": "HoudiniSwap/houdini-api-examples: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": true,
                "detail": "5 of 10 recent commits signed"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/commits?per_page=10",
              "detail": "HoudiniSwap/houdiniswap-agent: 5 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/commits?per_page=10",
              "detail": "HoudiniSwap/houdini-api-examples: 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/contents/?ref=main",
              "detail": "HoudiniSwap/houdiniswap-agent: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/contents/?ref=main",
              "detail": "HoudiniSwap/houdini-api-examples: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "HoudiniSwap/houdiniswap-agent",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "HoudiniSwap/houdini-api-examples",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdiniswap-agent/contents/?ref=main",
              "detail": "HoudiniSwap/houdiniswap-agent: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/HoudiniSwap/houdini-api-examples/contents/?ref=main",
              "detail": "HoudiniSwap/houdini-api-examples: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found in docs.houdiniswap.com (llms.txt index, partner FAQs, privacy and compliance) or the Terms of Service.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "absent",
          "value": "No SOC 2 or ISAE report exists yet; Houdini's partner FAQ says it is in the process of obtaining SOC 2 certification with Deloitte (security, availability and operational controls).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/partner-faqs",
              "detail": "Partner FAQs, Security & Audit.",
              "checked_at": "2026-10-09",
              "quote": "Houdini is currently in the process of obtaining",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "absent",
          "value": "Houdini's partner FAQ answers the question why Houdini has not been audited yet by pointing to the SOC 2 process; no independent review of the API, routing engine or web app is published. The docs mention audits only for third-party DEX contracts.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/partner-faqs",
              "detail": "Partner FAQs, Security & Audit, question on why Houdini has not been audited while competitors have.",
              "checked_at": "2026-10-09",
              "quote": "For detailed security documentation or enterprise discussions, contact the Houdini team.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No incident-notification commitment found; the partner FAQ says there is no fixed SLA for transaction issues and critical partner escalations go through direct channels.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "Recovery of a deposit in flight depends on the exchange partner's processes (CROPS S4 = 0); no service recovery plan published.",
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "A public, unauthenticated health endpoint (GET /v2/status, also /v2/health) reports API and CEX/DEX quote availability; no status page answered at status.houdiniswap.com and no post-mortems were found. Fortnightly release notes (from February 2026) mention only generic security improvements.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/api-reference/system/get-system-health",
              "detail": "API reference, Get system health.",
              "checked_at": "2026-10-09",
              "quote": "Returns a public, partner-safe summary of HoudiniSwap API and quote system availability",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "not_applicable",
          "reason": "Swappers have no account; each swap is an order with a one-time deposit address, created without sign-in (wallet connection is optional). Partner Portal accounts (email sign-up) are for integrators; their MFA is not documented.",
          "burden": "none",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "Partner API requests carry a static API key and secret in the Authorization header (key:secret); alternatively x402 pay-per-request with a signed USDC authorization. No OAuth 2.0 or OpenID Connect.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/developer-hub/getting-started/authentication",
              "detail": "API Keys & Authentication page.",
              "checked_at": "2026-10-09",
              "quote": "Houdini uses API key and secret authentication passed via the",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "One key and secret per partner account; rotation only by contacting support; no scopes. The reference integration keeps the secret server-side (see CROPS S5).",
          "refs": [
            {
              "criterion": "S5",
              "index": 1
            },
            {
              "criterion": "S5",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "No token expiry is documented; the key and secret are long-lived and change only when support rotates them.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/developer-hub/getting-started/authentication",
              "detail": "API Keys & Authentication page, credential handling.",
              "checked_at": "2026-10-09",
              "quote": "contact support to rotate credentials",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "evidenced",
          "value": "Per-endpoint rate limits by tier (Free 50 quotes and 10 exchanges a day; Pro 5,000 and 2,000); order listings return only the last 48 hours. No export logging is documented.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/developer-hub/getting-started/rate-limits-and-tiers",
              "detail": "Rate Limits & Tiers page.",
              "checked_at": "2026-10-09",
              "quote": "Rate limits are enforced per endpoint.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "unknown",
          "note": "The Privacy Notice (last updated 25 January 2024) lists security as a purpose but states no encryption, TLS or classification measures.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Transaction data (addresses, tokens, amounts, IP) is deleted automatically after 72 hours, kept longer only for open support cases; users can opt for immediate deletion. Exchange partners keep their own logs linking each leg (CROPS P3). See CROPS P2 for what is collected.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/products/swap-transfer/privacy-notice",
              "detail": "Privacy Notice (last updated 25 January 2024), Transaction Data retention.",
              "checked_at": "2026-10-09",
              "quote": "WE RETAIN TRANSACTION DATA FOR A STANDARD PERIOD OF 72 HOURS",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "unknown",
          "note": "The Privacy Notice does not name a data controller or processors; no DPIA statement.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "Partner responsibilities are said to be defined in a partner agreement, which is not published.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Integration architecture only (Architecture Overview, OpenAPI 3.0 spec, swap-flow guides); the routing engine, backend and partner integrations are not documented.",
          "refs": [
            {
              "criterion": "C3",
              "index": 1
            },
            {
              "criterion": "O4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Houdini Swap LLC under the Terms of Service (last updated 14 July 2026), Cayman Islands governing law and arbitration; notice address ops@houdiniswap.com. Jurisdiction of formation not stated. Each swap is executed by third-party exchange partners under their own terms; API partners sign a partner agreement (not published).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/69143df941a2491956546ef7/6a579a7d3db98c279dc6020b_Houdini%20Swap%20-%20Terms%20of%20Service-14673161-v6.pdf",
              "archive": "data/archive/houdini-swap-terms-of-service.txt",
              "detail": "Terms of Service, preamble.",
              "checked_at": "2026-10-09",
              "quote": "herein refers to Houdini Swap LLC"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Houdini earns a commission from each exchange partner after the swap (built into the all-in quote), shares part with API partners under per-partner terms, and charges x402 pay-per-request API fees. No subscription fees and, per the docs, no user-data monetisation.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/overview/coverage-and-economy/monetization-and-fees",
              "detail": "Fees & Pricing page.",
              "checked_at": "2026-10-09",
              "quote": "Houdini Swap earns a commission back from each exchange post-swap",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Houdini may change, suspend or terminate the Services or a user's access at any time without notice, and suspend use for any reason. A deposit already sent sits with the exchange partner, and its completion or refund depends on the partner's processes (CROPS S4).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/69143df941a2491956546ef7/6a579a7d3db98c279dc6020b_Houdini%20Swap%20-%20Terms%20of%20Service-14673161-v6.pdf",
              "archive": "data/archive/houdini-swap-terms-of-service.txt",
              "detail": "Terms of Service, Amendment, Suspension or Termination.",
              "checked_at": "2026-10-09",
              "quote": "terminate any aspect of the Services, or its availability to you, at any time"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Automated screening takes part: Houdini reserves automated screening (third-party analytics, IP geolocation) for illicit activity and sanctions; exchange partners screen every deposit with real-time AML tools such as Chainalysis; every swap runs an automatic Blockaid token scan. Whether any of these use AI or machine learning is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/69143df941a2491956546ef7/6a579a7d3db98c279dc6020b_Houdini%20Swap%20-%20Terms%20of%20Service-14673161-v6.pdf",
              "archive": "data/archive/houdini-swap-terms-of-service.txt",
              "detail": "Terms of Service, compliance and screening.",
              "checked_at": "2026-10-09",
              "quote": "deploy automated screening mechanisms (including third-party analytics and IP geolocation tools)"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/partner-faqs",
              "detail": "Partner FAQs, Risk & Compliance.",
              "checked_at": "2026-10-09",
              "quote": "Primary screening is performed by execution partners at the deposit stage",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "note": "No documentation of monitoring, validation, override or bias evaluation for the screening; blocked users are told to contact support.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Routing commission inside the all-in quote; private swaps about double No Wallet Connect; no rate published",
            "basis": "Fees & Pricing page; Houdini earns a commission back from the exchange partner after each swap.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Gas, bridge and protocol fees included in the quote",
            "basis": "Fees & Pricing page; fixed-rate quotes include the destination network fee (release notes).",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Optional integrator markup (percentage, absolute or basis points) on routes that support it",
            "basis": "Partner API v2 OpenAPI spec (markup, apiMarkupValue, markupType); set by the integrator per request.",
            "evidence_index": 1
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "API via x402 instead of a key: 0.01 USDC per exchange call, 0.001 per quote, 0.0001 per read",
            "basis": "x402 Payments page; charged to the integrator, not the swapper.",
            "evidence_index": 2
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Minimum and maximum per token pair, from the API (GET minMax)",
            "basis": "API reference; values not published as a table.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.houdiniswap.com/overview/coverage-and-economy/monetization-and-fees",
            "detail": "Fees & Pricing page (all-in quote, fees by swap type).",
            "checked_at": "2026-10-09",
            "quote": "Fees are approximately double the No Wallet Connect option",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://api-partner.houdiniswap.com/v2/openapi.json",
            "detail": "Partner API v2 OpenAPI spec (version 2.1.2), route markup fields and the minMax endpoint.",
            "checked_at": "2026-10-09",
            "quote": "True when the route can apply partner markup.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.houdiniswap.com/developer-hub/core-concepts/x402-pay-per-request",
            "detail": "x402 Payments page, pricing table.",
            "checked_at": "2026-10-09",
            "quote": "Requests are priced by operation type in USDC",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The swap fee is not published as a figure; it can be read only as the difference between quote and market rate. Exchange partners' own spreads are inside the quote. Houdini Pay links let the creator choose whether sender or receiver pays the fees (release notes, 15 September 2026).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with S1 (score 1, judgment call). Houdini says it holds no funds, but between deposit and payout the funds sit at deposit addresses controlled by exchange partners that Houdini's engine selects (two partners on private routes), so the swap is custodial for its duration. The user's own wallet is self-custodial before and after.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "unknown",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.houdiniswap.com/overview/getting-started/what-is-houdini",
            "detail": "About Houdini; Houdini describes itself as a non-custodial aggregator that runs no exchange and holds no funds, and names no licence.",
            "checked_at": "2026-10-09",
            "quote": "Houdini does not operate its own exchange and does not hold user funds",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No licence or registration found for Houdini Swap LLC in the Terms, Privacy Notice or docs; its jurisdiction of formation is not stated, so no register was searched. The 12 named exchange partners (ChangeNow, SimpleSwap, StealthEx and others) hold any licences in the swap path; none was checked.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "exchange",
            "partner": "Exchange partners selected by Houdini's routing engine (12 named CEXs)",
            "fee": "Included in the all-in quote",
            "limits": "Payout in crypto to any address the payer names; min and max per pair; 3 to 50 minutes per the docs.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.houdiniswap.com/overview/swaps-and-transfers/private-swaps",
            "detail": "Private Swap page; exchange 2 pays the recipient address.",
            "checked_at": "2026-10-09",
            "quote": "routing the transaction through two separate non-custodial exchanges",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Fiat cash-out: not_applicable. Houdini has no fiat leg, card, bank or cash partner; the only payout is the crypto leg to an address, and converting to fiat falls to the recipient or the deploying institution. ALL means every country outside the provider file's blocklist (US and unnamed sanctioned jurisdictions).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "unknown",
          "note": "No primary source dates the launch. The docs' release notes start on 9 February 2026, the Privacy Notice is dated 25 January 2024 and the GitHub org was created in December 2022; none is a launch date.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "unknown",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/69143df941a2491956546ef7/6a579a7d3db98c279dc6020b_Houdini%20Swap%20-%20Terms%20of%20Service-14673161-v6.pdf",
              "archive": "data/archive/houdini-swap-terms-of-service.txt",
              "detail": "Terms of Service name Houdini Swap LLC; disputes go to arbitration under Cayman Islands rules and Cayman law governs.",
              "checked_at": "2026-10-09",
              "quote": "herein refers to Houdini Swap LLC"
            }
          ],
          "note": "The contracting entity is named (Houdini Swap LLC), but no document gives its jurisdiction of formation, registration number or address; Cayman governing law is not taken as the jurisdiction.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident report or post-mortem found in the docs, release notes (February to September 2026, generic security fixes only), FAQs or partner FAQs; no status page. Third-party reports were not used.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2024-01-25",
              "summary": "Privacy Notice last updated (72-hour Transaction Data retention, opt-in immediate deletion).",
              "url": "https://docs.houdiniswap.com/products/swap-transfer/privacy-notice"
            },
            {
              "date": "2026-07-14",
              "summary": "Terms of Service last updated (US and restricted jurisdictions excluded; Cayman law).",
              "url": "https://docs.houdiniswap.com/products/swap-transfer/terms-of-service"
            },
            {
              "date": "2026-08-18",
              "summary": "Automatic Blockaid security scan added on the sent and received token of every swap.",
              "url": "https://docs.houdiniswap.com/changelog/release-notes"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/products/swap-transfer/privacy-notice",
              "detail": "Privacy Notice header.",
              "checked_at": "2026-10-09",
              "quote": "Last Updated: January 25, 2024",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.houdiniswap.com/changelog/release-notes",
              "detail": "Release notes, entry of 18 August 2026 (Token Security Screening).",
              "checked_at": "2026-10-09",
              "quote": "Every swap now runs an automatic Blockaid security scan",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/69143df941a2491956546ef7/6a579a7d3db98c279dc6020b_Houdini%20Swap%20-%20Terms%20of%20Service-14673161-v6.pdf",
              "archive": "data/archive/houdini-swap-terms-of-service.txt",
              "detail": "Terms of Service header.",
              "checked_at": "2026-10-09",
              "quote": "Last updated: July 14, 2026"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "No listed contracts. Deposits go to one-time addresses controlled by exchange partners and payouts come from partner wallets, so settlement cannot be read from any listed contract. Houdini's API exposes provider-reported volume, which is not stored.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "hyperbeat-card": {
      "slug": "hyperbeat-card",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement for Hyperbeat or Zoeion Ltd Corporation found on hyperbeat.org (terms, privacy), docs.hyperbeat.org or the 87 help articles at help.hyperbeat.org. The help centre's KYC article lists ISO 27001, ISO 27017/27018, SOC 2 Type II and PCI DSS for Sumsub, the KYC processor only.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "Same search as B1.1; the hosting of the Pay backend is not stated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE 3402 statement for Hyperbeat found (only for Sumsub, see B1.1).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "Two smart-contract audits of the Liquid Bank contracts are public (Zellic, 6 November 2025, 1 critical, 3 medium, 7 low; Nethermind NM-0697 on the Management Account). The audited repository is private and the deployed contracts are unverified, so the audited code cannot be matched to what runs; no review of the closed backend or app found.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or bug bounty found; hyperbeat.org/.well-known/security.txt returns 404.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "The privacy policy lists \"notice of a personal data breach (unless the breach is unlikely to be prejudicial to you)\" among data subject rights, without a time limit; no wider incident-notification commitment found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "evidenced",
          "value": "Hyperbeat documents a provider-exit path: users recover their Turnkey-secured wallet by email one-time code and export the recovery phrase or private key to another wallet without Hyperbeat. This contradicts the architecture docs used for CROPS S1 and S4, under which settlement-token and collateral withdrawals need Operator approval; no recovery plan for Hyperbeat's own service was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.hyperbeat.org/en/articles/16019217-can-hyperbeat-steal-freeze-or-lock-my-funds",
              "detail": "Help article (21 July 2026) on custody and recovery if Hyperbeat disappears.",
              "checked_at": "2026-10-09",
              "quote": "Hyperbeat cannot steal, freeze, or lock your funds, and you can always withdraw them",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page found (status.hyperbeat.org does not resolve) and no post-mortems found in the blog, docs or help centre.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Accounts and card actions are signed with a passkey (Turnkey key management); email one-time codes are used for login and recovery. No separate second factor is described.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.hyperbeat.org/en/articles/15073693-what-are-agent-cards",
              "detail": "Help article on Agent Cards; issuing a card is confirmed with the user's passkey.",
              "checked_at": "2026-10-09",
              "quote": "sign with your passkey",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "No public API documentation for Hyperbeat Pay found; the staking API in the docs is a separate product.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "note": "Agent Cards hand card credentials or a skill file to an AI agent under per-card spending limits, with one-tap revocation; no server-to-server API key scheme is documented.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Hyperbeat's privacy policy states no encryption or classification and warns that data in transit may not be secure. For KYC data only, the help centre states Sumsub encrypts data in transit (TLS 1.2+) and at rest in German data centres. Observed: hyperbeat.org refuses TLS 1.1 and accepts TLS 1.2.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.hyperbeat.org/en/articles/14196937-how-is-my-kyc-data-handled-and-protected",
              "detail": "Help article on KYC data handling (21 July 2026).",
              "checked_at": "2026-10-09",
              "quote": "All personal data is encrypted at rest on servers located in Tier III data centres in Germany (EU)",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://hyperbeat.org",
              "detail": "openssl s_client -tls1_1 to hyperbeat.org:443 failed with alert protocol version; -tls1_2 negotiated ECDHE-RSA-CHACHA20-POLY1305. Run 2026-10-09 with LibreSSL 3.3.6.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect hyperbeat.org:443 -servername hyperbeat.org -tls1_1; echo | openssl s_client -connect hyperbeat.org:443 -servername hyperbeat.org -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "The privacy policy keeps data \"only for so long as necessary\" with no periods; Hyperbeat may keep Pay account registration information after termination (Terms). KYC data held by Sumsub is kept 5 years after the relationship ends, with deletion requests processed within 30 days except legally retained records. Account deletion is self-service in settings. See CROPS P2 for what is collected.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/privacy",
              "detail": "Privacy Policy (last updated 21 August 2025), Retention.",
              "checked_at": "2026-10-09",
              "quote": "We will retain your personal data only for so long as necessary to fulfill the purposes for which it was collected",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.hyperbeat.org/en/articles/14196937-how-is-my-kyc-data-handled-and-protected",
              "detail": "Help article on KYC data retention.",
              "checked_at": "2026-10-09",
              "quote": "for AML-regulated services, applicable law requires personal data to be retained for 5 years",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Zoeion Ltd Corporation (Panama City) is data controller; Sumsub is named as KYC data processor acting on Hyperbeat's instructions. Other processors are named by category only; complaints go to Panama's data protection authority. No DPIA statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/privacy",
              "detail": "Privacy Policy opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "the Organization is the data controller",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.hyperbeat.org/en/articles/14196937-how-is-my-kyc-data-handled-and-protected",
              "detail": "Help article naming Sumsub's role.",
              "checked_at": "2026-10-09",
              "quote": "Sumsub acts as a data processor",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "note": "The Pay web app bundles the Datadog browser SDK (provider file, CROPS P1), which indicates client-side monitoring; no statement on server-side logging, SIEM or endpoint detection found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical architecture only, in prose (docs page \"Liquid banking Architecture\" describing ManagementAccount, factory, registries, the Operator's settle() and Turnkey key management). No infrastructure or integration architecture, no diagrams of the backend, and no contract addresses for the card stack.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.hyperbeat.org/liquid-banking/liquid-banking-architecture",
              "detail": "Liquid Banking architecture page.",
              "checked_at": "2026-10-09",
              "quote": "Liquid Banking uses Turnkey to provide secure, non-custodial key management",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Zoeion Ltd Corporation, Panama (address PH Iver 77, Calle José Matilde Perez, San Francisco, Panama City); disputes go to arbitration in Panama (CECAP). The card is issued by Third National under the separate, unpublished Hyperbeat Pay Cardholder Agreement; bank ramps run through Noah. No company register entry found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/terms",
              "detail": "Terms of Use (last updated 1 March 2026), opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "provided and operated by Zoeion Ltd Corporation",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/privacy",
              "detail": "Privacy Policy giving the company address.",
              "checked_at": "2026-10-09",
              "quote": "PH Iver 77, Calle José Matilde Perez, San Francisco, Panama City",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Platform fees on transactions (set and changeable by the Company), FX and ATM fees on the card, fiat ramp fees and interest on Credit Mode borrowing; cashback is described as funded from account activity rather than a marketing budget. No financial statements found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/terms",
              "detail": "Terms of Use, Payment, Gas Fees and Taxes.",
              "checked_at": "2026-10-09",
              "quote": "such fees for the utilisation of the Platform",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "The Company may terminate the Terms at any time, for any reason or none, with or without notice; after termination users keep access to their Digital Wallet through means outside the Platform. Hyperbeat may keep Pay account registration data after the user terminates. Collateral can be withdrawn only after repaying all borrowings. Card-level termination terms are in the unpublished Cardholder Agreement.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/terms",
              "detail": "Terms of Use, Term and Termination.",
              "checked_at": "2026-10-09",
              "quote": "The Company reserves the right to terminate these Terms at any time for any reason, or for no reason, with or without notice to you",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/terms",
              "detail": "Terms of Use, effect of termination.",
              "checked_at": "2026-10-09",
              "quote": "you will continue to be able to access and use your Digital Wallet",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "AI agents can initiate card payments: Agent Cards let AI assistants (Claude, ChatGPT and others) and backend code spend under per-card limits. The privacy policy says no decisions with legal or similarly significant effects are taken solely by automated processing unless assessed in writing; KYC screening (sanctions, PEP, liveness) runs through Sumsub.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.hyperbeat.org/en/articles/15073693-what-are-agent-cards",
              "detail": "Help article on Agent Cards (12 May 2026).",
              "checked_at": "2026-10-09",
              "quote": "Let Claude, ChatGPT, or other AI agents buy things for you online",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/privacy",
              "detail": "Privacy Policy, Automated decision-making.",
              "checked_at": "2026-10-09",
              "quote": "will not take decisions producing legal effects concerning you",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "For Agent Cards only spending controls are documented (per-transaction or period limits, optional expiry, one-tap revocation, passkey-signed issuance). No monitoring, validation, bias or decommissioning documentation found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.hyperbeat.org/en/articles/15073693-what-are-agent-cards",
              "detail": "Help article on Agent Cards, spending controls.",
              "checked_at": "2026-10-09",
              "quote": "Instant revocation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "none",
            "amount": "Virtual cards free (up to 20 active)",
            "basis": "Help article 16086494; physical card fee not published.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "0.4% to 1% on foreign-currency purchases (Visa rate)",
            "basis": "Help article 12674592; merchant DCC and surcharges are extra.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM: 1 USD + 0.65% per withdrawal; 0.60 USD per balance inquiry or decline; plus ATM operator fees",
            "basis": "Help articles 12674592 and 12898397; physical card only.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Fiat withdrawal: fixed + variable per currency, e.g. USD ACH 0.25 USD + 0.12%, EUR 1 EUR + 0.20%, GBP 1 GBP + 0.25%",
            "basis": "Help article 14107075 (24 August 2026); processed by Noah.",
            "evidence_index": 2
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Platform Fee on transactions, amount not published in the Terms; Credit Mode borrowing at a variable APR shown in app",
            "basis": "Terms of Use, Payment, Gas Fees and Taxes; the Company may change the Platform Fee at any time.",
            "evidence_index": 3
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "100,000 USD default monthly spending limit; ATM 250 USD per transaction, 3 per day",
            "basis": "Help articles 12674592 and 12898397.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.hyperbeat.org/en/articles/16086494-how-much-does-it-cost-to-issue-a-virtual-card",
            "detail": "Help article on virtual card cost.",
            "checked_at": "2026-10-09",
            "quote": "Issuing a virtual card is free",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.hyperbeat.org/en/articles/12674592-what-are-the-rates-and-fees-for-consumer-hyperbeat-pay-cards",
            "detail": "Help article \"What are the rates and fees for consumer Hyperbeat Pay cards?\" (18 March 2026).",
            "checked_at": "2026-10-09",
            "quote": "Withdrawals: $1 + 0.65%",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.hyperbeat.org/en/articles/14107075-what-are-the-fees-for-fiat-withdrawals",
            "detail": "Help article on fiat withdrawal fees.",
            "checked_at": "2026-10-09",
            "quote": "USD (ACH transfers) $0.25 0.12%",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hyperbeat.org/terms",
            "detail": "Terms of Use, Platform Fee clause.",
            "checked_at": "2026-10-09",
            "quote": "such fees for the utilisation of the Platform",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Fiat deposits cost 0.12% + 0.25 USD (ACH) to 0.12% + 35 USD (SWIFT) and 0.2% + 1 EUR (SEPA) (help article 14107006). No card purchase fee is published; the Hyperbeat Pay Cardholder Agreement, where card fees would be set, is not public. Gas for Operator settlement is not described as a user fee.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "Per the architecture docs (S1 finding), funds sit in a user-owned, upgradeable ManagementAccount, but Hyperbeat's Operator settles card spends up to a user-set limit and must approve settlement-token and collateral withdrawals. Hyperbeat's help centre says it cannot move, freeze or lock funds; that provider claim conflicts with the docs and is not used for the value.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "attested",
        "value": [
          {
            "entity": "Third National",
            "holder": "partner",
            "country": "US",
            "regulator": "not stated",
            "type": "Card issuer under licence from Visa (as stated in Hyperbeat's Terms)",
            "activities": "Issues the Hyperbeat Pay card; does not extend credit (credit comes from onchain lending markets)",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://hyperbeat.org/terms",
            "detail": "Terms of Use, Card clause (the same clause also refers to \"Ether.Fi protocol\", apparently copied from another programme's terms).",
            "checked_at": "2026-10-09",
            "quote": "The Hyperbeat Card is issued by Third National",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No licence held by Zoeion Ltd Corporation was found or claimed. Not found in a register: an active FDIC-insured institution named Third National (FDIC BankFind search, 2026-10-09). Noah, which processes fiat deposits and withdrawals, is named without a licence. The help centre says availability depends on licensing and partner rails without naming licences.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Third National (issuer), Visa",
            "fee": "FX 0.4% to 1%; no purchase fee published",
            "limits": "100,000 USD default monthly; Cash Mode spends the USD balance, Credit Mode borrows against collateral up to the Spending Cap.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Third National (issuer), Visa",
            "fee": "1 USD + 0.65%; 0.60 USD per inquiry or decline",
            "limits": "Physical card only; 250 USD per transaction, 3 per day; not allowed in North Korea, Iran or Myanmar.",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Noah",
            "fee": "Fixed + variable per currency (e.g. USD ACH 0.25 USD + 0.12%)",
            "limits": "15 payout currencies available (USD, EUR, GBP, AED, AUD, BRL, IDR, MYR, NGN, PLN, THB, TRY, VND, PHP, ZAR); limits per channel shown in app; third-party recipients allowed.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.hyperbeat.org/en/articles/12674592-what-are-the-rates-and-fees-for-consumer-hyperbeat-pay-cards",
            "detail": "Help article on card rates, fees and limits.",
            "checked_at": "2026-10-09",
            "quote": "$100,000 default monthly spending limit",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.hyperbeat.org/en/articles/12898397-can-i-withdraw-cash-from-an-atm-will-there-be-an-extra-fee",
            "detail": "Help article on ATM withdrawals.",
            "checked_at": "2026-10-09",
            "quote": "Please note the ATM limit of $250 per transaction and only 3 atm withdrawals per day",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.hyperbeat.org/en/articles/14107061-how-do-i-withdraw-fiat-currency-to-my-bank-account",
            "detail": "Help article on fiat withdrawals.",
            "checked_at": "2026-10-09",
            "quote": "Noah processes the transfer and sends funds to your bank account",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ALL means every country not blocked in the provider file's availability (blocklist of five embargoed countries). Narrower first-party lists exist: help article 13512812 lists supported card jurisdictions (about 50 countries, \"Europe\" and 35 US states), and help article 16199140 lists countries per virtual bank account; neither is reflected row by row here. The withdrawal-currency article says 13 currencies in its summary but marks 15 as available.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-04-08",
            "what": "Liquid Banking (account, Hyperbeat Pay card and credit) announced as live in Hyperbeat's newsroom."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/blog/introducing-liquid-banking",
              "detail": "Newsroom post \"Introducing Liquid Banking\", dated 8 April 2026.",
              "checked_at": "2026-10-09",
              "quote": "It is live today",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The card predates this announcement - help-centre card articles are dated from 15 January 2026, the Zellic audit of Hyperbeat Pay is dated 6 November 2025, and the privacy policy from 21 August 2025 - but no dated first launch of the card was found. The Operator contract's deployment block could not be read (HyperEVM public RPC ignores the block parameter for eth_getCode; contracts unverified).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Zoeion Ltd Corporation",
            "jurisdiction": "PA"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/terms",
              "detail": "Terms of Use naming the operator.",
              "checked_at": "2026-10-09",
              "quote": "provided and operated by Zoeion Ltd Corporation",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/privacy",
              "detail": "Privacy Policy giving the Panama City address.",
              "checked_at": "2026-10-09",
              "quote": "PH Iver 77, Calle José Matilde Perez, San Francisco, Panama City",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Not checked in Panama's Registro Público (interactive search), so no register_url or registration number.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident report found in the Hyperbeat newsroom, docs or help centre, and there is no status page. The Zellic audit's critical finding was pre-deployment and is covered by CROPS S6, not recorded as an incident. Searched 2026-10-09.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-08-21",
              "summary": "Privacy Policy (Zoeion Ltd Corporation, Panama) last updated.",
              "url": "https://hyperbeat.org/privacy"
            },
            {
              "date": "2026-03-01",
              "summary": "Terms of Use last updated, covering the Pay Service and naming Third National as card issuer.",
              "url": "https://hyperbeat.org/terms"
            },
            {
              "date": "2026-04-08",
              "summary": "Liquid Banking launched (self-custodial account, card, credit and ramps).",
              "url": "https://hyperbeat.org/blog/introducing-liquid-banking"
            },
            {
              "date": "2026-05-01",
              "summary": "Real-World Credit described - Credit Mode on five isolated HyperEVM lending markets lending beatUSD.",
              "url": "https://hyperbeat.org/blog/real-world-credit"
            },
            {
              "date": "2026-08-05",
              "summary": "New cashback system (0.20% base, up to 1% daily, more with trading activity).",
              "url": "https://hyperbeat.org/blog/new-cashback-system"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/terms",
              "detail": "Terms of Use header.",
              "checked_at": "2026-10-09",
              "quote": "Last updated: March 1, 2026",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/privacy",
              "detail": "Privacy Policy header.",
              "checked_at": "2026-10-09",
              "quote": "Last updated: August 21, 2025",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://hyperbeat.org/blog/introducing-liquid-banking",
              "detail": "Newsroom post dated 8 April 2026.",
              "checked_at": "2026-10-09",
              "quote": "It is live today",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "No listed contracts. Card settlement runs through Hyperbeat's Operator and a batchSettle contract on HyperEVM that are unverified and not attributed in any Hyperbeat publication (provider file notes), so no spec over listed settlement contracts can be written.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "jupiter-card": {
      "slug": "jupiter-card",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement for Jupiter Spend. Jupiter's security page lists audits of its onchain programs only; Rain lists SOC 2 Type II and PCI DSS; nothing found for DCS or Noah.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "attested",
          "value": "Jupiter states nothing for Spend. Partner (Rain, for Rain-issued cards): SOC 2 Type II and PCI DSS, reports available to partners on request; not read.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page (Signify Holdings, Inc.), section \"Security reports and policies\"; the trust center at trust.rain.xyz is a client-rendered Vanta page and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Partners and prospective partners can request our SOC 2 report, PCI DSS attestation, penetration test summary, and security policies through our trust center",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy (last updated 16 July 2026), Security section.",
              "checked_at": "2026-10-09",
              "quote": "Rain maintains SOC 2 Type II certification",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Jupiter's docs name Rain as issuer outside the nine DCS countries, so Rain's statements cover Rain-issued cards only; nothing was found for DCS or Noah.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "attested",
          "value": "Jupiter says Rain-card deposits stay onchain as collateral; Rain says its contracts are independently audited before launch and per chain. No report linked and no collateral program identified (CROPS S6 unknown). Jupiter's published audits cover its own onchain programs, not Spend.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/index.md",
              "detail": "Jupiter Spend overview, deposits.",
              "checked_at": "2026-10-09",
              "quote": "With a Rain-issued card, they stay on-chain as collateral for the card",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Smart contract audits\"; no report is linked from the page.",
              "checked_at": "2026-10-09",
              "quote": "Our smart contracts are reviewed by independent auditors before launch and again for each new chain we support",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "attested",
          "value": "Partner (Rain): penetration test summary available to partners through its trust center. Nothing from Jupiter, DCS or Noah.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page (Signify Holdings, Inc.), section \"Security reports and policies\"; the trust center at trust.rain.xyz is a client-rendered Vanta page and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Partners and prospective partners can request our SOC 2 report, PCI DSS attestation, penetration test summary, and security policies through our trust center",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Jupiter's docs name Rain as issuer outside the nine DCS countries, so Rain's statements cover Rain-issued cards only; nothing was found for DCS or Noah.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "evidenced",
          "value": "Partner (Rain): code peer-reviewed and automatically scanned before production; no cadence. Nothing from Jupiter for Spend.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Secure development\".",
              "checked_at": "2026-10-09",
              "quote": "Code is peer-reviewed and automatically scanned for vulnerabilities before it reaches production",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Jupiter's docs name Rain as issuer outside the nine DCS countries, so Rain's statements cover Rain-issued cards only; nothing was found for DCS or Noah.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "evidenced",
          "value": "No Jupiter commitment found. Partner (Rain): documented incident response plan keeping partners informed; no time stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Detection and response\".",
              "checked_at": "2026-10-09",
              "quote": "Security events are monitored centrally, and a documented incident response plan guides how we act and keep partners informed",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Jupiter's docs name Rain as issuer outside the nine DCS countries, so Rain's statements cover Rain-issued cards only; nothing was found for DCS or Noah.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "See CROPS S4 (0): the only documented exits are partner-run withdrawals.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Jupiter's status page (status.jup.ag) covers the website and trading APIs, not Spend or the card. Partner (Rain): status.rain.xyz with incident history; no post-mortems found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/",
              "detail": "Rain Platform Status (cState), with components for onboarding, API, card issuing, authorizations, disputes and collateral, and a paged incident history back to 2025.",
              "checked_at": "2026-10-09",
              "quote": "We continuously monitor the performance and availability of our services",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/",
              "detail": "Read the incident pages listed on status.rain.xyz pages 1 to 3 (2025-06-12 to 2026-09-28) on 2026-10-09. Updates give a one-line cause at most (partner OS patching, payment processor, expired certificate, processor rules engine); the 2026-09-28 incident says the root cause is still being investigated, and no post-mortem is linked from any incident.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/ | grep -i \"root cause\""
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://status.jup.ag/",
              "detail": "status.jup.ag read 2026-10-09: components are Website, API Gateway and swap, trigger, recurring, token and price APIs; no Spend or card component.",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "Jupiter's docs name Rain as issuer outside the nine DCS countries, so Rain's statements cover Rain-issued cards only; nothing was found for DCS or Noah.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Global ID sign-in by an emailed verification code or a Google or Apple account; no password and no separate second factor. Unfreezing a DCS-issued card asks for an SMS code.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/faq.md",
              "detail": "Jupiter Spend FAQ, account access.",
              "checked_at": "2026-10-09",
              "quote": "You log in to your Global ID with a verification code sent to your email, or with your Google or Apple account",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "No Spend API is documented; Jupiter's developer APIs cover trading only.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Jupiter interface privacy policy: encryption in transit and at rest, access controls and NDAs. Partner (Rain): encryption in transit and at rest, PCI DSS. Observed: jup.ag refuses TLS 1.1 and accepts TLS 1.2. No data classification; no Spend-specific policy.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/legal/privacy-policy.md",
              "detail": "Jupiter privacy policy, section 9 Data Integrity & Security of Processing.",
              "checked_at": "2026-10-09",
              "quote": "both during transmission and once it is at rest",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Security section: encryption in transit and at rest, access controls, multifactor authentication, tokenization, PCI DSS for card data.",
              "checked_at": "2026-10-09",
              "quote": "encryption of sensitive data in transit and at rest",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://jup.ag",
              "detail": "openssl s_client -tls1_1 to jup.ag:443 failed with alert protocol version; -tls1_2 negotiated an ECDHE cipher. Run 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect jup.ag:443 -servername jup.ag -tls1_1; echo | openssl s_client -connect jup.ag:443 -servername jup.ag -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "A Global ID cannot be deleted once verified; identity documents are held by SumSub, not Jupiter. The interface privacy policy keeps data as long as needed for its purposes; Rain keeps card records five years or longer after closure. No Spend-specific retention schedule.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/index.md",
              "detail": "Jupiter Spend overview, Data Handling & Privacy.",
              "checked_at": "2026-10-09",
              "quote": "Global ID cannot be deleted once created",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Retention section.",
              "checked_at": "2026-10-09",
              "quote": "Customer identification records, transaction records, and related regulated financial services records may be retained for five years or longer following account closure",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Block Raccoon S.A. (Panama) is controller for interface data; Spend is not mentioned. SumSub handles verification; Nimbus LLC (Third National) is controller for Rain card issuance. No DPIA statement.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/legal/privacy-policy.md",
              "detail": "Jupiter privacy policy, opening.",
              "checked_at": "2026-10-09",
              "quote": "which is the controller for your Personal Data within the scope of this Privacy Policy",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Entity Roles and Data Flows: Nimbus LLC d/b/a Third National is controller for card issuance.",
              "checked_at": "2026-10-09",
              "quote": "For card issuance and customer account services, Nimbus LLC generally acts as a controller",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "evidenced",
          "value": "Partner (Rain): security events monitored centrally; no SIEM or endpoint detection named. Jupiter: some merchants are dynamically restricted by fraud and risk monitoring.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Detection and response\".",
              "checked_at": "2026-10-09",
              "quote": "Security events are monitored centrally, and a documented incident response plan guides how we act and keep partners informed",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Jupiter's docs name Rain as issuer outside the nine DCS countries, so Rain's statements cover Rain-issued cards only; nothing was found for DCS or Noah.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical view only: the docs map each Spend product to its partner (card: Rain or DCS; off-ramp and remittance: Noah; QR Pay: DCS) and describe deposits and balances. No infrastructure or integration architecture.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/risks-and-security.md",
              "detail": "Jupiter Spend, Risks & Security.",
              "checked_at": "2026-10-09",
              "quote": "Each product is operated through a different partner",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "No Jupiter Spend terms are public. The interface Terms of Use name \"Jupiter\" with a registered address in Grand Cayman under Panama law; the privacy policy names Block Raccoon S.A. (Panama) as controller; neither mentions Spend. Card terms with Rain or DCS are not published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/legal/terms-of-use.md",
              "detail": "Jupiter Terms of Use (interface).",
              "checked_at": "2026-10-09",
              "quote": "registered address is Suite 102, Cannon Place, P.O. Box 712",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/legal/privacy-policy.md",
              "detail": "Jupiter privacy policy.",
              "checked_at": "2026-10-09",
              "quote": "Block Raccoon S.A., a company incorporated in Panama",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Only fee revenue is documented (FX, ATM, physical card, deposit processing, payout fees). No funding statement or financial statements for Spend.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
              "detail": "Jupiter Spend Fees & Limits.",
              "checked_at": "2026-10-09",
              "quote": "FX conversion (Rain) | 1% on non-USD payments",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Jupiter may disable interface access at any time; Spend users are bound by partner terms. Card balances can leave only through the Send routes (Solana wallet or Noah bank transfer, not for every card); DCS-card balances cannot be withdrawn; Rain-card refunds cannot be withdrawn. A Global ID cannot be deleted.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/risks-and-security.md",
              "detail": "Jupiter Spend, Risks & Security.",
              "checked_at": "2026-10-09",
              "quote": "Users are subject to the terms, conditions, and operational stability of these partners",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
              "detail": "Jupiter Spend Fees & Limits, withdrawals with DCS-issued cards.",
              "checked_at": "2026-10-09",
              "quote": "card balances are for spending only",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Yes: merchants may be dynamically restricted by fraud, abuse or risk monitoring systems, and Rain uses automated fraud, sanctions and transaction monitoring. Machine learning is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
              "detail": "Jupiter Spend Fees & Limits, restricted merchant categories.",
              "checked_at": "2026-10-09",
              "quote": "some merchants may be dynamically restricted based on fraud, abuse, or risk monitoring systems",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Automated Processing and Decision-Making.",
              "checked_at": "2026-10-09",
              "quote": "We may use automated systems to support fraud detection, sanctions screening, transaction monitoring, identity verification, biometric matching, eligibility assessments, and risk management",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "Only Rain's override path (human review where law grants it). Nothing from Jupiter.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Automated Processing and Decision-Making: available where applicable law grants the right.",
              "checked_at": "2026-10-09",
              "quote": "request human review, express your point of view, and contest the decision",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "No annual fee; physical card $13.13 plus shipping; Claynosaurz virtual card $25",
            "basis": "Fees & Limits; card orders non-refundable.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Deposit: none on Solana; Ethereum, Base, Arbitrum, Sui: higher of $0.30 or 0.02% plus gas",
            "basis": "Fees & Limits; minimum deposit $3 ($10 on Ethereum).",
            "evidence_index": 1
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "1% on non-USD (Rain cards); 1.8% (DCS cards)",
            "basis": "Fees & Limits; set by the issuer.",
            "evidence_index": 2
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM (Rain only): $1 + 0.65%, plus $0.30 + 1% if non-USD; $0.60 balance inquiry or decline",
            "basis": "Fees & Limits; DCS cards have no ATM access.",
            "evidence_index": 3
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Bank payout via Noah: fixed + variable per corridor, e.g. ACH $2 + 0.05%, SEPA $1 + 0.10%, SWIFT $30 + 0.05%",
            "basis": "Fees & Limits, Payout Fees; may change.",
            "evidence_index": 4
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "DCS: $50,000/day, $990,000/year; Rain: no limit",
            "basis": "Fees & Limits, Spending Limits.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
            "detail": "Jupiter Spend Fees & Limits, physical card.",
            "checked_at": "2026-10-09",
            "quote": "plus shipping, charged to your Spend balance",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
            "detail": "Fees & Limits, deposit note.",
            "checked_at": "2026-10-09",
            "quote": "Direct deposits on Solana have no processing fee",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
            "detail": "Fees & Limits, card fees and regional differences.",
            "checked_at": "2026-10-09",
            "quote": "FX conversion (DCS) | 1.8% on non-USD payments",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
            "detail": "Fees & Limits, ATM withdrawal (Rain).",
            "checked_at": "2026-10-09",
            "quote": "a withdrawal in a currency other than USD adds an FX fee of",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
            "detail": "Fees & Limits, Payout Fees table.",
            "checked_at": "2026-10-09",
            "quote": "Each payout (outgoing transfer) incurs a fixed fee plus a variable fee on the transfer amount",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No USD payment fee. Remittance deposits by bank transfer also carry fees (e.g. ACH $2 + 0.05%). The standard virtual card price is not listed.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "Agrees with S1 (1): Spend balances are managed by the issuing partners. The Rain \"onchain collateral\" claim has no published address and is not used.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "attested",
        "value": [
          {
            "entity": "Nimbus LLC d/b/a Third National (Rain)",
            "holder": "partner",
            "country": "US",
            "regulator": "Not named in any document",
            "type": "Licensed lender and money transmitter; Visa-authorized card issuer (as stated by Rain)",
            "activities": "Issuer for Rain cards outside the nine DCS countries (Jupiter names only \"Rain\").",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/risks-and-security.md",
            "detail": "Jupiter Spend, Risks & Security.",
            "checked_at": "2026-10-09",
            "quote": "Jupiter Spend relies on regulated financial partners to issue cards, process payments, and handle transfers",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.raincards.xyz/legal/privacy-policy",
            "detail": "Rain privacy policy, Entity Roles and Data Flows: describes Nimbus LLC, doing business as Third National, without naming a regulator, state or licence number.",
            "checked_at": "2026-10-09",
            "quote": "is a licensed lender, money transmitter and Visa-authorized card issuer",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "trace",
            "url": "https://api.fdic.gov/banks/institutions?search=NAME:%22Third%20National%22&fields=NAME,CERT,ACTIVE,CITY,STNAME&limit=20",
            "detail": "FDIC BankFind institutions API, run 2026-10-09: the closest matches for \"Third National\" are other banks (Fifth Third Bank, N.A. and inactive banks); a search for NAME:Nimbus with ACTIVE:1 returns 0 institutions. NMLS Consumer Access returned HTTP 403 to a scripted request and was not bypassed; the Puerto Rico OCIF licence check (concesionarios.ocif.pr.gov) failed the TLS handshake.",
            "checked_at": "2026-10-09",
            "recheck": "curl -s 'https://api.fdic.gov/banks/institutions?search=NAME:Nimbus&filters=ACTIVE:1&fields=NAME,CERT' | grep -o '\"total\":[0-9]*'"
          }
        ],
        "note": "Attested only. Jupiter names \"Rain\" and \"DCS\" without entities or licences; DCS and Noah were not identified in any register. FDIC BankFind lists no institution named Third National or Nimbus; NMLS blocked scripted access; the Puerto Rico OCIF check could not be reached.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Rain or DCS (by country), Visa",
            "fee": "1% (Rain) or 1.8% (DCS) on non-USD",
            "limits": "DCS $50,000/day; Rain no limit.",
            "evidence_index": 0
          },
          {
            "countries": [
              "AG",
              "AR",
              "BS",
              "BB",
              "BZ",
              "BO",
              "BR",
              "KY",
              "CO",
              "CR",
              "CI",
              "DM",
              "DO",
              "EC",
              "EG",
              "SV",
              "GH",
              "GD",
              "GT",
              "GY",
              "HN",
              "KE",
              "MX",
              "MA",
              "NZ",
              "PK",
              "PA",
              "PY",
              "PE",
              "KN",
              "LC",
              "VC",
              "SN",
              "ZA",
              "SR",
              "TT",
              "TC",
              "UG",
              "AE",
              "UY",
              "ZM",
              "US"
            ],
            "method": "atm",
            "partner": "Rain, Visa",
            "fee": "$1 + 0.65% (+ $0.30 + 1% non-USD)",
            "limits": "Rain-issued cards only.",
            "evidence_index": 1
          },
          {
            "countries": [
              "AG",
              "AR",
              "BS",
              "BB",
              "BZ",
              "BO",
              "BR",
              "KY",
              "CO",
              "CR",
              "CI",
              "DM",
              "DO",
              "EC",
              "EG",
              "SV",
              "GH",
              "GD",
              "GT",
              "GY",
              "HN",
              "KE",
              "MX",
              "MA",
              "NZ",
              "PY",
              "PE",
              "KN",
              "LC",
              "VC",
              "SN",
              "ZA",
              "SR",
              "TT",
              "TC",
              "UG",
              "AE",
              "UY",
              "ZM",
              "US"
            ],
            "method": "bank_transfer",
            "partner": "Noah",
            "fee": "Fixed + variable per corridor",
            "limits": "USDC deposits only; Rain-issued cards; EUR or USD restricted in some regions.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/jupiter-card.md",
            "detail": "Jupiter Card, Card Issuers.",
            "checked_at": "2026-10-09",
            "quote": "Each user is assigned one card issuer automatically",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
            "detail": "Fees & Limits.",
            "checked_at": "2026-10-09",
            "quote": "DCS-issued cards cannot withdraw cash at ATMs for now",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.jup.ag/user-docs/global/spend/fees-and-limits.md",
            "detail": "Fees & Limits, Withdrawals, with the restricted-region table.",
            "checked_at": "2026-10-09",
            "quote": "Bank Transfer is powered by our partner Noah",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ATM and bank rows exclude the DCS countries; bank rows also exclude Pakistan and Panama (no EUR or USD off-ramp). A Solana wallet withdrawal also exists for some cards; it is not a cash-out.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "unknown",
          "note": "No dated launch announcement or effective-dated terms found (docs undated; jup.ag legal and blog paths 404; the public jup-ag/docs repo holds no Spend pages).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "unknown",
          "note": "Contracting entity for Spend not documented: the interface Terms name \"Jupiter\" at a Grand Cayman address under Panama law, and the privacy policy names Block Raccoon S.A. (Panama); neither mentions Spend (see B11.1).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-09-28",
              "summary": "Rain platform: unexpected card declines and API issues for some partners, 18:53 to 19:35 UTC; root cause still under investigation. Rain-wide; which programmes were affected is not stated.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/"
            },
            {
              "date": "2026-06-25",
              "summary": "Rain platform: elevated API error rates for 3h32m, caused by an expired encryption certificate.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-06-25-elevated-api-error-rate/"
            },
            {
              "date": "2026-06-03",
              "summary": "Rain platform: partial outage affecting card authorizations for 9 minutes, attributed to operating-system patching at a partner.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-06-03-payments-partner-outage/"
            },
            {
              "date": "2026-05-05",
              "summary": "Rain platform: elevated card declines for 3h10m from a partial outage at its payment processor.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-05-05-elevated-authorization-declines/"
            },
            {
              "date": "2026-01-02",
              "summary": "Rain platform: elevated card declines for 1h15m from an incident in the processor rules engine; Rain stated funds were safe.",
              "funds_lost": "no",
              "url": "https://status.rain.xyz/issues/2026-01-02-payementology-rules-declines/"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/",
              "detail": "Rain status incident 2026-09-28.",
              "checked_at": "2026-10-09",
              "quote": "We are investigating an issue that is causing unexpected declines for transactions",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-06-25-elevated-api-error-rate/",
              "detail": "Rain status incident 2026-06-25.",
              "checked_at": "2026-10-09",
              "quote": "The issue was caused by an expired encryption certificate",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-06-03-payments-partner-outage/",
              "detail": "Rain status incident 2026-06-03.",
              "checked_at": "2026-10-09",
              "quote": "Our partner has identified the cause as operating system patching activity on their side",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-05-05-elevated-authorization-declines/",
              "detail": "Rain status incident 2026-05-05.",
              "checked_at": "2026-10-09",
              "quote": "The incident was related to our payment processor and has been mitigated",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-01-02-payementology-rules-declines/",
              "detail": "Rain status incident 2026-01-02.",
              "checked_at": "2026-10-09",
              "quote": "Funds are safe and Rain infrastructure is working as intended",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No Spend incident report found in the docs or on status.jup.ag. Entries are Rain platform incidents (Rain-issued cards only); not stated which programmes were affected.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "unknown",
          "note": "Spend docs carry no dates; no changelog found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "Incumbent: the provider file lists no contracts, so there is nothing a volume spec could be computed over; card settlement runs offchain through the issuer and Visa.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "notes": "Incumbent card in the Jupiter app, issued by Rain or DCS by country, with Noah for off-ramp. Partner-level facts cite Rain and cover Rain-issued cards only. Docs cited as Mintlify .md copies. No repository facts apply."
    },
    "m-pesa": {
      "slug": "m-pesa",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/contents/?ref=master",
              "detail": "safaricom/mpesa-node-library: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/contents/?ref=master",
              "detail": "safaricom/LNMOnlineAndroidSample: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/contents/?ref=master",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/contents/?ref=master",
              "detail": "safaricom/mpesa_listener: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-php-sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-java-sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/contents/?ref=master",
              "detail": "safaricom/mpesa-api-C-Sharp: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/contents/?ref=master",
              "detail": "safaricom/mpesa-node-library: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/contents/?ref=master",
              "detail": "safaricom/LNMOnlineAndroidSample: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/contents/?ref=master",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/contents/?ref=master",
              "detail": "safaricom/mpesa_listener: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-php-sdk: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-java-sdk: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/contents/?ref=master",
              "detail": "safaricom/mpesa-api-C-Sharp: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/contents/?ref=master",
              "detail": "safaricom/mpesa-node-library: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/contents/?ref=master",
              "detail": "safaricom/LNMOnlineAndroidSample: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/contents/?ref=master",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/contents/?ref=master",
              "detail": "safaricom/mpesa_listener: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-php-sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-java-sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/contents/?ref=master",
              "detail": "safaricom/mpesa-api-C-Sharp: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/rules/branches/master",
              "detail": "safaricom/mpesa-node-library: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/rules/branches/master",
              "detail": "safaricom/LNMOnlineAndroidSample: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/rules/branches/master",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/rules/branches/master",
              "detail": "safaricom/mpesa_listener: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/rules/branches/master",
              "detail": "safaricom/mpesa-php-sdk: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/rules/branches/master",
              "detail": "safaricom/mpesa-java-sdk: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/rules/branches/master",
              "detail": "safaricom/mpesa-api-C-Sharp: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/contents/?ref=master",
              "detail": "safaricom/mpesa-node-library: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/contents/?ref=master",
              "detail": "safaricom/LNMOnlineAndroidSample: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/contents/?ref=master",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/contents/?ref=master",
              "detail": "safaricom/mpesa_listener: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-php-sdk: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-java-sdk: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/contents/?ref=master",
              "detail": "safaricom/mpesa-api-C-Sharp: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/contents/?ref=master",
              "detail": "safaricom/mpesa-node-library: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/contents/?ref=master",
              "detail": "safaricom/LNMOnlineAndroidSample: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/contents/?ref=master",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/contents/?ref=master",
              "detail": "safaricom/mpesa_listener: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-php-sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-java-sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/contents/?ref=master",
              "detail": "safaricom/mpesa-api-C-Sharp: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/contents/?ref=master",
              "detail": "safaricom/mpesa-node-library: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/contents/?ref=master",
              "detail": "safaricom/LNMOnlineAndroidSample: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/contents/?ref=master",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/contents/?ref=master",
              "detail": "safaricom/mpesa_listener: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-php-sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-java-sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/contents/?ref=master",
              "detail": "safaricom/mpesa-api-C-Sharp: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": true,
                "detail": "latest tags: v0.1.3"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": true,
                "detail": "latest tags: 1.0.8, 1.0.7, 1.0.6"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/tags",
              "detail": "safaricom/mpesa-node-library: latest tags: v0.1.3",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/tags",
              "detail": "safaricom/LNMOnlineAndroidSample: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/tags",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/tags",
              "detail": "safaricom/mpesa_listener: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/tags",
              "detail": "safaricom/mpesa-php-sdk: latest tags: 1.0.8, 1.0.7, 1.0.6",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/tags",
              "detail": "safaricom/mpesa-java-sdk: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/tags",
              "detail": "safaricom/mpesa-api-C-Sharp: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "0 of 3 recent commits signed"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "4 of 10 recent commits signed"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": true,
                "detail": "8 of 10 recent commits signed"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": true,
                "detail": "4 of 8 recent commits signed"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "1 of 4 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/commits?per_page=10",
              "detail": "safaricom/mpesa-node-library: 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/commits?per_page=10",
              "detail": "safaricom/LNMOnlineAndroidSample: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/commits?per_page=10",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: 0 of 3 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/commits?per_page=10",
              "detail": "safaricom/mpesa_listener: 4 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/commits?per_page=10",
              "detail": "safaricom/mpesa-php-sdk: 8 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/commits?per_page=10",
              "detail": "safaricom/mpesa-java-sdk: 4 of 8 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/commits?per_page=10",
              "detail": "safaricom/mpesa-api-C-Sharp: 1 of 4 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": true,
                "detail": "1 release(s) with notes"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": true,
                "detail": "3 release(s) with notes"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/contents/?ref=master",
              "detail": "safaricom/mpesa-node-library: 1 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/contents/?ref=master",
              "detail": "safaricom/LNMOnlineAndroidSample: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/contents/?ref=master",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/contents/?ref=master",
              "detail": "safaricom/mpesa_listener: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-php-sdk: 3 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-java-sdk: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/contents/?ref=master",
              "detail": "safaricom/mpesa-api-C-Sharp: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "safaricom/mpesa-node-library",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "safaricom/LNMOnlineAndroidSample",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "safaricom/mpesa_c2b_php_confirmation_validation",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "safaricom/mpesa_listener",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "safaricom/mpesa-php-sdk",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "safaricom/mpesa-java-sdk",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "safaricom/mpesa-api-C-Sharp",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-node-library/contents/?ref=master",
              "detail": "safaricom/mpesa-node-library: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/LNMOnlineAndroidSample/contents/?ref=master",
              "detail": "safaricom/LNMOnlineAndroidSample: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_c2b_php_confirmation_validation/contents/?ref=master",
              "detail": "safaricom/mpesa_c2b_php_confirmation_validation: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa_listener/contents/?ref=master",
              "detail": "safaricom/mpesa_listener: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-php-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-php-sdk: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-java-sdk/contents/?ref=master",
              "detail": "safaricom/mpesa-java-sdk: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/safaricom/mpesa-api-C-Sharp/contents/?ref=master",
              "detail": "safaricom/mpesa-api-C-Sharp: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "OAuth 2.0 client-credentials bearer tokens on every Daraja call.",
          "refs": [
            {
              "criterion": "C2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Consumer key and secret issued per app; B2C and similar calls also carry an encrypted initiator security credential; callbacks are unsigned (see CROPS S5).",
          "refs": [
            {
              "criterion": "C2",
              "index": 0
            },
            {
              "criterion": "S5",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "note": "The Daraja docs say access tokens expire (\"Regenerate a new token and use it before expiry\") but the C2B, B2C, M-Pesa Express and Transaction Status docs read do not state the lifetime. The Authorization doc alias returned \"Invalid ApiName Option\" from populateApi.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Observed: developer.safaricom.co.ke refuses TLS 1.1 and accepts TLS 1.2. No data classification or encryption-at-rest statement could be read (safaricom.co.ke returns 403).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://developer.safaricom.co.ke",
              "detail": "openssl s_client -tls1_1 to developer.safaricom.co.ke:443 failed with alert protocol version; -tls1_2 negotiated ECDHE-RSA-AES128-GCM-SHA256. Run 2026-10-09. api.safaricom.co.ke was not scanned.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect developer.safaricom.co.ke:443 -servername developer.safaricom.co.ke -tls1_1; echo | openssl s_client -connect developer.safaricom.co.ke:443 -servername developer.safaricom.co.ke -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "unknown",
          "note": "The privacy statement returns 403 to automated access.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Integration architecture only (Daraja API docs with sequence diagrams, account types and environments); logical and infrastructure architecture of the M-Pesa platform are not published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/apis/BusinessToCustomer",
              "archive": "data/archive/m-pesa-ops-daraja-b2c.txt",
              "quote": "Account Types in C2B Organization",
              "detail": "Daraja B2C documentation (client-rendered; GraphQL markdown archived).",
              "checked_at": "2026-10-09"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Safaricom PLC, Kenya (Safaricom House, Waiyaki Way, Westlands, Nairobi).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.centralbank.go.ke/wp-content/uploads/2026/09/Directory-of-Authorized-Payment-Service-Providers-August-10-2026.pdf",
              "archive": "data/archive/m-pesa-ops-cbk-psp-directory.txt",
              "quote": "Date First Licensed: January 1, 2016",
              "detail": "CBK Directory of Authorized Payment Service Providers as at August 10, 2026, entry 1 (PDF, text archived).",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "The M-Pesa customer terms (which name the contracting entity) return 403 and were not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Transaction charges under Safaricom's tariff, levied on the organisation or split with the customer (Daraja account-type notes); Safaricom PLC is a listed company.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://developer.safaricom.co.ke/apis/MpesaExpressSimulate",
              "archive": "data/archive/m-pesa-ops-daraja-mpesa-express.txt",
              "quote": "depending on the tariff, a charge is levied on the Organization or is split between the organization and the customer",
              "detail": "Daraja M-Pesa Express documentation, Charges Paid Account.",
              "checked_at": "2026-10-09"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "unknown",
          "note": "The M-Pesa customer terms return 403 to automated access.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "both",
            "amount": "per Safaricom tariff (amounts not published in Daraja)",
            "basis": "Daraja says that, depending on the tariff, the charge is levied on the organisation or split between organisation and customer; debited to the Charges Paid account.",
            "evidence_index": 0
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "customer daily transfer limit KES 500,000",
            "basis": "Daraja B2C result-code table (\"currently Ksh 500,000\").",
            "evidence_index": 1
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "maximum customer account balance KES 500,000",
            "basis": "Daraja B2C result-code table.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://developer.safaricom.co.ke/apis/MpesaExpressSimulate",
            "archive": "data/archive/m-pesa-ops-daraja-mpesa-express.txt",
            "quote": "depending on the tariff, a charge is levied on the Organization or is split between the organization and the customer",
            "detail": "Daraja M-Pesa Express documentation (client-rendered; GraphQL markdown archived).",
            "checked_at": "2026-10-09"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://developer.safaricom.co.ke/apis/BusinessToCustomer",
            "archive": "data/archive/m-pesa-ops-daraja-b2c.txt",
            "quote": "the customer daily transfer amount limit is currently Ksh 500,000",
            "detail": "Daraja B2C documentation, result codes 4 and 8.",
            "checked_at": "2026-10-09"
          }
        ],
        "note": "Safaricom's consumer tariff pages (send, withdraw, pay) return 403 to automated access, and the Wayback Machine availability API returned 429, so no archived first-party tariff was used. Per-transaction amounts are unknown, not zero. The Daraja sample \"Fee For B2C Payment|KES|22.40\" is sandbox example data and is not recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "Safaricom PLC",
            "holder": "provider",
            "country": "KE",
            "regulator": "Central Bank of Kenya",
            "type": "Authorised payment service provider (mobile money)",
            "activities": "Issue, process, store, send and facilitate mobile money payments; platform processing payments on behalf of merchants. First licensed January 1, 2016.",
            "register_url": "https://www.centralbank.go.ke/national-payments-system/",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.centralbank.go.ke/wp-content/uploads/2026/09/Directory-of-Authorized-Payment-Service-Providers-August-10-2026.pdf",
            "archive": "data/archive/m-pesa-ops-cbk-psp-directory.txt",
            "quote": "To issue, process, store, send and facilitate mobile money payments.",
            "detail": "CBK Directory of Authorized Payment Service Providers as at August 10, 2026, entry 1 (PDF linked from the CBK national payments system page; text extracted and archived 2026-10-09).",
            "checked_at": "2026-10-09"
          }
        ],
        "note": "Evidence is the regulator's own directory, extracted from the current PDF (it replaces the earlier transcription in data/archive/m-pesa-cbk-directory.txt). The register URL is the CBK payments page that links the directory.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "KE"
            ],
            "method": "mobile_money",
            "partner": "Daraja B2C (business to customer M-Pesa wallet)",
            "limits": "customer daily transfer and balance limits KES 500,000",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://developer.safaricom.co.ke/apis/BusinessToCustomer",
            "archive": "data/archive/m-pesa-ops-daraja-b2c.txt",
            "quote": "Transfers initiated to move funds from a financial institution or digital wallet to a customer’s account or for cash-out purposes.",
            "detail": "Daraja B2C use cases (salary, loan and financial-institution withdrawal payouts to customer wallets or bank accounts).",
            "checked_at": "2026-10-09"
          }
        ],
        "note": "Agent cash-out is the product's core, but no readable first-party source for agent withdrawal terms or fees was found (safaricom.co.ke 403; Daraja does not cover agents). CBK states that M-Pesa launched with 307 agents in 2007 (Governor's 2013 speech), which is not a current terms source. Agent and ATM rows are therefore not recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2007-03-01",
            "what": "M-PESA launch in Kenya. CBK gives the month (March 2007) only; the day is a placeholder."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.centralbank.go.ke/wp-content/uploads/2023/02/Kenyas-Payments-Journey.pdf",
              "archive": "data/archive/m-pesa-ops-cbk-payments-journey.txt",
              "quote": "starting with M-PESA (m – for ‘mobile’; Pesa – Swahili for ‘money’) in March 2007",
              "detail": "Central Bank of Kenya publication \"Kenya's Payments Journey\" (PDF, excerpt archived).",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "The CBK licence date (January 1, 2016) is the date of the current authorisation under the 2011 Act, not the launch.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Safaricom PLC",
            "jurisdiction": "KE"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.centralbank.go.ke/wp-content/uploads/2026/09/Directory-of-Authorized-Payment-Service-Providers-August-10-2026.pdf",
              "archive": "data/archive/m-pesa-ops-cbk-psp-directory.txt",
              "quote": "Physical Address: Safaricom House, Waiyaki Way, Westlands, Nairobi",
              "detail": "CBK PSP directory entry 1.",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "The Kenyan Business Registration Service register was not checked, so no registration number is recorded.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No primary-source incident notice could be read. Safaricom's newsroom and status pages return 403, and no CBK enforcement notice naming M-Pesa was found in this pass.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2016-01-01",
              "summary": "Safaricom PLC first licensed by CBK as a payment service provider under the current framework (per the CBK PSP directory).",
              "url": "https://www.centralbank.go.ke/wp-content/uploads/2026/09/Directory-of-Authorized-Payment-Service-Providers-August-10-2026.pdf"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.centralbank.go.ke/wp-content/uploads/2026/09/Directory-of-Authorized-Payment-Service-Providers-August-10-2026.pdf",
              "archive": "data/archive/m-pesa-ops-cbk-psp-directory.txt",
              "quote": "Date First Licensed: January 1, 2016",
              "detail": "CBK PSP directory entry 1.",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "Other changes (tariff changes, limit changes, product changes) need Safaricom announcements, which return 403.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "Closed ledger; no public chain to read. Safaricom and CBK publish aggregate figures, which are reported, not verifiable, and are not recorded here.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "metamask-card": {
      "slug": "metamask-card",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/contents/?ref=main",
              "detail": "MetaMask/metamask-mobile: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": true,
                "detail": "dependabot config present"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/contents/?ref=main",
              "detail": "MetaMask/metamask-mobile: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/contents/?ref=main",
              "detail": "MetaMask/metamask-mobile: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": true,
                "detail": "rules: pull_request, non_fast_forward, required_status_checks, merge_queue, pull_request"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/rules/branches/main",
              "detail": "MetaMask/metamask-mobile: rules: pull_request, non_fast_forward, required_status_checks, merge_queue, pull_request",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": true,
                "detail": "95 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/contents/?ref=main",
              "detail": "MetaMask/metamask-mobile: 95 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/contents/?ref=main",
              "detail": "MetaMask/metamask-mobile: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": true,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/contents/?ref=main",
              "detail": "MetaMask/metamask-mobile: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": true,
                "detail": "latest tags: v8.15.0, v8.14.0, v8.13.1"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/tags",
              "detail": "MetaMask/metamask-mobile: latest tags: v8.15.0, v8.14.0, v8.13.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/commits?per_page=10",
              "detail": "MetaMask/metamask-mobile: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": true,
                "detail": "CHANGELOG file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/contents/?ref=main",
              "detail": "MetaMask/metamask-mobile: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "MetaMask/metamask-mobile",
                "ok": true,
                "detail": "CONTRIBUTING file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/MetaMask/metamask-mobile/contents/?ref=main",
              "detail": "MetaMask/metamask-mobile: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found for Crypto Life / Baanx (now Monavate Onchain Ltd), Monavate or Consensys on the MetaMask card support pages, withcl.com home and legal pages, or the CL Platform Terms and Monavate cardholder terms. The Baanx global privacy policy (secure.baanx.co.uk) fails TLS from this environment.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No hosting or support organisation certification found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No audit of FoxConnect or the Baanx platform was found (CROPS S6 is unknown). withcl.com links to kudelskisecurity.com without a report.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or attestation found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "Neither the CL Platform Terms nor the Monavate cardholder terms contain a security or data-breach notification commitment; the Baanx privacy policy could not be read.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "The card account (Crypto Life / Baanx) uses email and password plus a one-time code; the wallet itself is the user's MetaMask key.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.metamask.io/trade/metamask-card/getting-started-with-card/",
              "detail": "Getting started with MetaMask Card.",
              "checked_at": "2026-10-09",
              "quote": "Setting up your account involves adding an email/password, confirming your phone number",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S5",
              "index": 0
            }
          ],
          "note": "The OTP step is shown in the app code (S5 evidence); whether a second factor is required on every login is not stated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "The app talks to the Baanx API with OAuth using PKCE (S256), user email, password and OTP.",
          "refs": [
            {
              "criterion": "S5",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "A single build-time client key is shipped in every app bundle and sent as client_id, client_secret and x-secret-key; with PKCE it acts as a public client identifier. Server-to-server keys between MetaMask and Baanx are not visible.",
          "refs": [
            {
              "criterion": "S5",
              "index": 0
            }
          ],
          "note": "Cross-reference CROPS S5 (score 1).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Baanx retains account and transaction information for five years after account closure; Monavate lets the cardholder redeem e-money for up to six years after the agreement ends.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/679758c14272c334b6975a26/67ed139f59c727d6e69de3ea_CL%20Platform%20Terms%20of%20Use%20-%20Monavate%202025.pdf",
              "archive": "data/archive/metamask-card-cl-platform-terms.txt",
              "detail": "CL Platform Terms, data retention paragraph.",
              "checked_at": "2026-10-09",
              "quote": "Baanx is required by law to retain Your information (including Account & Transactional) for five"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Crypto Life (Baanx) runs KYC and processes the personal data under its own privacy policy; MetaMask states it has no access to those details. No DPIA mentioned.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.metamask.io/trade/metamask-card/security-privacy/",
              "detail": "MetaMask Card security and privacy page, Crypto Life KYC section.",
              "checked_at": "2026-10-09",
              "quote": "MetaMask will not have access to any of the personal details you provide to Crypto Life",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Baanx.com Ltd (England, company 11155611, renamed MONAVATE ONCHAIN LTD on 19 Aug 2026) under the CL Platform Terms; the card account is held with UAB Monavate (Lithuania, code 305628001) for EU customers and Monavate Ltd (England, 12472532) for UK customers. Consensys provides the MetaMask app.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/679758c14272c334b6975a26/67ed139f59c727d6e69de3ea_CL%20Platform%20Terms%20of%20Use%20-%20Monavate%202025.pdf",
              "archive": "data/archive/metamask-card-cl-platform-terms.txt",
              "detail": "CL Platform Terms, party table and definitions.",
              "checked_at": "2026-10-09",
              "quote": "whose registered office is"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/11155611",
              "archive": "data/archive/metamask-card-ops-companies-house.txt",
              "detail": "Companies House entry for company 11155611, MONAVATE ONCHAIN LTD, active, incorporated 17 Jan 2018, previous name BAANX.COM LTD until 19 Aug 2026.",
              "checked_at": "2026-10-09",
              "quote": "MONAVATE ONCHAIN LTD",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Baanx: the user may cancel on 30 days' notice after requesting Restoration of assets; Baanx may end services on 60 days' notice with full Restoration, or suspend immediately on listed grounds. Monavate: the user may close on one month's notice and can redeem remaining e-money for up to six years. Tokens in the user's own wallet are unaffected (CROPS S4).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/679758c14272c334b6975a26/67ed139f59c727d6e69de3ea_CL%20Platform%20Terms%20of%20Use%20-%20Monavate%202025.pdf",
              "archive": "data/archive/metamask-card-cl-platform-terms.txt",
              "detail": "CL Platform Terms, termination paragraph.",
              "checked_at": "2026-10-09",
              "quote": "We may terminate the services provided by Baanx with 60 days"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://public.withcl.com/Monavate-Issuer-Terms-2023-Nov.pdf",
              "archive": "data/archive/metamask-card-monavate-issuer-terms.txt",
              "detail": "Monavate cardholder terms, sections 14 and 15.",
              "checked_at": "2026-10-09",
              "quote": "You may still, however, withdraw this money for up to six years"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Annual subscription 0 USD (Free tier) or 199 USD (Metal tier); Metal card replacement 99 USD",
            "basis": "MetaMask support limits-and-fees page.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "0.5% when the stablecoin is in neither the cardholder's nor the merchant's currency; otherwise no fee",
            "basis": "Same page, token fees; exception for Argentina where the card is USD-denominated.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "0.875% when spending other cryptocurrencies (e.g. wETH); DeFi tokens free to 1,200 USD per month, then 0.5%",
            "basis": "Same page, token fees.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Cross-border 1% (Free tier), none for Metal (fair usage)",
            "basis": "Same page; applies when the merchant is outside the cardholder's country.",
            "evidence_index": 0
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM 2% (Free tier); Metal free up to 1,200 USD per month, then 2%; ATM operator fees extra",
            "basis": "Same page; ATM withdrawals are available to US cardholders only (FAQ).",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Network gas, typically about 0.01 USD on Linea",
            "basis": "Same page.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.metamask.io/trade/metamask-card/limits-and-fees/",
            "archive": "data/archive/metamask-card-ops-limits-and-fees.txt",
            "detail": "MetaMask Card limits and fees table (Free and Metal tiers) with footnotes.",
            "checked_at": "2026-10-09",
            "quote": "Stablecoin denominated in currency not of cardholder country or merchant country",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The support site serves region-dependent guidance; the static HTML read here is the default (US) view. Metal cards are no longer offered to new UK users (UK migration guide). Judgment call: MetaMask's own support pricing page is treated as documented for fees, while the CROPS seed cited the support site as claimed.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S4",
            "index": 0
          }
        ],
        "note": "Tokens rest in the cardholder's own wallet; any of 33 Baanx operator EOAs can pull up to the approved allowance (unbounded by default) through FoxConnect to a beneficiary Safe the owner can change. Agrees with the S1 finding (score 0, provider can redirect funds within the allowance).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "UAB Monavate",
            "holder": "partner",
            "country": "LT",
            "regulator": "Bank of Lithuania",
            "type": "Electronic money institution licence (non-limited activity)",
            "number": "LB002139",
            "activities": "Issuing e-money and payment instruments, payment transactions, cash withdrawals, currency exchange; valid from 2022-03-31; EU card issuer for MetaMask Card.",
            "register_url": "https://www.lb.lt/en/sfi-financial-market-participants/uab-monavate",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.lb.lt/en/sfi-financial-market-participants/uab-monavate",
            "detail": "Bank of Lithuania register entry for UAB Monavate, authorisation code LB002139, company code 305628001, licence valid from 2022-03-31.",
            "checked_at": "2026-10-09",
            "quote": "Electronic money institution, holding a licence issued in Lithuania for non-limited activity",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://cdn.prod.website-files.com/679758c14272c334b6975a26/67ed139f59c727d6e69de3ea_CL%20Platform%20Terms%20of%20Use%20-%20Monavate%202025.pdf",
            "archive": "data/archive/metamask-card-cl-platform-terms.txt",
            "detail": "CL Platform Terms name UAB Monavate (code 305628001) as EU card issuer and Monavate Ltd (FCA-authorised EMI) as UK card issuer.",
            "checked_at": "2026-10-09",
            "quote": "an entity registered and regulated in Lithuania"
          }
        ],
        "note": "Only the EU issuer is evidenced from a register. Monavate Ltd (UK, company 12472532) is described in the CL terms as an FCA-authorised electronic money institution, but the FCA register is client-rendered and its API returned 403, so it is not listed here (attested only). New UK cards since 28 Sep 2026 are with Immersve, and US cards run under Baanx US with Cross River Bank; neither was checked. Crypto Life's terms say its crypto services are not regulated.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_withdrawal",
            "partner": "Monavate (issuer), Mastercard",
            "fee": "0.5% token conversion where applicable; 1% cross-border on Free tier",
            "limits": "Card spend at merchants (the schema has no card-spend value); 10,000 USD per transaction and 15,000 USD per day on Free tier.",
            "evidence_index": 0
          },
          {
            "countries": [
              "US"
            ],
            "method": "atm",
            "partner": "Baanx US programme",
            "fee": "2% (Free tier); Metal free up to 1,200 USD per month",
            "limits": "1,000 USD per transaction and per day (Free); only existing US cardholders, since US sign-ups are paused; other regions cannot use ATMs.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.metamask.io/trade/metamask-card/limits-and-fees/",
            "archive": "data/archive/metamask-card-ops-limits-and-fees.txt",
            "detail": "Limits and fees, transaction and ATM limits.",
            "checked_at": "2026-10-09",
            "quote": "Using card with merchant located outside of cardholder country",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.metamask.io/trade/metamask-card/card-faq/",
            "archive": "data/archive/metamask-card-ops-faq.txt",
            "detail": "Card FAQ, ATM question.",
            "checked_at": "2026-10-09",
            "quote": "Card users in the United States can withdraw cash from an ATM with their card.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No bank withdrawal through the card programme is documented; refund credits withdraw to the user's wallet as mUSD, not fiat. US is not in the availability allowlist (sign-ups paused), so the ATM row only reaches existing US cardholders.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2024-03-06",
            "block": 2715910,
            "what": "FoxConnect (Global) card spender 0x9dd23A4a0845f10d65D293776B792af1131c7B30 on Linea"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://lineascan.build/tx/0x10f468bf55946c6c96cdeb7613ad01e6cb7909d90baf5bea660794a39be8136a",
              "address": "0x9dd23A4a0845f10d65D293776B792af1131c7B30",
              "block_number": 2715910,
              "detail": "FoxConnect Global has code size 0 at Linea block 2715909 and 9578 bytes at 2715910 (timestamp 1709721562, 2024-03-06 10:39:22 UTC); the receipt of tx 0x10f468bf...136a in that block has this contractAddress.",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0x9dd23A4a0845f10d65D293776B792af1131c7B30 --block 2715909 --rpc-url https://rpc.linea.build; cast codesize 0x9dd23A4a0845f10d65D293776B792af1131c7B30 --block 2715910 --rpc-url https://rpc.linea.build"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "MONAVATE ONCHAIN LTD (formerly Baanx.com Ltd)",
            "jurisdiction": "GB",
            "register_url": "https://find-and-update.company-information.service.gov.uk/company/11155611",
            "registration_number": "11155611"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/11155611",
              "archive": "data/archive/metamask-card-ops-companies-house.txt",
              "detail": "Companies House, company 11155611, active, incorporated 17 Jan 2018; name BAANX.COM LTD until 19 Aug 2026.",
              "checked_at": "2026-10-09",
              "quote": "MONAVATE ONCHAIN LTD",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://cdn.prod.website-files.com/679758c14272c334b6975a26/67ed139f59c727d6e69de3ea_CL%20Platform%20Terms%20of%20Use%20-%20Monavate%202025.pdf",
              "archive": "data/archive/metamask-card-cl-platform-terms.txt",
              "detail": "CL Platform Terms define Baanx as Baanx.com Ltd, UK company registration number 11155611.",
              "checked_at": "2026-10-09",
              "quote": "whose registered office is"
            }
          ],
          "note": "The cardholder contracts with Crypto Life (Baanx) and the issuer Monavate; MetaMask (Consensys) is the wallet provider and is not a party to the CL terms.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident disclosure found on the MetaMask card support pages, withcl.com or in the CL and Monavate terms; the Baanx privacy policy host fails TLS. No incident log exists to search.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-08-19",
              "summary": "Programme manager Baanx.com Ltd renamed MONAVATE ONCHAIN LTD (company 11155611).",
              "url": "https://find-and-update.company-information.service.gov.uk/company/11155611"
            },
            {
              "date": "2026-09-28",
              "summary": "UK programme moves to Immersve with USDC on Base; UK cards issued before this date, including Metal cards, stop working on 29 Dec 2026.",
              "url": "https://support.metamask.io/trade/metamask-card/uk-migration/"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/11155611/more",
              "archive": "data/archive/metamask-card-ops-companies-house.txt",
              "detail": "Companies House previous company names, BAANX.COM LTD 17 Jan 2018 to 19 Aug 2026.",
              "checked_at": "2026-10-09",
              "quote": "BAANX.COM LTD"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.metamask.io/trade/metamask-card/uk-migration/",
              "detail": "UK card migration guide.",
              "checked_at": "2026-10-09",
              "quote": "MetaMask is now partnered with Immersve to bring MetaMask Card to users in the United Kingdom",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "US sign-ups are paused (support pages) with no date given, so it is not listed.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "FoxConnect.withdraw moves tokens with transferFrom from each cardholder wallet to the beneficiary Safe; FoxConnect's own WithdrawalStatus event carries no token or amount. The amounts appear only as ERC-20 Transfer logs on the token contracts (mUSD, USDC and others), which the spec cannot filter by recipient, and transfers to the beneficiary cannot be separated from other inflows without Baanx's records.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "minipay": {
      "slug": "minipay",
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "no MiniPay fee on wallet transfers",
            "basis": "MiniPay FAQ; set by Blueboard and changeable.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Celo network fee, stated as typically under $0.01",
            "basis": "Celo gas, payable in stablecoins; set by the network, not MiniPay.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "$1 + 1% on deposits to a USD virtual account; EUR 1 + 1% on EUR",
            "basis": "MiniPay FAQ (virtual accounts provided by NOAH).",
            "evidence_index": 1
          },
          {
            "kind": "card",
            "paid_by": "none",
            "amount": "no issuance or monthly MiniPay Card fee",
            "basis": "MiniPay FAQ; Visa exchange rates and fees may apply on non-USD purchases.",
            "evidence_index": 2
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "set by third-party ramp providers; FAQ says fee-free local-currency withdrawals are available through some",
            "basis": "MiniPay FAQ; partner fees are not published by MiniPay.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://minipay.to/faq",
            "quote": "there are very low network fees (typically less than $0.01) charged on every transaction",
            "detail": "MiniPay FAQ, \"Does MiniPay charge fees?\".",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://minipay.to/faq",
            "quote": "there is a $1 + 1% fee charged on deposits to your USD account",
            "detail": "MiniPay FAQ, \"Are there any fees for receiving payments?\" (virtual accounts).",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://minipay.to/faq",
            "quote": "No, there are no monthly card fees or subscriptions for the MiniPay card.",
            "detail": "MiniPay FAQ, card fees.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Judgment call. The provider file treats the FAQ as claimed (support content) for CROPS scores, but here it is cited as documented because it is the operator's only published pricing statement. Ramp-partner fees are unknown.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "Self-custody per the terms (key pair generated on device, recovery phrase backed up to the user's Google account, \"not available to us\"). The app is closed, so this rests on documents only (CROPS S1 holds at the documented cap). The MiniPay backend still holds account and transaction data, so operator controls apply.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "unknown",
        "note": "No licence held by Blueboard Limited was found in the terms, privacy statement, FAQ or minipay.to. The terms say Blueboard offers no exchange services and that buying and selling crypto assets is provided by third parties under their own terms, so any licences sit with the unnamed ramp and virtual-account partners (NOAH named for virtual accounts). No regulator register was searched for Blueboard.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "exchange",
            "partner": "Integrated third-party ramp partners (not named per country)",
            "fee": "Partner-set; not published by MiniPay",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://minipay.to/faq",
            "quote": "You can withdraw funds from MiniPay to your local currency and preferred payment method",
            "detail": "MiniPay FAQ, \"How can I withdraw my funds from MiniPay?\"; top-ups and withdrawals are provided by third parties.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The payout method (bank, mobile money or other) depends on the ramp partner in each country, and MiniPay publishes no per-country partner list, so the method is recorded as exchange through a ramp. Because the wallet is self-custodial, a user can also move stablecoins to any exchange on Celo. The MiniPay Card is digital-only, and no ATM withdrawal is documented.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2023-09-13",
            "what": "MiniPay unveiled inside Opera Mini; rollout began in Nigeria."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://press.opera.com/2023/09/13/opera-launches-minipay/",
              "quote": "MiniPay’s rollout begins in Nigeria",
              "detail": "Opera press release dated Oslo, September 13, 2023.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Blueboard Limited",
            "jurisdiction": "IE"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "form a legally binding contract between you and Blueboard Limited",
              "detail": "MiniPay terms of service (last update April 27, 2026); governed by Norwegian law with the Oslo City Court as venue.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Jurisdiction IE comes from Opera Ltd's Form 20-F for 2020 (SEC accession 0001437749-21-014514, exhibit 8.1 list of subsidiaries, \"Blueboard Limited Ireland\"), read 2026-10-09. sec.gov returns 403 to the validator's user agent, so it is not cited as an evidence URL. The Irish Companies Registration Office entry was not read, so no registration number is recorded.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident notice was found on minipay.to, the MiniPay blog or Opera's Africa blog. No status page was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2023-10-18",
              "summary": "After a month-long initial rollout, MiniPay opened to all Opera Mini users in Nigeria.",
              "url": "https://blogs.opera.com/africa/2023/10/minipay-now-open-to-all-users-in-nigeria/"
            },
            {
              "date": "2023-11-06",
              "summary": "MiniPay launched to all Opera Mini users in Kenya.",
              "url": "https://blogs.opera.com/africa/2023/11/minipay-now-available-to-all-users-in-kenya/"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://blogs.opera.com/africa/2023/10/minipay-now-open-to-all-users-in-nigeria/",
              "quote": "Our initial month-long rollout of MiniPay has proven to be a big hit",
              "detail": "Opera Africa blog, October 18th, 2023.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://blogs.opera.com/africa/2023/11/minipay-now-available-to-all-users-in-kenya/",
              "quote": "we are delighted to launch our innovative stablecoin wallet, MiniPay, to all Opera Mini users in Kenya",
              "detail": "Opera Africa blog, November 6th, 2023.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Later changes (standalone apps, virtual accounts, MiniPay Card) were not dated from a primary source here.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "MiniPay transfers are ordinary stablecoin transfers on Celo, but the provider file lists no settlement contracts. The only MiniPay-specific onchain marker is the SocialConnect issuer's attestations, which identify registered addresses, not MiniPay-originated transfers. A volume figure would need an attribution method that has not been reviewed. Reported figures are not recorded.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement for Blueboard Limited or Opera found; not in the Coalfire Certification directory (checked for Wise).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "Opera runs public and private bug bounties (security.opera.com, bugcrowd.com/opera); whether MiniPay is in scope was not established, and no penetration-test report was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "not_applicable",
          "reason": "Self-custody per the terms. Funds sit on Celo under user-held keys, and the recovery phrase is backed up to the user's own Google account, not by Blueboard. Backups of Blueboard's account and transaction metadata are not covered by this control and were not found.",
          "burden": "institution",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "not_applicable",
          "reason": "Self-custody per the terms. If the app stops, recovery is the user's recovery phrase in another Celo wallet (CROPS S4, documented only).",
          "burden": "institution",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Access and recovery go through the user's Google Account login. Any MFA is whatever the user sets on that Google account; MiniPay states no MFA of its own.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/faq",
              "quote": "Only you have access to your funds through your secure Google Account login.",
              "detail": "MiniPay FAQ, \"Your Wallet's Security\".",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "The documented Mini App interface is an injected EIP-1193 provider in the app (CROPS O4); the authentication of the app-to-backend API is not documented.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Observed: minipay.to refuses TLS 1.1 and accepts TLS 1.2. The terms say the private key is stored encrypted on the device. No statement on server-side encryption at rest or data classification was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://minipay.to",
              "detail": "openssl s_client -tls1_1 to minipay.to:443 failed with alert protocol version; -tls1_2 negotiated ECDHE-ECDSA-AES128-GCM-SHA256. Run 2026-10-09. The app's backend host was not identified, so it was not scanned.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect minipay.to:443 -servername minipay.to -tls1_1; echo | openssl s_client -connect minipay.to:443 -servername minipay.to -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Contact, technical, personal and wallet data kept for two years after use ends; transactional data while active and for two years after. Deletion on request through an online form. See CROPS P2 for what is collected.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/privacy-statement",
              "quote": "Transactional Data is retained for as long as a Crypto Assets or transaction is active, and for a period of two years thereafter.",
              "detail": "MiniPay privacy statement section 4, Retention (last update Sep 7, 2026).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Blueboard Limited is the data controller under the GDPR; a Data Protection Officer is reachable by form; the Irish DPC and Norway's Datatilsynet are named as supervisory authorities. DPIA availability not found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/privacy-statement",
              "quote": "We act as a Data controller of Personal data that Process via Services.",
              "detail": "MiniPay privacy statement sections 1 and 6-7.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Integration view only (docs.minipay.xyz documents the injected provider, custom methods and token transfers for Mini Apps); the logical and infrastructure architecture of the app and backend is not published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.minipay.xyz/technical-references.md",
              "quote": "MiniPay injects an Ethereum provider when it loads your app",
              "detail": "MiniPay developer docs, technical references.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Blueboard Limited (Opera Group; Ireland per Opera's 20-F subsidiary list). Terms governed by Norwegian law, with the Oslo City Court as venue.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "These General Terms are governed by the laws of Norway",
              "detail": "MiniPay terms of service, general terms.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "unknown",
          "note": "MiniPay charges no wallet fees. It takes deposit fees on virtual accounts and pays card cashback; it is part of the Opera Group. No primary source on how its ongoing operation is funded was read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Blueboard may terminate access at any time, with or without notice; termination ends the software licence. Funds stay on Celo under the user's keys (self-custody per the terms), so exit is through the recovery phrase.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://minipay.to/terms-of-service",
              "quote": "to terminate your access to the Services at any time, with or without notice",
              "detail": "MiniPay terms of service, general terms.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "unknown",
          "note": "The terms and privacy statement (searched for AI, automated decision-making and machine learning) do not mention AI in payment processing or compliance. The app is closed, so absence cannot be shown.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      }
    },
    "monero": {
      "slug": "monero",
      "fees": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": [
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Dynamic per-byte fee; sample 0.000491 XMR for a 1,535-byte transaction (block 3,780,260, 2026-10-09)",
            "basis": "Consensus minimum since fork v15 is 0.95 x block_reward x 3000 / median_weight^2 per byte of weight; nodes reject fees more than 2% below it. Wallets pay a multiple by priority. Paid to the miner; changes need a hard fork.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
            "checked_at": "2026-10-09",
            "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_core/blockchain.cpp#L3621-L3718",
            "path": "src/cryptonote_core/blockchain.cpp",
            "detail": "get_dynamic_base_fee (L3621-L3663) computes the per-byte minimum from the block reward, DYNAMIC_FEE_REFERENCE_TRANSACTION_WEIGHT (3000, cryptonote_config.h L75) and the long-term effective median from HF_VERSION_2021_SCALING (v15); check_fee (L3667-L3718) multiplies by transaction weight and rejects fees below 98% of it.",
            "recheck": "gh api \"repos/monero-project/monero/contents/src/cryptonote_core/blockchain.cpp?ref=22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0\" --jq .content | base64 -d | sed -n 3621,3718p"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://xmrchain.net/api/block/3780260",
            "block_number": 3780260,
            "detail": "Block 3,780,260 (2026-10-09 12:10:24 UTC) holds two-output transactions of 1,532-1,539 bytes paying 490,240,000-492,480,000 piconero (about 0.00049 XMR, 320,000 piconero per byte). Read through a public explorer API; any monerod returns the same block.",
            "checked_at": "2026-10-09",
            "recheck": "curl -s https://xmrchain.net/api/block/3780260 | jq '.data.txs[1:6][] | {tx_fee, tx_size}'"
          }
        ],
        "note": "There is no protocol, developer or provider fee; the only charge is the miner fee. The sample is one block on one day; the per-byte minimum moves with the block reward (tail emission 0.6 XMR) and the median block weight.",
        "checked_at": "2026-10-09"
      },
      "custody_model": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "Agrees with the S1 finding (anchor 3 in substance, capped at 2 only for want of contract evidence). Value moves from the payer's outputs to one-time outputs only the payee's keys can spend; nobody holds funds in flight.",
        "checked_at": "2026-10-09"
      },
      "licences": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "No operating entity runs the rail. Monero is a proof-of-work chain run by independent miners and node operators; the project has no company, and its Core Team and volunteers maintain software and escrow donations but do not transmit or hold users' funds.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "cashout": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "Native-asset rail. The payee receives XMR at its own address; converting XMR to local currency is outside the protocol and depends on exchanges whose availability varies by jurisdiction.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "maturity": {
        "first_deployment": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "date": "2014-04-18",
            "block": 1,
            "what": "Monero mainnet launch (block 1, first mined block; genesis has timestamp 0). The current format (ring 16, Bulletproofs+, view tags) dates from fork v15, 2022-08-13."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_config.h#L236-L237",
              "path": "src/cryptonote_config.h",
              "detail": "Mainnet GENESIS_TX and GENESIS_NONCE (10000) compiled into monerod v0.18.5.3; hardforks.cpp L34-L36 starts fork version 1 at height 1."
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://xmrchain.net/api/block/1",
              "block_number": 1,
              "detail": "Block 1 (hash 771fbcd6...8148) has timestamp 1397818193, 2014-04-18 10:49:53 UTC. Block 0 (hash 418015bb...32e3, the CAIP-2 reference) has timestamp 0. Read through a public explorer API; any monerod returns the same headers.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://xmrchain.net/api/block/1 | jq -r '.data.timestamp_utc'"
            }
          ],
          "note": "Judgment call. The first mined block is recorded because the genesis block carries no real timestamp.",
          "checked_at": "2026-10-09"
        },
        "entity": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "5a596d19334d647cdad65cdb9f1287729c9d140d",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero-site/blob/5a596d19334d647cdad65cdb9f1287729c9d140d/_i18n/en.yml#L468-L468",
              "path": "_i18n/en.yml",
              "detail": "The getmonero.org FAQ text states that Monero is an open source community project with no company that runs it and no CEO; contributors are volunteers or community-funded.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "5a596d19334d647cdad65cdb9f1287729c9d140d",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero-site/blob/5a596d19334d647cdad65cdb9f1287729c9d140d/_posts/2019-12-03-core-team-general-fund.md#L9-L25",
              "path": "_posts/2019-12-03-core-team-general-fund.md",
              "detail": "The Core Team describes itself as an informal group that escrows the Community Crowdfunding System and stewards the General Fund; no legal entity is named.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Judgment call. Recorded as absent (no maintaining legal entity exists) rather than unknown. The Core Team, the Monero Research Lab and the vulnerability response team are informal groups; the security contacts in meta/VULNERABILITY_RESPONSE_PROCESS.md are individuals. Search of the website and docs repositories for company, corporation, legal entity and foundation found no entity.",
          "checked_at": "2026-10-09"
        },
        "incidents": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2017-05-17",
              "summary": "Disclosure of the CryptoNote key-image bug that allowed undetectable inflation. Found 2017-02-19, patched secretly in v0.10.2 and enforced by the April 2017 fork; the project scanned the chain and states Monero was never exploited.",
              "funds_lost": "no",
              "url": "https://www.getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html"
            },
            {
              "date": "2018-09-05",
              "summary": "Post-mortem of the multiple-counting bug in wallet transfer reporting (fixed in v0.12.3.0); exchanges using get_transfers could be credited several times over. An exchange was exploited through a Monero fork; losses on Monero itself are not stated.",
              "funds_lost": "unknown",
              "url": "https://www.getmonero.org/2018/09/05/a-post-mortum-of-the-multiple-counting-bug-2018-09-05.html"
            },
            {
              "date": "2018-09-25",
              "summary": "Post-mortem of the burning bug. The wallet did not warn on outputs sent to a reused one-time address, so an attacker could leave a service with unspendable outputs; patched privately for exchanges, protocol and supply unaffected.",
              "funds_lost": "unknown",
              "url": "https://www.getmonero.org/2018/09/25/a-post-mortum-of-the-burning-bug.html"
            },
            {
              "date": "2021-09-20",
              "summary": "Post-mortem of two decoy-selection bugs in the reference wallet (v0.14.1.0 to v0.17.2.2) that weakened sender privacy; fixed in v0.17.2.3.",
              "funds_lost": "no",
              "url": "https://www.getmonero.org/2021/09/20/post-mortem-of-decoy-selection-bugs.html"
            },
            {
              "date": "2023-06-08",
              "summary": "Post-mortem of the 10-block-old decoy selection bug (HIGH severity, wallets v0.13.0.2 to v0.18.2.1) revealing the real input of transactions spending outputs exactly 10 blocks old.",
              "funds_lost": "no",
              "url": "https://www.getmonero.org/2023/06/08/10block-old-decoy-selection-bug.html"
            },
            {
              "date": "2023-11-04",
              "summary": "The Core Team reports the Community Crowdfunding System hot wallet was drained of 2,675.73 XMR on 2023-09-01, source not ascertained; the General Fund covered the loss. Project donation funds, not user funds or the protocol.",
              "funds_lost": "yes",
              "url": "https://www.getmonero.org/2023/11/04/ccs-wallet-incident.html"
            },
            {
              "date": "2025-08-26",
              "summary": "Post-mortem of the find_and_save_rings() bug (wallets v0.12.0.0 to v0.18.4.1) that sent outgoing transaction ids to the daemon on first wallet load, reducing sender anonymity against an untrusted remote node; fixed in v0.18.4.2.",
              "funds_lost": "no",
              "url": "https://www.getmonero.org/2025/08/26/post-mortem-of-find-and-save-rings-bug.html"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "5a596d19334d647cdad65cdb9f1287729c9d140d",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero-site/blob/5a596d19334d647cdad65cdb9f1287729c9d140d/_posts/2017-05-17-disclosure-of-a-major-bug-in-cryptonote-based-currencies.md#L9-L31",
              "path": "_posts/2017-05-17-disclosure-of-a-major-bug-in-cryptonote-based-currencies.md",
              "detail": "Overview and timeline of the key-image bug, including the statement that the Monero blockchain had never been exploited.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "5a596d19334d647cdad65cdb9f1287729c9d140d",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero-site/blob/5a596d19334d647cdad65cdb9f1287729c9d140d/_posts/2023-11-04-ccs-wallet-incident.md#L1-L13",
              "path": "_posts/2023-11-04-ccs-wallet-incident.md",
              "detail": "Core Team notice of the CCS wallet drain of 2,675.73 XMR on 2023-09-01 and the General Fund covering it.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "5a596d19334d647cdad65cdb9f1287729c9d140d",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero-site/blob/5a596d19334d647cdad65cdb9f1287729c9d140d/_posts/2025-08-26-post-mortem-of-find-and-save-rings-bug.md#L1-L20",
              "path": "_posts/2025-08-26-post-mortem-of-find-and-save-rings-bug.md",
              "detail": "Quick facts of the find_and_save_rings() privacy bug (severity, affected versions, fix). The other post-mortems listed are in the same _posts directory at this commit.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Primary sources are the project's own post-mortems in monero-project/monero-site. The 2021-12 multisig vulnerability notice (experimental feature) and the 2016 MWR Labs statement are not listed. Privacy-loss incidents in the reference wallet are included because the rail's property is privacy; none moved funds.",
          "checked_at": "2026-10-09"
        },
        "changes": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2017-01-10",
              "summary": "Fork v4 (height 1,220,516) allows RingCT transactions (hidden amounts).",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/README.md#L130-L130"
            },
            {
              "date": "2018-10-18",
              "summary": "Forks v8/v9 (heights 1,685,555 and 1,686,275) enable then require Bulletproofs and fix ring size at 11.",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/README.md#L134-L135"
            },
            {
              "date": "2019-11-30",
              "summary": "Fork v12 (height 1,978,433) switches proof of work to RandomX and requires at least two outputs.",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/README.md#L138-L138"
            },
            {
              "date": "2020-10-17",
              "summary": "Forks v13/v14 (heights 2,210,000 and 2,210,720) introduce the CLSAG signature format and forbid MLSAG.",
              "url": "https://www.getmonero.org/2020/08/18/network-upgrade-october-2020.html"
            },
            {
              "date": "2022-08-13",
              "summary": "Forks v15/v16 (heights 2,688,888 and 2,689,608) raise ring size to 16, add Bulletproofs+ and view tags, and change the dynamic fee and block-weight algorithm. No fork since; the next is listed as undetermined.",
              "url": "https://www.getmonero.org/2022/04/20/network-upgrade-july-2022.html"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/README.md#L120-L145",
              "path": "README.md",
              "detail": "Scheduled software upgrades table with height, date, fork version and details for every mainnet fork; the next fork row is XXX (not determined)."
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/hardforks/hardforks.cpp#L34-L76",
              "path": "src/hardforks/hardforks.cpp",
              "detail": "Mainnet fork heights compiled into monerod. Dates above are the activation-block timestamps read from xmrchain.net/api/block/<height>, which match the README dates.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Forks v2, v3, v5 to v7, v10 and v11 are omitted for brevity; they are in the same README table.",
          "checked_at": "2026-10-09"
        }
      },
      "volume": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_observable",
        "reason": "Ring signatures, stealth addresses and RingCT hide senders, recipients and amounts by design; only transaction counts and fees are public. Monero also has no contract address the volume script could query."
      },
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/contents/?ref=master",
              "detail": "monero-project/monero: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/contents/?ref=master",
              "detail": "monero-project/monero-gui: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/contents/?ref=master",
              "detail": "monero-project/monero-site: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/contents/?ref=master",
              "detail": "monero-project/monero: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/contents/?ref=master",
              "detail": "monero-project/monero-gui: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/contents/?ref=master",
              "detail": "monero-project/monero-site: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": true,
                "detail": "deployment configuration: Dockerfile.android"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/contents/?ref=master",
              "detail": "monero-project/monero: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/contents/?ref=master",
              "detail": "monero-project/monero-gui: deployment configuration: Dockerfile.android",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/contents/?ref=master",
              "detail": "monero-project/monero-site: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": false,
                "detail": "rules: deletion, non_fast_forward"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/rules/branches/master",
              "detail": "monero-project/monero: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/rules/branches/master",
              "detail": "monero-project/monero-gui: rules: deletion, non_fast_forward",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/rules/branches/master",
              "detail": "monero-project/monero-site: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": true,
                "detail": "3 workflow file(s)"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": true,
                "detail": "3 workflow file(s)"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": true,
                "detail": "4 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/contents/?ref=master",
              "detail": "monero-project/monero: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/contents/?ref=master",
              "detail": "monero-project/monero-gui: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/contents/?ref=master",
              "detail": "monero-project/monero-site: 4 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/contents/?ref=master",
              "detail": "monero-project/monero: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/contents/?ref=master",
              "detail": "monero-project/monero-gui: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/contents/?ref=master",
              "detail": "monero-project/monero-site: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/contents/?ref=master",
              "detail": "monero-project/monero: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/contents/?ref=master",
              "detail": "monero-project/monero-gui: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/contents/?ref=master",
              "detail": "monero-project/monero-site: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": true,
                "detail": "latest tags: v0.18.5.4, v0.18.5.3, v0.18.5.1"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": true,
                "detail": "latest tags: v0.18.5.4, v0.18.5.3, v0.18.5.2"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": false,
                "detail": "latest tags: 2026-07-21, 2026-07-08, 2026-05-12"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/tags",
              "detail": "monero-project/monero: latest tags: v0.18.5.4, v0.18.5.3, v0.18.5.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/tags",
              "detail": "monero-project/monero-gui: latest tags: v0.18.5.4, v0.18.5.3, v0.18.5.2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/tags",
              "detail": "monero-project/monero-site: latest tags: 2026-07-21, 2026-07-08, 2026-05-12",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/commits?per_page=10",
              "detail": "monero-project/monero: 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/commits?per_page=10",
              "detail": "monero-project/monero-gui: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/commits?per_page=10",
              "detail": "monero-project/monero-site: 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": true,
                "detail": "7 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/contents/?ref=master",
              "detail": "monero-project/monero: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/contents/?ref=master",
              "detail": "monero-project/monero-gui: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/contents/?ref=master",
              "detail": "monero-project/monero-site: 7 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "monero-project/monero",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "monero-project/monero-gui",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "monero-project/monero-site",
                "ok": true,
                "detail": "CONTRIBUTING file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero/contents/?ref=master",
              "detail": "monero-project/monero: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-gui/contents/?ref=master",
              "detail": "monero-project/monero-gui: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/monero-project/monero-site/contents/?ref=master",
              "detail": "monero-project/monero-site: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Vulnerability Response Process. Acknowledgement within 3 working days; HIGH and MEDIUM fixed in a point release, LOW in the next regular release; HIGH announced publicly within 3 working days of the patch release; the response team has 90 days to complete the process, after which the researcher may disclose. No fixed patch deadline per severity of the 30/40/90-day kind.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "97fb74b0bfffafa553b8ca6b4978218b4ca13362",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/meta/blob/97fb74b0bfffafa553b8ca6b4978218b4ca13362/VULNERABILITY_RESPONSE_PROCESS.md#L55-L131",
              "path": "VULNERABILITY_RESPONSE_PROCESS.md",
              "detail": "Section III steps 3 and 7 (response time, release type by severity), section IV step 1 (90 days) and step 3d (researcher disclosure after 90 days).",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The process covers code in the project's repositories, not the websites. It is run by volunteers.",
          "checked_at": "2026-10-09"
        },
        "B10.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Logical and integration views only. The docs describe the node/wallet split (monerod, wallet CLI, wallet RPC, GUI), their P2P, keyboard and JSON-RPC interfaces and the data directory; the RPC references and the Levin P2P protocol are documented separately. No single architecture document and no infrastructure view, as no operator-run infrastructure is required.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "fff7b8ecc25bb8fc37f919b7c4795bb89aa8d9eb",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero-docs/blob/fff7b8ecc25bb8fc37f919b7c4795bb89aa8d9eb/docs/en/interacting/overview.md#L51-L96",
              "path": "docs/en/interacting/overview.md",
              "detail": "Executables table and the interaction matrix (P2P, keyboard commands, HTTP API, GUI) published as docs.getmonero.org.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/docs/LEVIN_PROTOCOL.md",
              "path": "docs/LEVIN_PROTOCOL.md",
              "detail": "Wire format of the P2P protocol; docs/ANONYMITY_NETWORKS.md and docs/ZMQ.md cover Tor/I2P transport and the ZMQ interface.",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Donations only. There is no protocol funding stream (the block reward, including tail emission, goes to miners). Development is paid through the Community Crowdfunding System and the General Fund, both escrowed by the Core Team; the bug bounty is paid from community donations.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "5a596d19334d647cdad65cdb9f1287729c9d140d",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero-site/blob/5a596d19334d647cdad65cdb9f1287729c9d140d/_posts/2019-12-03-core-team-general-fund.md#L9-L25",
              "path": "_posts/2019-12-03-core-team-general-fund.md",
              "detail": "The Core Team escrows the CCS and stewards the General Fund, which pays contributors, infrastructure and server costs, with some hosting donated by sponsors.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "97fb74b0bfffafa553b8ca6b4978218b4ca13362",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/meta/blob/97fb74b0bfffafa553b8ca6b4978218b4ca13362/VULNERABILITY_RESPONSE_PROCESS.md#L133-L140",
              "path": "VULNERABILITY_RESPONSE_PROCESS.md",
              "detail": "Bounty XMR is solely contributed by community donors and escrowed by unpaid volunteers.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The 2023 CCS wallet drain (2,675.73 XMR) was covered from the General Fund (see incidents). No current treasury figure was read.",
          "checked_at": "2026-10-09"
        },
        "B12.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            },
            {
              "criterion": "C4",
              "index": 1
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0",
              "checked_at": "2026-10-09",
              "url": "https://github.com/monero-project/monero/blob/22578c3f7d7b4b6dd85ff7daa42a827d97cc53d0/src/cryptonote_core/blockchain.cpp#L3667-L3718",
              "path": "src/cryptonote_core/blockchain.cpp",
              "detail": "Transaction acceptance depends on consensus checks and the fee rule only. The seed research searched monero and monero-gui for country, analytics and telemetry and found no screening step; the VRP's AI clause concerns bug reports, not the payment path."
            }
          ],
          "checked_at": "2026-10-09"
        }
      }
    },
    "nullmask": {
      "slug": "nullmask",
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Protocol fee on deposits and on withdrawals, at most 1% each; current rates shown only in the app",
            "basis": "Terms 7.1 and 7.6; set by the operator and changeable without notice within the 1% cap. The rates in force were not read (the app needs a wallet; the contract is unverified).",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Network and service fee set by the servers; sample 0.00197 ETH on a withdrawal whose gas cost 0.00130 ETH",
            "basis": "Docs fee formula is (latest or default gas) x 1.25 x current gas price, deducted from the shielded balance and paid to the relayer; terms 7.3 say it may exceed actual gas and the difference is not refunded. Sample from tx 0x789715bd…fd02 (2026-06-23).",
            "evidence_index": 1
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "ETH added to each deposit; the operator keeps the crediting gas and an amount towards screening, the rest is returned",
            "basis": "Terms 5.1 and 7.4; amount not published.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Screening fee of up to 1% on a returned deposit, if introduced, plus the network cost of the return",
            "basis": "Terms 5.7; not stated to be in force.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Ethereum gas for deposits and key registration sent from the user's own wallet; Uniswap V2 fee on swaps",
            "basis": "Terms 6.5 and 7.5; set by Ethereum and Uniswap.",
            "evidence_index": 0
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Minimum deposit per asset, enforced by the Pool; maximums may be set at any time",
            "basis": "Terms 5.9; values not published.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://app.nullmask.io/terms",
            "archive": "data/archive/nullmask-ops-terms.txt",
            "detail": "Terms of Use (effective 2026-10-01) sections 5.7, 5.9, 6.5, 7.1, 7.3, 7.4 and 7.6.",
            "checked_at": "2026-10-09",
            "quote": "We charge a protocol fee on deposits and on withdrawals. Each fee is at most 1% of the amount.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.nullmask.io/user-guide/fees.md",
            "detail": "Docs fee page, how the relayer fee is estimated.",
            "checked_at": "2026-10-09",
            "quote": "It applies a 1.25x buffer and multiplies the result by the current gas price",
            "drift": true
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://eth.blockscout.com/tx/0x789715bdb90a5a938029ba63267bda6bd3a7cc1fda416b1a8b5a5a1c3f7ffd02",
            "address": "0x88888888Eb71E1D68aD0C471C6893EdEEa00B026",
            "chain_id": 1,
            "block_number": 25380622,
            "detail": "ShieldedWithdrawal log (topic matches the docs' event signature) in block 25380622: amount 0.00128 ETH, fee 1973875227928586 wei in ETH; the relayer's transaction used 4,530,380 gas at 0.286 gwei (about 0.00130 ETH).",
            "checked_at": "2026-10-09",
            "recheck": "cast receipt 0x789715bdb90a5a938029ba63267bda6bd3a7cc1fda416b1a8b5a5a1c3f7ffd02 --rpc-url https://ethereum-rpc.publicnode.com"
          }
        ],
        "note": "The rail's only path runs through the operator's servers, so these fees apply to every payment. Only 30 ShieldedWithdrawal logs existed from the pool's deployment to 2026-10-09, all before the announced 2026-10-01 launch; the sample is from that period.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "C2",
            "index": 0
          }
        ],
        "note": "Judgment call. The terms say only the user's wallet can authorise spending and that assets are not held in an account with the operator, but the S1 finding (score 0) shows the pool is upgradeable through a controller whose admin is one EOA, and the operator says an upgrade can change who can move assets; C2 and S4 show every transfer and withdrawal needs its servers. The operator controls funds at rest, so provider_custodial rather than hybrid (as for Payy).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://app.nullmask.io/terms",
            "archive": "data/archive/nullmask-ops-terms.txt",
            "detail": "Terms 3.4 say the operator is not a bank, exchange, broker or payment institution; no licence, registration or regulator is named anywhere in the terms.",
            "checked_at": "2026-10-09",
            "quote": "We are not a bank, exchange, broker, payment institution, investment adviser or trustee.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://find-and-update.company-information.service.gov.uk/search/companies?q=nullmask",
            "detail": "Companies House name search for \"nullmask\" (the terms choose English law and London arbitration) returned no company.",
            "checked_at": "2026-10-09",
            "quote": "No results found",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Searched: Terms of Use and Privacy Policy (both effective 2026-10-01), docs.nullmask.io (compliance, security, architecture pages) and Companies House by name. The operator is unnamed and the privacy policy says it is established outside the EEA and the UK, so no regulator register could be searched by entity.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "Withdrawals send tokens to an Ethereum address the user names; converting them to local currency is outside the service. The terms list no fiat off-ramp.",
        "burden": "institution",
        "refs": [
          {
            "criterion": "C2",
            "index": 0
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-02-03",
            "block": 24378139,
            "what": "Nullmask pool proxy 0x8888…B026 on Ethereum, created through the CreateX factory 0xba5E…a5Ed in tx 0x867dcf77…e7ed sent by 0xFf29…9CCd (now the upgrade controller's admin)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/tx/0x867dcf77c70fe11feac675c9a17352019a70ac9041d97acf28e0ebcffc88e7ed",
              "address": "0x88888888Eb71E1D68aD0C471C6893EdEEa00B026",
              "chain_id": 1,
              "block_number": 24378139,
              "detail": "Blockscout gives this as the proxy's creation transaction (creator 0xba5Ed099633D3B313e4D5F7bdc1305d3c28ba5Ed); the receipt (status 1) carries the factory's ContractCreation log for 0x8888…B026, and block 24378139 is dated 2026-02-03 18:32:35 UTC. Sourcify has no record of the contract, so its creation data could not be used.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://eth.blockscout.com/api/v2/addresses/0x88888888Eb71E1D68aD0C471C6893EdEEa00B026 | jq .creation_transaction_hash && cast receipt 0x867dcf77c70fe11feac675c9a17352019a70ac9041d97acf28e0ebcffc88e7ed --rpc-url https://ethereum-rpc.publicnode.com"
            }
          ],
          "note": "The public launch came later; the roadmap gave 1 October 2026 as the mainnet ETA and the terms take effect that day.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "attested",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-ops-terms.txt",
              "detail": "Terms 1.1 define the operator only as the company that operates the Services and offer its legal details on written request.",
              "checked_at": "2026-10-09",
              "quote": "We will give the Operator's full legal details to any person who needs them to bring or answer a legal claim",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "The privacy policy says the operator is established outside the EEA and the UK.",
              "checked_at": "2026-10-09",
              "quote": "It is established outside the European Economic Area and the United Kingdom.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Judgment call. The operator says an identified legal entity exists and is disclosed only on request, which is the attested state; no name, jurisdiction or register entry is public. Companies House has no \"nullmask\" company.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "Searched: docs.nullmask.io (security, threat model), the terms and privacy policy, status.nullmask.io (does not resolve), security.txt (none on app.nullmask.io) and github.com/nullmask-io (one landing-page repo, no advisories). The operator publishes no incident or advisory channel, so absence of incidents cannot be shown. No pause events in the OpenZeppelin format appear in the pool's logs, but the contract is unverified and may log pauses differently.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-02-03",
              "summary": "Pool proxy created and first implementation 0xab88…db2f set (Upgraded log, tx 0x9d1188ec…84b8).",
              "url": "https://eth.blockscout.com/tx/0x9d1188ecbda1cb6641d1cb710e10bd9b86dc3f27c298e0dff8f34f19ca9b84b8"
            },
            {
              "date": "2026-02-09",
              "summary": "Ten further implementation upgrades between 2026-02-04 and 2026-02-09 (blocks 24380499 to 24420355); the last set 0xb801…eaea.",
              "url": "https://eth.blockscout.com/tx/0xd6ada552f161ab0226bf1a882483e884025c2422811a2b179528d3f8bf646c3e"
            },
            {
              "date": "2026-02-23",
              "summary": "Pool upgraded to the current implementation 0x4E50…0e91 (tx 0x27b938d9…fae0); no upgrade since.",
              "url": "https://eth.blockscout.com/tx/0x27b938d91dfd7b45eada7dd26911dcc45ae1e1b66d3d593396ac20f1271ffae0"
            },
            {
              "date": "2026-10-01",
              "summary": "Terms of Use and Privacy Policy take effect; the roadmap's Ethereum mainnet launch date.",
              "url": "https://app.nullmask.io/terms"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://eth.blockscout.com/address/0x88888888Eb71E1D68aD0C471C6893EdEEa00B026",
              "address": "0x88888888Eb71E1D68aD0C471C6893EdEEa00B026",
              "chain_id": 1,
              "block_number": 24520325,
              "detail": "Twelve EIP-1967 Upgraded logs on the proxy from block 24378139 to latest, at blocks 24378140, 24380499, 24385676, 24388785, 24389720, 24398907, 24398912, 24398997, 24401824, 24419542, 24420355 and 24520325; the last names 0x4E50…0e91, which the implementation slot still holds (S1).",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://eth.blockscout.com/api?module=logs&action=getLogs&fromBlock=24378139&toBlock=latest&address=0x88888888Eb71E1D68aD0C471C6893EdEEa00B026&topic0=0xbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b\""
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/project-roadmap.md",
              "detail": "Roadmap, phase 1 Ethereum mainnet launch.",
              "checked_at": "2026-10-09",
              "quote": "**ETA: 1st October 2026**",
              "drift": true
            }
          ],
          "note": "Upgrades are made by the controller whose admin is an EOA, with no notice (terms 8.3). Guard or relayer address changes were not traced because the contract is unverified.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "Incumbent-typed rail with no listed settlement contract; the pool is unverified, so its events can only be read against the operator's own docs. Volumes are computed over listed, verified contracts only.",
        "note": "The pool emits a ShieldedWithdrawal log whose topic matches the docs' event signature, with recipient, amount, token and fee in plaintext (30 such logs to 2026-10-09). If the pool is verified and listed, a spec over topic 0xe252471d…45d7 with amount in word 4 and token in word 5 would work.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement in the terms, privacy policy or docs; the operator is unnamed.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "The privacy policy says the servers are in Finland; no hosting provider or certification is named.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "absent",
          "value": "The operator states the pool contracts were not independently audited at the effective date; no review of the servers, relayer or guard is mentioned.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration test of the RPC proxy, relayer, guard or app found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "note": "The docs' code-quality page says CI runs a dependency audit (pnpm audit) on the private monorepo; no platform scanning cadence is stated.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No patch timelines in the terms, privacy policy or docs; no security.txt or disclosure page found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "The privacy policy says a breach could expose account keys and history but makes no notification commitment; the terms promise in-app notice only for changes to the terms and for a shutdown.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "note": "The docs say per-user state is kept in LMDB on the RPC proxy; no backup or restore statement found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "No recovery plan is published. The terms say only that, if the Services stop, the operator will try to give notice and time to withdraw (8.5); without its servers shielded funds cannot be moved (S4 = 0).",
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "status.nullmask.io does not resolve and no status page or post-mortem is linked from the app or docs.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "No passwords or MFA. Sign-in is a wallet signature, from which the proxy derives an access token; the session cookie ends with the browser but the token stays valid server-side, and the credential saved in the wallet's network settings does not expire.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/security/access-tokens.md",
              "detail": "Access token derivation from the wallet signature and its delivery as cookie or query parameter.",
              "checked_at": "2026-10-09",
              "quote": "Since wallets use deterministic signatures (RFC 6979), the same wallet always produces the same access token.",
              "drift": true
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "Privacy policy section 9 on the wallet network credential.",
              "checked_at": "2026-10-09",
              "quote": "The credential gives read access to your balance and your own operations, and it does not expire.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "note": "The privacy policy says server access is restricted to authorised personnel; no MFA or separate-account statement. The pool's upgrade authority is a single EOA (S2).",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "evidenced",
          "value": "The browser session cookie lasts until the browser closes, but the token behind it stays valid on the servers and the wallet-saved credential never expires; no idle timeout is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "Privacy policy section 9, session cookie row.",
              "checked_at": "2026-10-09",
              "quote": "The token is created from your wallet's signature and stays valid on our servers after the cookie is gone.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "A static per-wallet access token (16 bytes of keccak over the wallet signature) sent as an HTTP-only cookie or as a query parameter in the wallet's RPC URL; no OAuth, OpenID Connect, SAML or JWT.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/rpc-api-reference/rpc.md",
              "detail": "RPC API overview and authentication.",
              "checked_at": "2026-10-09",
              "quote": "The proxy uses an **access token** to identify users and isolate their private data",
              "drift": true
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "note": "No server-to-server or partner API is documented; the roadmap lists an SDK for Q4 2026.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "Access tokens do not expire; the same wallet always yields the same token.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "Privacy policy section 9.",
              "checked_at": "2026-10-09",
              "quote": "The credential gives read access to your balance and your own operations, and it does not expire.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "note": "No export function or limits documented; the privacy policy offers data in a portable format on request.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Encryption in transit and access restricted to authorised personnel; servers in Finland. Observed: app.nullmask.io refuses TLS 1.1 and accepts TLS 1.2. No data classification or encryption at rest is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "Privacy policy section 11.",
              "checked_at": "2026-10-09",
              "quote": "Connections to the Services are encrypted in transit.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://app.nullmask.io",
              "detail": "openssl s_client -tls1_1 to app.nullmask.io:443 failed with alert protocol version; -tls1_2 negotiated ECDHE-ECDSA-CHACHA20-POLY1305. Run 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect app.nullmask.io:443 -servername app.nullmask.io -tls1_1; echo | openssl s_client -connect app.nullmask.io:443 -servername app.nullmask.io -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Account keys and private activity while the user uses the Services or until deletion is requested; deposit and screening records and the blocklist 5 years; recipient checks 24 hours; rate-limit IPs up to a day in memory; error logs 90 days; messages 12 months; website analytics 14 months. Screening records may be kept after a deletion request.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "Privacy policy section 10, retention table.",
              "checked_at": "2026-10-09",
              "quote": "Deposit and screening records, and the list of blocked addresses: 5 years after the deposit or check"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The unnamed operator is the controller; processors are listed by type (hosting, node, analytics, data and error-monitoring providers) but not by name. No DPIA is mentioned.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "Privacy policy section 1.",
              "checked_at": "2026-10-09",
              "quote": "is the controller of the personal data described here",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No data processing agreement published or offered; the service has no business-customer terms.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "evidenced",
          "value": "Administrative actions on the screening system are recorded; logging of other account or server activity is not described.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "Privacy policy section 11.",
              "checked_at": "2026-10-09",
              "quote": "Administrative actions on the screening system require cryptographic authorisation and are recorded.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "note": "The privacy policy names an unnamed error-monitoring provider; no SIEM or endpoint detection statement.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical and integration views on the hosted docs (system overview, components, data flow, protocol and circuit specs, contract interface and events, RPC API). Infrastructure only in outline (Fastify services on Node.js, LMDB state, servers in Finland). Not versioned in a public repository.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.nullmask.io/architecture/components.md",
              "detail": "Components page (wallet, RPC proxy, relayer, guard, contract) and linked architecture and backend-services pages.",
              "checked_at": "2026-10-09",
              "quote": "Nullmask consists of four main components that work together to provide privacy-preserving transactions.",
              "drift": true
            }
          ],
          "refs": [
            {
              "criterion": "O4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "attested",
          "value": "Unnamed operator; legal details on written request to legal@nullmask.io. English law, LCIA arbitration seated in London.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-ops-terms.txt",
              "detail": "Terms 1.1 and 19.3.",
              "checked_at": "2026-10-09",
              "quote": "We will give the Operator's full legal details to any person who needs them to bring or answer a legal claim",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "User fees - a protocol fee of up to 1% on deposits and withdrawals and a network and service fee set above relayer gas to cover the cost of running the Services. No treasury, token or funding statement beyond that.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-ops-terms.txt",
              "detail": "Terms 7.1 and 7.3.",
              "checked_at": "2026-10-09",
              "quote": "It covers the network gas our relayer pays and our cost of running the Services.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The roadmap mentions a MASK token on Solana; the terms say it gives no claim on fees. Not treated as funding.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "The operator may end access at any time without notice; assets stay recorded in the pool and withdrawals to addresses passing screening are not refused for that reason alone, but they still run through the operator's servers. On a shutdown it will try to give notice and time to withdraw.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/terms",
              "archive": "data/archive/nullmask-ops-terms.txt",
              "detail": "Terms 18.2, 18.3 and 8.5.",
              "checked_at": "2026-10-09",
              "quote": "We may restrict or end your access to the Services at any time and without notice.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Automated screening of depositing, connected and recipient addresses decides whether deposits are credited and withdrawals sent, using sanctions lists, chain data and an unnamed analytics vendor; some cases go to a person. Whether AI or a learned model is used is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "Privacy policy section 13, automated decisions.",
              "checked_at": "2026-10-09",
              "quote": "Screening decisions are made automatically from address risk data and the public history of the address.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C4",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "A person reviews a screening decision on request by email, with no response time; no monitoring, validation, decommissioning or bias evaluation is documented.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://app.nullmask.io/privacy",
              "archive": "data/archive/nullmask-ops-privacy.txt",
              "detail": "Privacy policy section 13.",
              "checked_at": "2026-10-09",
              "quote": "A person will consider the request.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "notes": "Incumbent-typed (no verified contract, no public repository needed to run it), but its pool settles on Ethereum, so first deployment and changes are read from chain logs. Every operator and custodial control applies. Terms and privacy policy are client-rendered; the excerpts read in a browser are archived under data/archive/nullmask-ops-*.txt. No transactions, sign-ins or form submissions."
    },
    "oobit-card": {
      "slug": "oobit-card",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found on oobit.com (legal hub, terms, card terms, privacy notice, GDPR page, about; /security returns 404) or in the 82 help articles at support.oobit.com. docs.oobit.com returned a bot challenge and was not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "Same search as B1.1; the privacy notice names \"cloud storage\" processors by category only.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE 3402 statement found in the same search.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No independent code review report found; CROPS S6 is unknown for this provider.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or attestation found. oobit.com/.well-known/security.txt lists a bug bounty mailbox (bugbounty@oobit.com) and expired on 2026-06-05; no programme terms or scope were found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No customer incident-notification commitment found. The GDPR page describes the regulation's 72-hour breach notice as a user right, not as an Oobit commitment; the privacy notice says Oobit cannot guarantee absolute security.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "A status page exists (status.oobit.com, Atlassian Statuspage) but appears unmaintained: its components list Tap Payments, Pay Friends and per-coin deposits and withdrawals, with no card or ATM component, and its incident API returns a single 2022-06-30 maintenance entry. No post-mortems found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.oobit.com",
              "detail": "Oobit status page, all systems operational on 2026-10-09.",
              "checked_at": "2026-10-09",
              "quote": "follow the operational status of our platform",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://status.oobit.com/api/v2/incidents.json",
              "detail": "The incidents API returned 1 incident (2022-06-30, Ethereum network upgrade maintenance) and no text mentioning a postmortem on 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://status.oobit.com/api/v2/incidents.json | grep -o '\"created_at\":\"[^\"]*\"'"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Personal accounts sign in with a password or Apple/Google sign-in; revealing card details or the PIN needs Face ID or fingerprint. No second factor for personal login is described. Oobit Business gives every team member a login with two-factor authentication.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.oobit.com/en/articles/17324782-how-do-i-see-my-card-details-or-pin-or-lock-my-card",
              "detail": "Help article on card details, PIN and lock (biometric confirmation).",
              "checked_at": "2026-10-09",
              "quote": "tap to reveal your card details or PIN",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.oobit.com/en/articles/15684487-oobit-business-compliance-and-how-it-s-different",
              "detail": "Help article on Oobit Business verification and logins.",
              "checked_at": "2026-10-09",
              "quote": "Every team member also has their own login with two-factor authentication",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "note": "Card number, CVV and PIN are shown in a secure session \"for a short time only\" (help article 15262452); no app idle-session timeout is stated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "The Partner API and Plug & Pay SDK docs (docs.oobit.com) returned a bot challenge and were not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "For Agent Payments on Oobit Business (beta), each agent authenticates with its own API key (prefix oobit_mcp_), one active key per agent, revocable and replaceable at any time, under a spending policy (defaults 500 USD per transaction and 2,000 USD per day). Partner API authentication not read (docs bot-protected).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.oobit.com/en/articles/17253226-what-are-agent-payments",
              "detail": "Help article on Agent Payments.",
              "checked_at": "2026-10-09",
              "quote": "Each agent signs in with an API key (starting with oobit_mcp_), not a login",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "note": "The account-deletion article tells users to export their transaction history first; no API export limits or export logging found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "The privacy notice promises reasonable technical, administrative and organisational measures without naming encryption or a data classification. Observed: www.oobit.com still accepts TLS 1.1 (and TLS 1.2), below the partner's TLS 1.2 floor.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/privacy-notice",
              "detail": "Privacy Notice (last updated 8 September 2025), section on protecting personal data.",
              "checked_at": "2026-10-09",
              "quote": "adopt all reasonable technical, administrative, and organizational measures",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://www.oobit.com",
              "detail": "openssl s_client -tls1_1 to www.oobit.com:443 negotiated ECDHE-RSA-AES128-SHA; -tls1_2 negotiated ECDHE-ECDSA-CHACHA20-POLY1305. Run 2026-10-09 with LibreSSL 3.3.6.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect www.oobit.com:443 -servername www.oobit.com -tls1_1"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "On deletion, personal data is deleted except identity verification records and transaction history, kept for 7 years for AML and financial regulation. The privacy notice gives no periods (retention \"for the time necessary\"). See CROPS P2 for what is collected.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.oobit.com/en/articles/17423931-how-do-i-delete-my-oobit-account",
              "detail": "Help article on account deletion, section on what happens to data.",
              "checked_at": "2026-10-09",
              "quote": "which we keep for 7 years to meet anti-money laundering and financial regulations",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The current Privacy Notice is issued by Oobit Tecnologia LTDA (Brazil, CNPJ 61.020.917/0001-42) under the LGPD and GDPR, with processors named by category only and data transferred to a group headquartered in Singapore. The GDPR page says a Data Protection Officer was appointed. No DPIA statement and no controller for non-Brazilian users is named.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/privacy-notice",
              "detail": "Privacy Notice opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "CNPJ 61.020.917/0001-42, headquartered at Avenida Paulista",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/gdpr",
              "detail": "GDPR page listing compliance steps.",
              "checked_at": "2026-10-09",
              "quote": "Appoint a Data Protection Officer - COMPLETE",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "attested",
          "value": "The GDPR page says Oobit rewrote its Data Protection Agreement; no DPA is published and no request route is given.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/gdpr",
              "detail": "GDPR page, compliance checklist.",
              "checked_at": "2026-10-09",
              "quote": "Rewrite our Data Protection Agreement - COMPLETE",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "note": "See B6.1 for the observed TLS 1.1 acceptance on www.oobit.com; no hosting or hardening statement found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "unknown",
          "note": "No architecture documentation found on oobit.com or the help centre; docs.oobit.com (partner integration docs) was bot-protected and not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Split across entities. The card terms are with Oobit Technologies UAB (Lithuania, company code 306074900, registered 2022-05-06) and the issuer Third National (Rain programme per the help centre). The Terms of Use link now resolves to the Brazilian terms with Oobit Tecnologia LTDA (CNPJ 61.020.917/0001-42), which also issues the Privacy Notice. US crypto services run through Bakkt Financial Solutions I, LLC.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/card-terms",
              "detail": "Oobit Spend Card Terms (effective 1 August 2025), opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "access to which is provided to you by Oobit Technologies UAB",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://get.data.gov.lt/datasets/gov/rc/jar/iregistruoti/JuridinisAsmuo/:format/json?ja_pavadinimas.contains(%22Oobit%22)&limit(5)",
              "detail": "Lithuanian Register of Legal Entities open data (Registrų centras via data.gov.lt); Oobit Technologies UAB, code 306074900, registered 2022-05-06, no deregistration date.",
              "checked_at": "2026-10-09",
              "quote": "\"ja_kodas\":306074900,\"ja_pavadinimas\":\"Oobit Technologies UAB\""
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/brazil-terms-of-use",
              "detail": "Terms of Use (last updated 28 December 2025); www.oobit.com/legal/terms-of-use 301-redirects here on 2026-10-09.",
              "checked_at": "2026-10-09",
              "quote": "Oobit Tecnologia LTDA, CNPJ 61.020.917/0001-42",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Transaction fees (1% on card purchases, 2.5% on ATM, 0.95% to 3% on swaps, transfer fees) fund the service; Oobit describes itself as Tether-backed. No financial statements found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.oobit.com/en/articles/15262354-what-fees-does-oobit-charge",
              "detail": "Help article listing Oobit fees.",
              "checked_at": "2026-10-09",
              "quote": "Card purchase 1%, minimum $0.25",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Oobit and the issuer may suspend, revoke or cancel the card at any time with or without cause or notice (card terms s9); Oobit may terminate all or part of the Services without prior notice (Terms of Use s14.1). Users may close the account in the app; crypto must be withdrawn first and cashback or rewards cannot be withdrawn. On closure Oobit confirms any balance due and sends it (s14.10). The card is cancelled automatically after 90 days without purchases.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/card-terms",
              "detail": "Oobit Spend Card Terms s9 Termination.",
              "checked_at": "2026-10-09",
              "quote": "in our sole discretion at any time, with or without cause and with or without giving you notice",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/brazil-terms-of-use",
              "detail": "Terms of Use s14.1 Termination and Suspension Rights of Oobit.",
              "checked_at": "2026-10-09",
              "quote": "without prior notice, including for any regulatory or legal reasons",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.oobit.com/en/articles/17423931-how-do-i-delete-my-oobit-account",
              "detail": "Help article on account deletion.",
              "checked_at": "2026-10-09",
              "quote": "Move any crypto in your Oobit account to an external wallet or exchange before you close it",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "AI agents can initiate payments: Agent Payments let AI assistants (via MCP) and automated systems pay with scoped Oobit cards under user-set limits. No statement found on automated or AI-based compliance or fraud decisions; the privacy notice lists fraud prevention processors by category only.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.oobit.com/en/articles/17253226-what-are-agent-payments",
              "detail": "Help article on Agent Payments.",
              "checked_at": "2026-10-09",
              "quote": "You can revoke a key and create a new one whenever you need to",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "For Agent Payments only spending controls are documented (per-agent scoped cards with spending and transaction-count limits that expire, revocable keys, merchant allow and block lists, policy checks before the card network). No monitoring, validation, bias or decommissioning documentation for any AI system found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://support.oobit.com/en/articles/17253226-what-are-agent-payments",
              "detail": "Help article on Agent Payments, spending policy section.",
              "checked_at": "2026-10-09",
              "quote": "Payments that break the policy are declined before they reach the card network",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "1% per card purchase, minimum 0.25 USD (Brazil 1%, no minimum)",
            "basis": "Help article 15262354 and Oobit Spend Card Terms (effective 1 August 2025); fees may change on 30 days' notice (card terms s6).",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Foreign exchange fee up to 1.5% on non-USD purchases",
            "basis": "Oobit Spend Card Terms, Important Disclosures and s6.2; Brazil local card adds IOF tax and FX.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM 2.5%, minimum 0.25 USD, plus any ATM operator charge",
            "basis": "Help article 17253225.",
            "evidence_index": 2
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Send Crypto to a bank account varies by currency (Unblock fee and FX margin), shown before sending",
            "basis": "Help article 15262354; no figure published.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Swap 0.95% (3% when receiving OOB); crypto withdrawal flat network fee shown before confirming",
            "basis": "Help article 15262354.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Returned payment fee 29 USD",
            "basis": "Oobit Spend Card Terms s6.1(b).",
            "evidence_index": 1
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Card 1 to 2,000 USD per purchase, 10,000 USD per 24 hours; ATM 250 USD per withdrawal, 3 attempts per 24 hours",
            "basis": "Help article 15262360; limits may change.",
            "evidence_index": 3
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.oobit.com/en/articles/15262354-what-fees-does-oobit-charge",
            "detail": "Help article \"What fees does Oobit charge?\".",
            "checked_at": "2026-10-09",
            "quote": "Card purchase 1%, minimum $0.25",
            "confirmed_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.oobit.com/legal/card-terms",
            "detail": "Oobit Spend Card Terms, Important Disclosures.",
            "checked_at": "2026-10-09",
            "quote": "Foreign Exchange Fee (non USD): up to 1.5%",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.oobit.com/en/articles/17253225-how-do-i-withdraw-cash-at-an-atm-with-my-oobit-card",
            "detail": "Help article on ATM withdrawals.",
            "checked_at": "2026-10-09",
            "quote": "Oobit charges 2.5% of the amount you withdraw, minimum $0.25",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.oobit.com/en/articles/15262360-what-are-oobit-s-limits",
            "detail": "Help article on limits.",
            "checked_at": "2026-10-09",
            "quote": "$1 to $2,000 per purchase. Up to $10,000 in any 24 hours",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Deposits by bank transfer carry a conversion partner fee of about 0.65% (minimum 0.50 USD); Pix send 1% and receive 0.3% in Brazil; card purchases of crypto via Transak carry Transak's fees. Network gas for DePay/WalletConnect funding is not described as a user fee. Cashback is a reward, not recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "Card purchases are funded by default from the Oobit balance, which Oobit holds on a custodial basis (Terms of Use s7.19). An optional WalletConnect/DePay mode funds purchases from the user's own wallet under a spending approval, so funds stay there until each purchase; that mode is rolling out gradually and does not change the S1 finding.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "attested",
        "value": [
          {
            "entity": "Third National (issuer per card terms); Rain (card issuer per help centre)",
            "holder": "partner",
            "country": "US",
            "regulator": "not stated",
            "type": "Card issuer under licence from Visa",
            "activities": "Issues the Oobit Visa card (credit secured by collateral, per the help centre)",
            "evidence_index": 0
          },
          {
            "entity": "POMELO INSTITUIÇÃO DE PAGAMENTO LTDA.",
            "holder": "partner",
            "country": "BR",
            "regulator": "Banco Central do Brasil",
            "type": "Payment institution (as stated in Oobit's Terms of Use)",
            "number": "CNPJ 44.128.548/0001-97",
            "activities": "Banking-as-a-service and local card issuing in Brazil",
            "evidence_index": 1
          },
          {
            "entity": "Bakkt Financial Solutions I, LLC",
            "holder": "partner",
            "country": "US",
            "regulator": "FinCEN",
            "type": "Money Services Business registration and state money transmitter licences (as stated by Oobit)",
            "activities": "US cryptocurrency services",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.oobit.com/legal/card-terms",
            "detail": "Card terms naming the issuer; the help centre (article 17324780) says the card is issued by Rain, a Visa Principal Member.",
            "checked_at": "2026-10-09",
            "quote": "The issuer for this card program is ThirdNational",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.oobit.com/legal/brazil-terms-of-use",
            "detail": "Terms of Use s6.4 naming the Brazilian regulated partner.",
            "checked_at": "2026-10-09",
            "quote": "a financial institution supervised by the Central Bank of Brazil (BCB), registered under CNPJ No. 44.128.548/0001-97",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.oobit.com/about",
            "detail": "Site footer disclosure.",
            "checked_at": "2026-10-09",
            "quote": "US Cryptocurrency services are provided in partnership with Bakkt Financial Solutions I, LLC",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "All licences rest on Oobit's own pages; none was confirmed in a register. Not found: any licence held by an Oobit entity (Oobit Technologies UAB is not in ESMA's interim MiCA CASP register or its non-compliant list); an active FDIC-insured institution named Third National (FDIC BankFind search, 2026-10-09); a regulator for Rain. The Banco Central do Brasil open-data API returned errors, so Pomelo was not checked; FinCEN's MSB search is interactive and was not used.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Third National / Rain (issuer), Visa; Pomelo for the Brazil local card",
            "fee": "1% (min 0.25 USD); FX up to 1.5%",
            "limits": "Virtual card only; 1 to 2,000 USD per purchase, 10,000 USD per 24 hours.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Third National / Rain (issuer), Visa",
            "fee": "2.5% (min 0.25 USD) plus operator charge",
            "limits": "Contactless (NFC) ATMs only, via Apple Pay or Google Wallet; 250 USD per withdrawal including operator charge; 3 attempts per 24 hours.",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Unblock",
            "fee": "Varies by currency, shown before sending",
            "limits": "Payouts in EUR, GBP, USD, BRL, MXN, PHP, TRY, INR, IDR, ARS and NGN; USD only for US residents; 1 to 2 business days.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.oobit.com/en/articles/15262360-what-are-oobit-s-limits",
            "detail": "Help article on limits.",
            "checked_at": "2026-10-09",
            "quote": "$1 to $2,000 per purchase. Up to $10,000 in any 24 hours",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.oobit.com/en/articles/17253225-how-do-i-withdraw-cash-at-an-atm-with-my-oobit-card",
            "detail": "Help article on ATM withdrawals.",
            "checked_at": "2026-10-09",
            "quote": "Up to $250 per withdrawal",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://support.oobit.com/en/articles/15262362-how-do-i-send-money-to-a-bank-account-with-send-crypto",
            "detail": "Help article on Send Crypto to a bank account.",
            "checked_at": "2026-10-09",
            "quote": "Currencies include EUR, GBP, USD, BRL, MXN, PHP, TRY, INR, IDR, ARS and NGN",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ALL means every country in the provider file's availability list (73 countries where the Oobit Visa card is marked available). The help centre's country table also marks transfers per country, which is not reflected row by row here. Brazil also has Pix send and receive (partner Avenia, launched 2026-06-23). The SWIFT USD payout announced on 2026-07-15 extends bank payouts to about 200 countries (provider statement).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2019-01-01",
            "what": "Oobit service launch; Oobit gives the year only, the day and month are a placeholder."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/about",
              "detail": "Oobit about page.",
              "checked_at": "2026-10-09",
              "quote": "Oobit was launched in 2019",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No dated launch announcement of the Visa card was found; the current Oobit Spend Card Terms took effect on 2025-08-01 (see changes).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Oobit Technologies UAB",
            "jurisdiction": "LT",
            "register_url": "https://get.data.gov.lt/datasets/gov/rc/jar/iregistruoti/JuridinisAsmuo/:format/json?ja_pavadinimas.contains(%22Oobit%22)&limit(5)",
            "registration_number": "306074900"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://get.data.gov.lt/datasets/gov/rc/jar/iregistruoti/JuridinisAsmuo/:format/json?ja_pavadinimas.contains(%22Oobit%22)&limit(5)",
              "detail": "Lithuanian Register of Legal Entities open data, registered 2022-05-06.",
              "checked_at": "2026-10-09",
              "quote": "\"ja_kodas\":306074900,\"ja_pavadinimas\":\"Oobit Technologies UAB\""
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/card-terms",
              "detail": "Card terms naming the Oobit party.",
              "checked_at": "2026-10-09",
              "quote": "access to which is provided to you by Oobit Technologies UAB",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Recorded as the card-contracting entity. The Terms of Use and Privacy Notice now name Oobit Tecnologia LTDA (Brazil), and the privacy notice says the group is headquartered in Singapore (entity not named); see B11.1.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "The status page incident history holds one 2022 maintenance entry and is not maintained for the card (B3.4); no incident or breach notice found on oobit.com news, the legal pages or the help centre. Searched 2026-10-09.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2022-05-06",
              "summary": "Oobit Technologies UAB registered in Lithuania (company code 306074900).",
              "url": "https://get.data.gov.lt/datasets/gov/rc/jar/iregistruoti/JuridinisAsmuo/:format/json?ja_pavadinimas.contains(%22Oobit%22)&limit(5)"
            },
            {
              "date": "2025-08-01",
              "summary": "Oobit Spend Card Terms take effect (issuer Third National; 1% transaction fee, FX up to 1.5%).",
              "url": "https://www.oobit.com/legal/card-terms"
            },
            {
              "date": "2025-09-08",
              "summary": "Privacy Notice updated, issued by Oobit Tecnologia LTDA (Brazil).",
              "url": "https://www.oobit.com/legal/privacy-notice"
            },
            {
              "date": "2025-12-28",
              "summary": "Terms of Use with Oobit Tecnologia LTDA last updated; the generic Terms of Use link now redirects to them.",
              "url": "https://www.oobit.com/legal/brazil-terms-of-use"
            },
            {
              "date": "2026-06-23",
              "summary": "Native Pix send and deposit launched in Brazil.",
              "url": "https://www.oobit.com/news/crypto-comes-to-pix-oobit-connects-the-digital-dollar-to-170-million-brazilians"
            },
            {
              "date": "2026-07-15",
              "summary": "Bank off-ramp extended to USD payouts via SWIFT, powered by Unblock.",
              "url": "https://www.oobit.com/news/oobit-extends-crypto-off-ramp-to-usd-via-swift-unlocking-global-bank-withdrawals"
            },
            {
              "date": "2026-07-30",
              "summary": "Contactless ATM cash withdrawals launched with the virtual card.",
              "url": "https://www.oobit.com/news/tether-backed-oobit-launches-global-atm-cash-withdrawals-eliminating-the-last-barrier-between-crypto-and-physical-money"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/legal/card-terms",
              "detail": "Card terms effective date.",
              "checked_at": "2026-10-09",
              "quote": "Effective as of August 1 st , 2025",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/news/tether-backed-oobit-launches-global-atm-cash-withdrawals-eliminating-the-last-barrier-between-crypto-and-physical-money",
              "detail": "Oobit news post dated 30 July 2026.",
              "checked_at": "2026-10-09",
              "quote": "has launched contactless crypto ATM cash withdrawals",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.oobit.com/news/oobit-extends-crypto-off-ramp-to-usd-via-swift-unlocking-global-bank-withdrawals",
              "detail": "Oobit news post dated 15 July 2026.",
              "checked_at": "2026-10-09",
              "quote": "adding support for USD payouts via SWIFT international wire",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "No listed contracts; the DePay spender and any Rain collateral contracts were not identified (provider file notes), and the custodial balance and card settlement run on Oobit's and the issuer's closed ledgers. Oobit's own volume claims (news, 18 August 2026) are provider-reported and not stored.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "payy-card": {
      "slug": "payy-card",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/contents/?ref=main",
              "detail": "polybase/payy: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": true,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/contents/?ref=main",
              "detail": "polybase/payy: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/contents/?ref=main",
              "detail": "polybase/payy: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, creation, update, required_linear_history, copilot_code_review, code_quality, pull_request, required_status_checks"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/rules/branches/main",
              "detail": "polybase/payy: rules: deletion, non_fast_forward, creation, update, required_linear_history, copilot_code_review, code_quality, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": true,
                "detail": "2 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/contents/?ref=main",
              "detail": "polybase/payy: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/contents/?ref=main",
              "detail": "polybase/payy: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/contents/?ref=main",
              "detail": "polybase/payy: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": false,
                "detail": "latest tags: zk-circuits-v1.1.12, beam-v0.3.0, beam-v0.2.4"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/tags",
              "detail": "polybase/payy: latest tags: zk-circuits-v1.1.12, beam-v0.3.0, beam-v0.2.4",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/commits?per_page=10",
              "detail": "polybase/payy: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": true,
                "detail": "9 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/contents/?ref=main",
              "detail": "polybase/payy: 9 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "polybase/payy",
                "ok": true,
                "detail": "contribution section in README"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/polybase/payy/contents/?ref=main",
              "detail": "polybase/payy: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement for Zeplo, Inc. (Payy) found in docs.payy.network (llms.txt index, card page, FAQ), payy.link, the Terms of Service or the Privacy Policy.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No hosting or support organisation certification found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "attested",
          "value": "Payy says the important parts of its code have been audited; no report, auditor or date is published (CROPS S6 unknown).",
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://docs.payy.network/payy-wallet/payy-wallet-faq",
              "detail": "Payy Wallet FAQ, \"Is Payy safe to use?\".",
              "checked_at": "2026-10-09",
              "quote": "code have been audited",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or attestation found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "The Terms of Service and Privacy Policy contain no security or data-incident notification commitment; the policy promises notice only of material policy changes.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page or post-mortem found on payy.link or docs.payy.network.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "No login, username, email or password; the wallet key is generated and stored on the device, with optional cloud backup and a recovery phrase. There is no account-level MFA.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.payy.network/payy-wallet/payy-wallet-faq",
              "detail": "Payy Wallet FAQ, \"Why is there no login, email or passwords in Payy?\".",
              "checked_at": "2026-10-09",
              "quote": "we do not have any login/username/email/password requirements in Payy",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Users can delete their account in the app; no retention period is stated, and Payy stores the network public key address but not the private key.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://payy.link/privacy",
              "detail": "Privacy Policy (last updated 6 May 2024), \"How you can access or change your information\".",
              "checked_at": "2026-10-09",
              "quote": "You may delete your Payy account at any time.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "note": "Card KYC data is collected for the card programme (CROPS P2); its retention by Rain or the issuer is governed by Rain's privacy policy, not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The Privacy Policy is issued by Zeplo, Inc. for Payy and refers card data to Rain's privacy policy; it does not name controller and processor roles or mention a DPIA.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://payy.link/privacy",
              "detail": "Privacy Policy opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "Payy by Zeplo, Inc. is a software service",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "docs.payy.network publishes a privacy architecture (privacy layer, PrivacyBridge, privacy vault) for the Payy Network EVM L2, which the CROPS seed excluded as not live for the card. The live Ethereum rollup v1 and the card path (wallet, guild backend, Rain) have no architecture document.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.payy.network/privacy/privacy-architecture",
              "detail": "Privacy Architecture page with component diagram.",
              "checked_at": "2026-10-09",
              "quote": "The Payy Privacy architecture is composed of the following components",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Zeplo, Inc. d/b/a Payy (registration number 6772334 stated on payy.link; office at 169 Madison Avenue, New York; terms performed in Delaware). The card is issued by Rain through issuing partners; Rain's issuing bank is not named.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.google.com/document/d/14W43Qk_y64clQCVtpc2DNZl12vWPW0lejO9Kr2R1eys/edit?usp=sharing",
              "archive": "data/archive/payy-card-terms.txt",
              "detail": "Terms of Service opening paragraph and section 14.1.",
              "checked_at": "2026-10-09",
              "quote": "ZEPLO, INC. d/b/a PAYY",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://payy.link/privacy",
              "detail": "payy.link footer with company number and address.",
              "checked_at": "2026-10-09",
              "quote": "Zeplo Inc. (6772334), 169 Madison Avenue",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The Delaware register search is behind a CAPTCHA and was not used.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Payy may terminate access immediately and without notice for non-compliance \"or for any reason\"; card use can be restricted, suspended or terminated with immediate effect, with notice and reasons unless unlawful. No statement on funds on termination beyond user control of the wallet; withdrawals depend on Payy's prover (CROPS S4 = 0).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.google.com/document/d/14W43Qk_y64clQCVtpc2DNZl12vWPW0lejO9Kr2R1eys/edit?usp=sharing",
              "archive": "data/archive/payy-card-terms.txt",
              "detail": "Terms of Service section 16 and section 2.6.22.",
              "checked_at": "2026-10-09",
              "quote": "will terminate immediately and automatically without notice from Payy",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "none",
            "amount": "No application, transaction, top-up or monthly fees",
            "basis": "Payy Card docs feature table; the Terms let Payy change fees at any time without notice.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Visa rate plus 1% bank fee on non-USD purchases",
            "basis": "Payy Card docs usage notes (set bank fee to 1% in the Visa calculator).",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "No transaction fee for the USDC-to-fiat conversion, but a spread may be included",
            "basis": "Terms of Service section 2.6.18; the referenced Pricing and Fees Disclosures were not found.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.payy.network/payy-wallet/payy-card",
            "detail": "Payy Card docs, Features table and usage notes.",
            "checked_at": "2026-10-09",
            "quote": "No transaction or top-up fees",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.google.com/document/d/14W43Qk_y64clQCVtpc2DNZl12vWPW0lejO9Kr2R1eys/edit?usp=sharing",
            "archive": "data/archive/payy-card-terms.txt",
            "detail": "Terms of Service section 2.6.18 Fees and Charges.",
            "checked_at": "2026-10-09",
            "quote": "Payy will not charge transaction  fees but may include a spread",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The ATM fee (private beta) and any physical-card fee are not stated; the Light Up physical card is sold out.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S4",
            "index": 0
          }
        ],
        "note": "Judgment call. Payy says it is non-custodial and the note keys sit on the user's device, but the S1 finding (score 0) shows funds at rest in an upgradeable rollup escrow whose owner Safe can overwrite the state root, and S4 (score 0) shows every withdrawal needs Payy's prover. Unlike Exa and MetaMask Card, the provider controls the funds at rest, not only a spend path, so provider_custodial; a reviewer may prefer hybrid.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "unknown",
        "note": "The Terms say cards are issued by Rain through issuing partners licensed in their jurisdictions; the card docs say only \"U.S.-based\" issuer. No issuer name, regulator or licence number is given in any first-party document, so no register could be checked. payy.link states Payy is not a regulated bank.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_withdrawal",
            "partner": "Rain and a U.S.-based issuer, Visa",
            "fee": "none from Payy; Visa rate plus 1% on non-USD",
            "limits": "Card spend at merchants (the schema has no card-spend value); spending limited to the wallet balance; some foreign online merchants reject U.S.-issued cards.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Rain and a U.S.-based issuer, Visa",
            "fee": "not stated",
            "limits": "Contactless ATM withdrawals in private beta, on request to support.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.payy.network/payy-wallet/payy-card",
            "detail": "Payy Card docs, Features table (ATM access) and usage notes.",
            "checked_at": "2026-10-09",
            "quote": "Contactless ATM withdrawals are supported",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No bank withdrawal is documented; bank deposits are offered from the U.S. and Argentina only. Payy publishes no country list (no availability block), so ALL here means wherever the card is issued.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-02-17",
            "block": 24475975,
            "what": "RollupV1 proxy 0x367C1eAF14AA06b78ce76bd0243297de79d85270 on Ethereum (current settlement escrow)"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://etherscan.io/tx/0x8d002955fe594ded0ee57519c15a7c9dcf52e759be1fdd628eaf810dc2558abd",
              "address": "0x367C1eAF14AA06b78ce76bd0243297de79d85270",
              "block_number": 24475975,
              "detail": "Creation tx 0x8d002955...8abd from 0x6B96F1A8D65eDe8AD688716078B3DD79f9BD7323 at block 24475975 (2026-02-17 10:32:35 UTC, Blockscout); eth_getCode returns 0x at block 24475974 and runtime code at 24475975 (read via eth.drpc.org, since publicnode refuses archive reads).",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0x367C1eAF14AA06b78ce76bd0243297de79d85270 --block 24475974 --rpc-url https://eth.drpc.org; cast codesize 0x367C1eAF14AA06b78ce76bd0243297de79d85270 --block 24475975 --rpc-url https://eth.drpc.org"
            }
          ],
          "note": "Dates the Ethereum rollup only. Payy ran earlier on a Polygon rollup (0x4cbb5041..., now empty; the repo documents a Polygon to Ethereum mint migration), which was not dated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Zeplo, Inc. (d/b/a Payy)",
            "jurisdiction": "US",
            "registration_number": "6772334"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.google.com/document/d/14W43Qk_y64clQCVtpc2DNZl12vWPW0lejO9Kr2R1eys/edit?usp=sharing",
              "archive": "data/archive/payy-card-terms.txt",
              "detail": "Terms of Service name Zeplo, Inc. d/b/a Payy as the contracting party.",
              "checked_at": "2026-10-09",
              "quote": "ZEPLO, INC. d/b/a PAYY",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://payy.link/privacy",
              "detail": "payy.link footer gives \"Zeplo Inc. (6772334)\" and a New York office address.",
              "checked_at": "2026-10-09",
              "quote": "Zeplo Inc. (6772334), 169 Madison Avenue",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The number's register is not stated; it has the form of a Delaware file number and the Terms are performed in Delaware, but the Delaware search is CAPTCHA-protected, so the state is not recorded.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident disclosure found on payy.link, docs.payy.network or in polybase/payy (no SECURITY.md or post-mortem at 2f95947). The reverted addProver and mint calls of 30 Sep 2026 noted in the CROPS log changed no state and are not an incident.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-02-17",
              "summary": "RollupV1 deployed on Ethereum; the repo documents a mint migration from the Polygon rollup.",
              "url": "https://etherscan.io/tx/0x8d002955fe594ded0ee57519c15a7c9dcf52e759be1fdd628eaf810dc2558abd"
            },
            {
              "date": "2026-03-25",
              "summary": "MIT LICENSE removed from polybase/payy (commit c4d2c902); RollupV1.sol is UNLICENSED.",
              "url": "https://github.com/polybase/payy/commit/c4d2c9021b8fb9988816eb6987a734b830bfce15"
            }
          ],
          "refs": [
            {
              "criterion": "F2",
              "index": 0
            }
          ],
          "note": "The Polygon to Ethereum migration date is taken from the Ethereum deployment; the repo README gives no date.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "Card debits are private UTXO note transfers inside the Payy rollup; the L1 contract sees only state roots and proofs, so card spends cannot be separated from other transfers or valued from chain data. Payy's funding of Rain happens off this contract.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "phantom-cash": {
      "slug": "phantom-cash",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found for Phantom Technologies, Inc. on phantom.com/security, the Terms of Use, the Privacy Policy or the Cash help-centre section. Bridge, Stripe, Lead Bank and Galileo were not checked.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "Hosting provider and its certification are not named in any Phantom document read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement found on phantom.com/security or in the legal pages.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "Phantom publishes two third-party audit reports for its wallet (Kudelski Security 2021, Least Authority 2024) in github.com/phantom/audit-reports. Both predate Phantom Cash (announced 30 September 2025); no review covering the Cash backend, the Cash account or Bridge's debit-card contract was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/security",
              "detail": "Security page, \"Independently audited\", links to github.com/phantom/audit-reports.",
              "checked_at": "2026-10-09",
              "quote": "Our code has been audited by top software auditing firms",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/phantom/audit-reports/tree/3450f82bc6c633f5d2eceee9a979f98ac1ca3cb3",
              "commit": "3450f82bc6c633f5d2eceee9a979f98ac1ca3cb3",
              "path": ".",
              "detail": "Repository root at this commit holds Kudelski-Security-2021.pdf, Least_Authority-2024.pdf and a README saying it contains all third-party audit reports for Phantom.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/phantom/audit-reports/contents?ref=3450f82bc6c633f5d2eceee9a979f98ac1ca3cb3 --jq '.[].name'"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or letter found. Phantom runs a bug bounty on Cantina (up to 50,000 USD per the security page; security.txt Policy points at phantom.com/bug-bounty), which is not a penetration test.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No patch service levels found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No customer incident-notification commitment found in the Terms of Use, Privacy Policy or Cash help articles.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "The help centre's compromise article tells users to move funds to a new wallet and contact support; no service recovery plan found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Public status page at status.phantom.com (StatusPal) covering the extension, mobile app, backend, website and external dependencies; it has no Cash, card or bank-transfer component and showed no incident history on 2026-10-09. No post-mortems found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.phantom.com",
              "detail": "StatusPal status page; components listed are Browser Extension, Mobile App, Phantom Backend, Phantom Website and external dependencies (Blowfish, CoinGecko, Magic Eden, Solana RPC).",
              "checked_at": "2026-10-09",
              "quote": "Incident & maintenance history",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Sign-in to the Phantom profile (and so the Cash account) is by Google or Apple account, recovery phrase or private key; on mobile the app is protected by device authentication such as Face ID or fingerprint. No separate second factor is described for Cash.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/how-your-wallet-is-secured-49409417837843",
              "detail": "Help article \"How your wallet is secured\", device-level protections.",
              "checked_at": "2026-10-09",
              "quote": "authentication such as Face ID or fingerprint",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "unknown",
          "note": "The Privacy Policy (last updated 7 July 2026) has no security or encryption section; no data classification or TLS statement found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Phantom keeps personal information as long as necessary for the purposes collected; no fixed periods. Phantom says it does not store KYC documents (Link does). Closing the Cash account (by request to support) deletes the virtual account numbers and closes the debit card, but Link's KYC data is not deleted and must be deleted at Link. See CROPS P2 for what is collected.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/privacy",
              "detail": "Privacy Policy (last updated 7 July 2026), US state section and Europe Retention section.",
              "checked_at": "2026-10-09",
              "quote": "We retain personal information for as long as necessary to carry out the purposes for which we originally collected it",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.phantom.com/articles/understanding-what-happens-when-your-cash-account-is-closed-46791622675347",
              "detail": "Help article on Cash account closure.",
              "checked_at": "2026-10-09",
              "quote": "Your Link account and identity verification (KYC) data are not deleted",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Phantom Technologies, Inc. publishes the policy; KYC data is processed by third-party service providers on Phantom's behalf, and Phantom says it may act as data controller for KYC only when sharing it with partners at the user's direction. GDPR lawful bases are listed for European users. No DPIA statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/privacy",
              "detail": "Privacy Policy, information collected directly from you (KYC).",
              "checked_at": "2026-10-09",
              "quote": "we may act as a data controller with respect to your KYC information",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No data processing agreement is published. The Europe section offers access, on request, to the safeguards used for international transfers (possibly redacted).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "unknown",
          "note": "Help pages describe the partner roles (Link KYC, Stripe funding and card, Bridge bank transfers and programme management, Lead Bank issuer, Galileo disputes); no architecture document found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Phantom Technologies, Inc. (Delaware corporation) under the Terms of Use and as Platform Provider for the card; the card agreement is with Lead Bank (Missouri state-chartered bank), with Bridge Ventures LLC (Delaware LLC) as Program Manager. Bank transfers run through Bridge; Stripe handles funding and, per a help article updated in October 2026, now issues replacement cards.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.bridge.xyz/card-agreements/phantom-card",
              "detail": "Lead Bank Prepaid Visa Cardholder Agreement, parties.",
              "checked_at": "2026-10-09",
              "quote": "Phantom Technologies, Inc. , a Delaware Corporation",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/terms",
              "detail": "Terms of Use (last updated 17 March 2026) name Phantom Technologies, Inc. as the contracting party and include Phantom Cash in the Functionality.",
              "checked_at": "2026-10-09",
              "quote": "Last updated: March 17, 2026",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Customer fees (0.85% on most Cash swaps, onramp fees, fast-withdrawal fee; see fees) plus revenue shared by execution partners (searchers, validators, market makers) under the Terms. Phantom is a private company; no financial statements found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/terms",
              "detail": "Terms of Use, Arrangements with Third Parties.",
              "checked_at": "2026-10-09",
              "quote": "Partners may share fees they earn from these arrangements with Phantom",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Phantom may terminate access at any time without notice; the bank may cancel or suspend the card at any time without prior notice except as law requires. On card closure the fiat balance is returned to the Phantom wallet as stablecoin (balances under 1 USD may be withheld). Closing the Cash account is permanent, by request to support; CASH stays in the user's Solana account, and Link KYC data is not deleted.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/terms",
              "detail": "Terms of Use, Termination.",
              "checked_at": "2026-10-09",
              "quote": "in our sole discretion, at any time and without notice to you",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.bridge.xyz/card-agreements/phantom-card",
              "detail": "Lead Bank cardholder agreement, closing the card and amendment and cancellation.",
              "checked_at": "2026-10-09",
              "quote": "any Fiat Currency balance remaining will be returned to your Platform Provider wallet in the form of Stablecoins",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "unknown",
          "note": "The Privacy Policy describes fraud prevention using phone numbers, payment details, merchant location and wallet associations but does not say whether automated or AI systems decide. The Terms' AI Agent sections cover user-run agents, not Phantom's compliance.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "none",
            "amount": "Virtual card issuance free; domestic US purchases free; no fee for loading the card or replacing it",
            "basis": "Cash fees help article and Lead Bank cardholder agreement; the bank may change fees on notice.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "International purchases \"fees may apply\", shown before confirming; no figure published",
            "basis": "Cash fees help article.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "0.85% on swaps out of Cash (except to USDC) and on non-stablecoin swaps into Cash; stablecoin swaps in free",
            "basis": "Cash fees help article; Terms say fees may change without notice and are shown before confirming.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Funding: debit card 1.75%, credit card 3.50% (Stripe, US and EU); ACH deposit 0.30%; domestic wire 1.00%",
            "basis": "Cash fees help article; banks and card partners may add their own fees.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Standard ACH withdrawal free; fast ACH withdrawal 1.00 USD + 0.75% (min 1.50 USD)",
            "basis": "Cash fees help article; US except New York.",
            "evidence_index": 2
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "One-time Solana account setup fee when sending CASH to a wallet that has never held it (varies with SOL price)",
            "basis": "Cash fees help article, described as a network requirement, not a Phantom fee.",
            "evidence_index": 3
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "2,000 USD per card transaction; 2,000 USD per day (up to 5,000 after 30 days); money-transfer merchants 500 USD per week",
            "basis": "Lead Bank cardholder agreement (per-transaction limit) and the debit card help article (daily and weekly limits).",
            "evidence_index": 4
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/cash-fees-44800531617939",
            "detail": "Cash fees help article, Phantom debit card table.",
            "checked_at": "2026-10-09",
            "quote": "Virtual card issuance Free Domestic purchases in the US Free",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/cash-fees-44800531617939",
            "detail": "Cash fees help article, onramps and offramps table.",
            "checked_at": "2026-10-09",
            "quote": "Add cash by debit card, incl. Apple Pay (Stripe, US + EU) 1.75%",
            "confirmed_at": "2026-10-12",
            "drift": true
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/cash-fees-44800531617939",
            "detail": "Cash fees help article, onramps and offramps table.",
            "checked_at": "2026-10-09",
            "quote": "Fast ACH withdrawal (US only) $1.00 flat + 0.75% (min $1.50)",
            "confirmed_at": "2026-10-12",
            "drift": true
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/cash-fees-44800531617939",
            "detail": "Cash fees help article, onchain actions.",
            "checked_at": "2026-10-09",
            "quote": "Solana requires a one-time setup fee for wallets receiving CASH for the first time",
            "confirmed_at": "2026-10-12",
            "drift": true
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.bridge.xyz/card-agreements/phantom-card",
            "detail": "Lead Bank Prepaid Visa Cardholder Agreement, transaction limitations; the help article \"Use your virtual Phantom debit card\" gives the daily and weekly limits.",
            "checked_at": "2026-10-09",
            "quote": "Your maximum per transaction limit will be $2,000.00",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Swap fees of 0.85% also cover swaps from the Cash account into other Solana stablecoins (USDT, USDG, PYUSD). Bridge's spread on the CASH-to-USD conversion at card payment is not stated; the card agreement says Bridge and Phantom conduct the stablecoin sale and refers fee questions to them.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "The user holds the keys to the Cash account, but the CASH mint's permanent delegate (issuer side, Bridge) can move or burn CASH from any holder and a freeze authority can freeze accounts; at payment Bridge draws CASH into its debit-card contract. Agrees with the S1 finding (score 0), which contradicts the FAQ's \"self-custodial\" statement.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "Lead Bank",
            "holder": "partner",
            "country": "US",
            "regulator": "FDIC (primary federal regulator); state charter, Missouri",
            "type": "State-chartered commercial bank, FDIC-insured, non-member (BKCLASS NM)",
            "number": "FDIC certificate 8283",
            "activities": "Issuer of the Phantom debit card (Lead Bank Prepaid Visa); Kansas City, MO; active.",
            "register_url": "https://banks.data.fdic.gov/bankfind-suite/bankfind/details/8283",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://api.fdic.gov/banks/institutions?filters=CERT:8283&fields=NAME,CERT,CITY,STNAME,REGAGNT,ACTIVE,BKCLASS,CHRTAGNT,ESTYMD,FED_RSSD&limit=1",
            "archive": "data/archive/phantom-cash-ops-fdic-lead-bank.txt",
            "detail": "FDIC BankFind API record for certificate 8283, Lead Bank, Kansas City, Missouri; active, state charter, regulator FDIC, class NM.",
            "checked_at": "2026-10-09",
            "quote": "\"NAME\":\"Lead Bank\"",
            "recheck": "curl -s 'https://api.fdic.gov/banks/institutions?filters=CERT:8283&fields=NAME,ACTIVE,REGAGNT,BKCLASS'",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.bridge.xyz/card-agreements/phantom-card",
            "detail": "The cardholder agreement names Lead Bank, a Missouri state-chartered bank, as issuer.",
            "checked_at": "2026-10-09",
            "quote": "Missouri state-chartered bank",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Only the issuer is register-checked. Phantom says it is not a bank and names no licence of its own. Bridge's footer says US services are provided by Bridge Building Inc. (NMLS ID 2450917); NMLS Consumer Access returned 403 to curl and was not bypassed, so that licence is not recorded. Card funds are not FDIC insured (cardholder agreement). The Cash help article updated in October 2026 says Stripe now issues the card and replacement cards are Stripe-issued, while the same page and phantom.com/cash still name Lead Bank; the issuer of replacement cards was not identified.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "US"
            ],
            "method": "card_spend",
            "partner": "Lead Bank (issuer), Bridge Ventures LLC (programme manager), Stripe, Visa",
            "fee": "Domestic free; international \"fees may apply\"",
            "limits": "Virtual card only, US except New York; 2,000 USD per transaction and per day (5,000 after 30 days).",
            "evidence_index": 0
          },
          {
            "countries": [
              "US"
            ],
            "method": "bank_transfer",
            "partner": "Bridge (US bank withdrawals, ACH)",
            "fee": "Standard free; fast 1.00 USD + 0.75% (min 1.50 USD)",
            "limits": "US except New York, KYC via Link; converted 1:1; to own or another person's linked US bank account.",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "exchange",
            "partner": "Kraken (the only exchange that accepts CASH on Solana per Phantom)",
            "fee": "Solana network fees; exchange fees not recorded",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/use-your-virtual-phantom-debit-card-us-only-44800221533459",
            "detail": "Debit card help article; declined merchant categories include cash advances and ATM withdrawals.",
            "checked_at": "2026-10-09",
            "quote": "The standard daily transaction limit is $2,000 USD",
            "confirmed_at": "2026-10-12",
            "drift": true
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/withdraw-money-from-your-cash-account-directly-to-a-us-bank-44800172520467",
            "detail": "Withdraw to a US bank help article.",
            "checked_at": "2026-10-09",
            "quote": "converted at a 1:1 rate",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.phantom.com/articles/cash-on-exchanges-and-brokerages-48631671713427",
            "detail": "CASH on exchanges and brokerages help article; Coinbase, Binance, OKX and others do not support CASH.",
            "checked_at": "2026-10-09",
            "quote": "Kraken is currently the only exchange that supports sending and receiving CASH on Solana",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No ATM cash-out; the card declines cash advances and ATM withdrawals, and the cardholder agreement bars cashback. Outside the US the Cash balance can only leave as CASH or swapped tokens to a Solana wallet.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2025-09-30",
            "what": "Phantom Cash announced with a waitlist; the post says it rolls out the following month. No dated general-availability source found."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/learn/blog/introducing-phantom-cash",
              "detail": "Phantom blog post introducing Phantom Cash (New Money, Now in Your Wallet), 30 September 2025.",
              "checked_at": "2026-10-09",
              "quote": "when it rolls out next month",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Phantom Technologies, Inc.",
            "jurisdiction": "US-DE"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.bridge.xyz/card-agreements/phantom-card",
              "detail": "Lead Bank cardholder agreement names Phantom Technologies, Inc., a Delaware corporation, as Platform Provider; the Terms of Use name the same company.",
              "checked_at": "2026-10-09",
              "quote": "Phantom Technologies, Inc. , a Delaware Corporation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Not checked in the Delaware Division of Corporations register (interactive search), so no register_url or file number.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident report for Phantom Cash or the debit card found. Searched status.phantom.com (no Cash component, empty history), the Cash help-centre section and the Phantom blog post list. The help centre's card-replacement wording (Stripe-issued replacement cards) gives no reason or date.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-09-30",
              "summary": "Phantom Cash announced (waitlist; Lead Bank prepaid Visa via Bridge).",
              "url": "https://phantom.com/learn/blog/introducing-phantom-cash"
            },
            {
              "date": "2026-03-17",
              "summary": "Terms of Use last updated (Phantom Cash and AI Agent sections).",
              "url": "https://phantom.com/terms"
            },
            {
              "date": "2026-07-07",
              "summary": "Privacy Policy last updated.",
              "url": "https://phantom.com/privacy"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/terms",
              "detail": "Terms of Use header.",
              "checked_at": "2026-10-09",
              "quote": "Last updated: March 17, 2026",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://phantom.com/privacy",
              "detail": "Privacy Policy header.",
              "checked_at": "2026-10-09",
              "quote": "Last updated: July 7, 2026",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Undated change: help articles updated in October 2026 say Stripe issues the card and handles disputes, and refer to replacement Stripe-issued cards, while older text on the same pages names Lead Bank, Bridge and Galileo. Not entered as a dated change.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "No listed contracts. Card payments move CASH to Bridge's debit-card contract, whose address is not published and whose addresses rotate; the card settles over Visa on Lead Bank's closed ledger.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "plasma-one": {
      "slug": "plasma-one",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001, SOC 2, security page or trust centre found for Plasma One (www.plasma.org/security and /trust return 404; sitemap, terms, privacy policy and card terms read). Rain and Third National not checked.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Wallet access is through linked authentication methods (Apple or Google sign-in, email verification, passkeys, biometrics) and any multi-factor authentication the user enrols in; MFA is optional and users are told to enrol more than one method. Keys are held by a key-management provider (Privy per CROPS components).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/terms-of-service",
              "detail": "Terms of Service (last updated 15 June 2026) s2.2(a).",
              "checked_at": "2026-10-09",
              "quote": "which may include Apple or Google sign-in, email verification, passkeys, biometric authentication, and any multi-factor authentication you enroll in",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "KYC/AML data for the relationship plus 5 years (up to 10 where law requires); transaction and blockchain data 5 years; marketing data until opt-out or 24 months' inactivity; communications up to 3 years. Sumsub keeps face data under its own rules (3 years Illinois, 1 year after purpose Texas, otherwise AML period). Onchain data cannot be erased.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/privacy-policy",
              "detail": "Privacy Policy, Retention.",
              "checked_at": "2026-10-09",
              "quote": "for the duration of our relationship with you and for five (5) years after that relationship ends",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Plasma (Cayman Islands, CO-412800) and Plasma Labs UK Ltd. are joint controllers under Article 26 GDPR / UK GDPR; Sumsub processes biometric KYC data; EEA/UK transfers rely on SCCs and the UK IDTA. No DPIA statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/privacy-policy",
              "detail": "Privacy Policy, Notice to European users, Controllers.",
              "checked_at": "2026-10-09",
              "quote": "Plasma and Plasma Labs UK Ltd. are joint controllers of your personal information",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Plasma, an exempted company incorporated in the Cayman Islands (CO-412800), with affiliates Plasma Labs UK Ltd. (Companies House 16405367, active, incorporated 24 April 2025) and Plasma US, Inc.; the card agreements are with the issuer, Third National; account services with Bridge Building Inc. (US), Bridge Building Sp. z o.o. (EEA) or Bridge Building Limited (others).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/terms-of-service",
              "detail": "Terms of Service preamble.",
              "checked_at": "2026-10-09",
              "quote": "an exempted company with limited liability incorporated under the laws of the Cayman Islands",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/16405367",
              "detail": "Companies House entry for PLASMA LABS UK LTD (active; incorporated 24 April 2025; SIC 62011, 62012).",
              "checked_at": "2026-10-09",
              "quote": "24 April 2025",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/plasma-one-international-card-terms",
              "detail": "International Card Terms, defined terms.",
              "checked_at": "2026-10-09",
              "quote": "The issuer for this card program is Third National.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Plasma may terminate at any time for any or no reason, with or without notice, but for consumers only for a valid reason and with reasonable notice unless immediate action is needed; the issuer may cancel the card at any time with or without notice. Plasma says it does not custody user assets; funds already in Rain collateral need a Rain signature to leave (CROPS S4).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/terms-of-service",
              "detail": "Terms of Service s13.3.",
              "checked_at": "2026-10-09",
              "quote": "Plasma reserves the right to terminate this Agreement and your access to the Services at any time, for any or for no reason, with or without notice to you",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/plasma-one-international-card-terms",
              "detail": "International Card Terms s10 Termination.",
              "checked_at": "2026-10-09",
              "quote": "we may suspend, revoke or cancel your Account privileges",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Automated processing (Sumsub's identity verification platform and internal compliance tooling) assesses KYC and AML and can restrict or close accounts. The policy does not say whether these are AI or machine-learning systems.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/privacy-policy",
              "detail": "Privacy Policy, Automated processing.",
              "checked_at": "2026-10-09",
              "quote": "internal compliance tooling, to assess KYC and AML obligations",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "Only an override path is documented (the user can request human review and contest an automated decision that restricts or closes the account). No monitoring, validation, decommissioning or bias evaluation documentation found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/privacy-policy",
              "detail": "Privacy Policy, Automated processing.",
              "checked_at": "2026-10-09",
              "quote": "you have the right to request human review, express your point of view, and contest the outcome",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "International card: FX up to 1% on non-USD spend; cross-border 0%; Platinum: Plasma covers the Visa FX fee",
            "basis": "International Card Terms Important Disclosures (effective 26 February 2026) and /personal FAQ.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "US card: 1% international transaction fee; no annual fee; late payment 2% of balance",
            "basis": "U.S. Consumer Card Terms account-opening disclosures (agreement last updated 12 February 2026).",
            "evidence_index": 1
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Core tier 199 USD per year or 20,000 XPL locked for 12 months; Lite tier free",
            "basis": "Plasma One Core page (Core has reduced fees and up to 2 free virtual cards; Lite 1). Tier pricing and card fees otherwise live in the Help Center (not read).",
            "evidence_index": 2
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "No Plasma fee; partner fees on FX and bank withdrawals are shown in the app before confirming",
            "basis": "/personal FAQ \"Are there fees?\".",
            "evidence_index": 3
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "International card penalty fees: late payment up to 40 USD, returned payment up to 29 USD",
            "basis": "International Card Terms Important Disclosures.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/plasma-one-international-card-terms",
            "detail": "International Card Terms, Important Disclosures.",
            "checked_at": "2026-10-09",
            "quote": "Foreign Exchange Fee (non USD): up to 1%",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/plasma-one-us-card-terms",
            "detail": "U.S. Consumer Card Terms, account-opening disclosures.",
            "checked_at": "2026-10-09",
            "quote": "International Transaction: 1% of each transaction in U.S. dollars.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/personal/core",
            "detail": "Plasma One Core tier page.",
            "checked_at": "2026-10-09",
            "quote": "Core for $199 per year or lock 20,000 XPL",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/personal",
            "detail": "Plasma One personal page FAQ.",
            "checked_at": "2026-10-09",
            "quote": "Plasma One does not charge any additional fees.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The \"Standard\" versus \"Reduced\" fee levels per tier are not quantified on the public pages; the Rewards Addendum points to the Help Center for card fees and tier pricing. Platinum pricing is not shown. Bridge's off-ramp fees are not published.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Balances rest in the user's own wallet, but the observed account grants its Rain collateral an unlimited USDT0 allowance that Rain's pull operator uses, and collateral is released only by Rain's Coordinator. Agrees with the S1 finding (score 0, Rain can redirect funds; the sample account is not confirmed as Plasma One's).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "unknown",
        "note": "No licence found in a register. The card terms (US and International) name Third National as issuer; no Plasma document gives its regulator or licence number, and FDIC BankFind lists no active institution of that name. The site footer instead says the card is issued by Rain, a Visa Principal Member, which is a network membership, not a licence. Bridge Building Inc. (US), Bridge Building Sp. z o.o. (EEA) and Bridge Building Limited provide account services; their registrations were not checked. Plasma states it is not a regulated financial institution.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Third National (issuer), Rain (programme manager), Visa",
            "fee": "FX up to 1% (International) or 1% (US); covered on Platinum",
            "limits": "US card for US residents, International card for non-US citizens; spend is funded by Rain pulling USDT0 into collateral.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Bridge (Bridge Building Inc. / Sp. z o.o. / Limited by residence)",
            "fee": "partner fee shown in the app",
            "limits": "Off-ramp rails depend on the user's region; not listed publicly.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/plasma-one-international-card-terms",
            "detail": "International Card Terms, issuer.",
            "checked_at": "2026-10-09",
            "quote": "The issuer for this card program is Third National.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/personal",
            "detail": "/personal FAQ \"Can I withdraw from Plasma One to my bank account?\" and footnote 3 on Bridge entities.",
            "checked_at": "2026-10-09",
            "quote": "Send funds to your bank using off-ramps directly inside the app.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.plasma.org/personal",
            "detail": "Footnote 3, Bridge entities by residence.",
            "checked_at": "2026-10-09",
            "quote": "Services to US residents are provided by Bridge Building Inc.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ATM access is not documented: the International Card Terms do not mention ATMs, and the US terms list no cash-advance fee and allow PIN ATM use only if enabled; no ATM row is recorded. Contradiction on the issuer: the card terms say Third National, the site footer says Rain.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-03-19",
            "block": 17026601,
            "what": "Rain collateral factory 0x36F5A315... and Collateral beacon 0xBb931B7B... on Plasma, created by Rain EOA 0x21ebc2f2..."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/tx/0x3885b50800aab37252eea4b8e8be94d3357b328feb480896e4df41f066bcbf9b",
              "address": "0x36F5A3156FC6deD6bbcA970D26972ABB2dfD6274",
              "block_number": 17026601,
              "detail": "The factory proxy has code size 0 at block 17026600 and 1167 at 17026601 (2026-03-19 22:12:39 UTC); creation tx 0x3885b508...bf9b from EOA 0x21ebc2f2.... The beacon 0xBb931B7B... appears in the same block (0 to 1084 bytes).",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0x36F5A3156FC6deD6bbcA970D26972ABB2dfD6274 --block 17026600 --rpc-url https://rpc.plasma.to; cast codesize 0x36F5A3156FC6deD6bbcA970D26972ABB2dfD6274 --block 17026601 --rpc-url https://rpc.plasma.to"
            }
          ],
          "note": "These are Rain's contracts and may serve other Rain programmes on Plasma; that they serve Plasma One rests on the card terms (provider file judgment call). The Coordinator and Collateral implementation now in use were deployed on 2026-09-29 (see changes).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Plasma (exempted company with limited liability)",
            "jurisdiction": "KY",
            "registration_number": "CO-412800"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/privacy-policy",
              "detail": "Privacy Policy, Who we are.",
              "checked_at": "2026-10-09",
              "quote": "registration number CO-412800",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The Cayman Islands register is not publicly searchable, so no register_url. The UK affiliate and joint controller Plasma Labs UK Ltd. is on Companies House (16405367); see B11.1.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident report or post-mortem found on www.plasma.org (sitemap pages other than blog posts read) or in the PlasmaLaboratories GitHub organisation; blog posts were not searched one by one.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-02-12",
              "summary": "US cardholder agreement last updated.",
              "url": "https://www.plasma.org/plasma-one-us-card-terms"
            },
            {
              "date": "2026-02-26",
              "summary": "International Card Terms disclosures effective (FX up to 1%, issuer Third National).",
              "url": "https://www.plasma.org/plasma-one-international-card-terms"
            },
            {
              "date": "2026-06-15",
              "summary": "Terms of Service last updated.",
              "url": "https://www.plasma.org/terms-of-service"
            },
            {
              "date": "2026-09-29",
              "summary": "New Rain Collateral implementation (block 33757857) and Coordinator (block 33757874) deployed on Plasma; the Coordinator in use was created here.",
              "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://plasmascan.to/address/0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "address": "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077",
              "block_number": 33757874,
              "detail": "Coordinator code size 0 at block 33757873 and 24540 at 33757874 (2026-09-29 16:20:25 UTC); Collateral implementation 0x05263D24... goes from 0 bytes at 33757856 to code at 33757857 (16:20:08 UTC).",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077 --block 33757873 --rpc-url https://rpc.plasma.to; cast codesize 0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077 --block 33757874 --rpc-url https://rpc.plasma.to"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/plasma-one-us-card-terms",
              "detail": "US cardholder agreement header.",
              "checked_at": "2026-10-09",
              "quote": "Last Updated: February 12, 2026",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.plasma.org/plasma-one-international-card-terms",
              "detail": "International Card Terms Important Disclosures.",
              "checked_at": "2026-10-09",
              "quote": "Effective as of February 26, 2026",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Whether a previous Coordinator served the card before 2026-09-29 was not traced.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 9745,
          "addresses": [
            "0xd5dd79397FdfBe5E1fceEdC2463fE4A464873077"
          ],
          "topic0": "0x114ae074135313f7bd77b4519fbe2a232e4eec564661201333ffa82548098e16",
          "event": "AssetPulled(address indexed user, address indexed collateralProxy, address asset, uint256 amount, string indexed indexedTransactionId, string transactionId)",
          "amount_word": 1,
          "token_word": 0,
          "window_days": 30,
          "exclusions": "Sums AssetPulled events (card funding pulls from user wallets into Rain collateral, one per card transaction id) on the listed Coordinator. Counts every Rain programme served by this Coordinator on Plasma, not only Plasma One; excludes payments from collateral, reversals and liquidations; pulls through any earlier Coordinator (before block 33757874) are not covered. Word layout checked on tx 0x32bbf2f4...34b8 (word 0 = USDT0, word 1 = 1340000 = 1.34 USDT0)."
        },
        "note": "Not yet computed; the maintainer runs scripts/volumes.mjs. The figure is gross pulls into card collateral, an upper bound on Plasma One card funding because the Coordinator may serve other Rain programmes.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: no blocks-per-day estimate for chain 9745"
      }
    },
    "privacy-pools": {
      "slug": "privacy-pools",
      "fees": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Vetting fee 0.5% of each deposit (vettingFeeBPS = 50) on the ETH and USDC pools; 0 on the USDT pool",
            "basis": "Entrypoint assetConfig per asset, set by OWNER_ROLE (0xbow Safe) with no timelock and no event-free path (PoolConfigurationUpdated). Terms state 0.5% and that it may change at 0xbow's discretion; fees accrue in the Entrypoint and only OWNER_ROLE can withdraw them.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "Relay fee set by the relayer, deducted from the withdrawal; onchain cap 10% (maxRelayFeeBPS 1000)",
            "basis": "Optional; only on withdrawals relayed through the Entrypoint. Each relayer sets fee_bps in its config (example config 500-1000); the Entrypoint reverts above the per-asset cap.",
            "evidence_index": 1
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Minimum deposit 0.01 ETH (ETH pool); 25 USDC; 25 USDT",
            "basis": "assetConfig minimumDepositAmount, set by OWNER_ROLE.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Ethereum gas for deposit; gas for withdrawal paid by the payee or by the relayer (recovered through the relay fee)",
            "basis": "Network fee, not set by the protocol.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://sourcify.dev/server/v2/contract/1/0x15e355024de1CDc74ADdea7EBDf98418Ba5B1a2c",
            "address": "0x6818809EefCe719E480a7526D76bD3e561526b46",
            "block_number": 26153723,
            "detail": "Entrypoint assetConfig at block 26153723: ETH (0xEeee…EEeE) pool 0xF241…C9fB, min 0.01 ETH, vettingFeeBPS 50, maxRelayFeeBPS 1000; USDC pool 0xb419…ce86, min 25 USDC, 50, 1000; USDT pool 0xe859…4572, min 25 USDT, 0, 1000.",
            "checked_at": "2026-10-09",
            "recheck": "cast call 0x6818809EefCe719E480a7526D76bD3e561526b46 \"assetConfig(address)(address,uint256,uint256,uint256)\" 0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE --rpc-url https://ethereum-rpc.publicnode.com",
            "check": {
              "call": "0xd6dbaf58000000000000000000000000eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
              "expect": "0x000000000000000000000000f241d57c6debae225c0f2e6ea1529373c9a9c9fb"
            },
            "drift": true
          },
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
            "checked_at": "2026-10-09",
            "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/src/contracts/Entrypoint.sol#L150-L175",
            "path": "packages/contracts/src/contracts/Entrypoint.sol",
            "detail": "relay() reverts if relayFeeBPS exceeds maxRelayFeeBPS, deducts the relay fee from the withdrawn amount and pays it to the feeRecipient chosen in the relay data; deposit (L320-L340) deducts vettingFeeBPS before the pool deposit; withdrawFees (L264-L272) is onlyRole(OWNER_ROLE).",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
            "checked_at": "2026-10-09",
            "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/toc.md#L176-L192",
            "path": "docs/docs/toc.md",
            "detail": "Terms of Use section 5 sets a Vetting Fee of 0.5% of each deposit, changeable at 0xbow's discretion and non-refundable.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The USDT pool's vetting fee reads 0 onchain although the terms state 0.5%; the contract value is what is charged. ETH vettingFeeBPS was briefly set to 500 (5%) on 2025-11-23 and back to 50 on 2025-11-27 (see changes).",
        "checked_at": "2026-10-09"
      },
      "custody_model": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Judgment call. Agrees with the S1 finding that no role can sweep or redirect pool funds and the depositor can always ragequit; the ASP's control over private release (why S1 is 1) is a release dependency, not custody, so self_custody rather than hybrid.",
        "checked_at": "2026-10-09"
      },
      "licences": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "absent",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
            "checked_at": "2026-10-09",
            "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/toc.md#L1-L40",
            "path": "docs/docs/toc.md",
            "detail": "The Terms of Use (556 lines) name 0xbow Limited as the counterparty and Delaware law, and describe the ASP due diligence and vetting fee; they cite no licence, registration or regulator (searched for licen, regulat, registered, money transmit). The privacy policy and 0xbow.io were searched the same way with no result.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Absent means no licence is claimed or cited anywhere 0xbow publishes. No regulator register (e.g. FinCEN MSB) was searched by entity name because the place of incorporation of 0xbow Limited is not stated.",
        "checked_at": "2026-10-09"
      },
      "cashout": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "Token-to-address rail. The payee receives ETH or tokens at an address it controls; converting them to local currency is outside the protocol.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "maturity": {
        "first_deployment": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "date": "2025-03-29",
            "block": 22153714,
            "what": "ETH pool (PrivacyPoolSimple) 0xF241…C9fB created in tx 0x6e3e14d7…cf75; the Entrypoint proxy was created one block earlier (22153713, tx 0x4987385c…776c)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB?fields=deployment",
              "address": "0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB",
              "block_number": 22153714,
              "detail": "Sourcify creation data gives tx 0x6e3e14d7bcdfa838a8f7918de81d7b233e40d3afd493a864285fad8b360bcf75 at block 22153714 (deployer EOA 0x1f4F…E187, via a factory, so the receipt has no contractAddress); block 22153714 is dated 2025-03-29 UTC.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://sourcify.dev/server/v2/contract/1/0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB?fields=deployment\""
            }
          ],
          "checked_at": "2026-10-09"
        },
        "entity": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "unknown",
          "note": "The terms name \"0xbow Limited\" (also \"Oxbow Ltd.\") as maintainer and counterparty, with Delaware governing law, but no place of incorporation or company number; the privacy policy, SECURITY.md, 0xbow.io and the GitHub org (no company field) give none. Recorded as unknown because the schema needs a jurisdiction; see B11.1 for the named counterparty.",
          "checked_at": "2026-10-09"
        },
        "incidents": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/security-advisories",
              "detail": "No published security advisories for 0xbow-io/privacy-pools-core.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB",
              "address": "0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB",
              "block_number": 26153723,
              "detail": "dead() returns false on the ETH pool (and on all 14 pools per the seed research); no PoolRemoved events on the Entrypoint.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x36cf7c87",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No post-mortem found in the core repo, docs or 0xbow.io. Audit findings fixed before launch (Oxorio, see S6) are not incidents.",
          "checked_at": "2026-10-09"
        },
        "changes": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2025-03-29",
              "summary": "Entrypoint proxy deployed with implementation 0xdd8a…d4c1; ETH pool deployed and registered.",
              "url": "https://etherscan.io/tx/0x4987385c58c49c9e3117244180094c5b7c5a0566c8547d13880df5e19076776c"
            },
            {
              "date": "2025-05-22",
              "summary": "Entrypoint upgraded to implementation 0x15e3…1a2c (audited Entrypoint upgrade, commit 238e3594).",
              "url": "https://etherscan.io/tx/0xde1c41f546e3b6064433e0db1309d8ca5a3ac78a8fc626f934b13d05ee67578f"
            },
            {
              "date": "2025-05-24",
              "summary": "ETH pool configuration set to vetting fee 50 bps, max relay fee 100 bps; minimum deposit raised to 0.1 ETH the same day.",
              "url": "https://etherscan.io/tx/0xd1bbd6fe30bddb8865b8c322fcce8aa3d256003799553a73dbd6d25823b0fffa"
            },
            {
              "date": "2025-07-14",
              "summary": "ETH pool max relay fee raised from 100 to 500 bps.",
              "url": "https://etherscan.io/tx/0xccb8ae46bf7cf305a82641d8381443e095ebf7ac259e01d2fd47a2c41b2ca902"
            },
            {
              "date": "2025-11-23",
              "summary": "Ten pools reconfigured in one transaction; ETH pool minimum lowered to 0.01 ETH, vetting fee set to 500 bps and max relay fee to 1000 bps.",
              "url": "https://etherscan.io/tx/0x0f0304222d94ea97675f978d714af8b082017aa3086bf10da17333d704b5cfb3"
            },
            {
              "date": "2025-11-27",
              "summary": "ETH pool vetting fee set back to 50 bps.",
              "url": "https://etherscan.io/tx/0xeb2f94c34062a8880af9175e47ba9cd4e752e635f3b497ea79553189347cc027"
            },
            {
              "date": "2025-12-15",
              "summary": "USDC pool vetting fee set from 0 to 50 bps.",
              "url": "https://etherscan.io/tx/0xac755a815639907c031f670c660658a95844e288090c281b02ff7a19d81c7097"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x6818809EefCe719E480a7526D76bD3e561526b46",
              "address": "0x6818809EefCe719E480a7526D76bD3e561526b46",
              "block_number": 26153723,
              "detail": "Upgraded and PoolConfigurationUpdated logs on the Entrypoint from block 22153712 to latest (via rpc.mevblocker.io); dates from block headers. Upgraded at 22153713 and 22540812; PoolConfigurationUpdated at 22553626, 22553907, 22919769, 23864776 (10 pools), 23892246, 24020649.",
              "checked_at": "2026-10-09",
              "recheck": "cast logs --address 0x6818809EefCe719E480a7526D76bD3e561526b46 0xfd8e5b01fa101008dcfcd9a7eab8692908a5493de0f49b63c0d4d7603efb7ede --from-block 22153712 --rpc-url https://rpc.mevblocker.io"
            }
          ],
          "note": "Fee and minimum changes are made by OWNER_ROLE without a timelock or prior notice found. No governance proposals exist; the transactions are the primary source.",
          "checked_at": "2026-10-09"
        }
      },
      "volume": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "unknown",
        "spec": {
          "chain_id": 1,
          "addresses": [
            "0xF241d57C6DebAe225c0F2e6eA1529373C9A9C9fB"
          ],
          "topic0": "0x75e161b3e824b114fc1a33274bd7091918dd4e639cede50b78b15a4eea956a21",
          "event": "Withdrawn(address indexed _processooor, uint256 _value, uint256 _spentNullifier, uint256 _newCommitment)",
          "amount_word": 0,
          "token": "0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE",
          "decimals": 18,
          "symbol": "ETH",
          "window_days": 30,
          "exclusions": "ETH pool only (most deposits); the USDC, USDT and 11 other pools are separate contracts with different tokens, which one fixed-token spec cannot sum. Amounts are gross of the relay fee. Ragequits (refunds to depositors) are a different event and excluded."
        },
        "note": "Withdrawals reveal amount and recipient onchain (only the link to the deposit is hidden), so private payouts are observable at pool level. Not computed; the maintainer runs scripts/volumes.mjs.",
        "reason": "not computed on 2026-10-19: eth_getLogs: Archive requests require a personal token. Get one at: https://www.allnodes.com/publicnode"
      },
      "facts": {
        "B1.4": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Oxorio audited the contracts (final commit 532eaa8e) and the Entrypoint upgrade (238e3594); deployed sources match. Circuits and Auditware reports are in the same folder. See CROPS S6.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B2.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": true,
                "detail": "security policy file: SECURITY.md"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-core: security policy file: SECURITY.md",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-website: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "checked_at": "2026-10-09",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/SECURITY.md#L1-L29",
              "path": "SECURITY.md",
              "detail": "The security policy lists acknowledge, investigate, prepare a fix and disclose after deployment, with no time commitments for acknowledgement or patching. The terms and privacy policy state none either.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-core: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-website: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "checked_at": "2026-10-09",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/privacy-policy.md#L125-L139",
              "path": "docs/docs/privacy-policy.md",
              "detail": "Neither the privacy policy nor the terms (docs/docs/toc.md) commit to notify users of security or data incidents; the only notification promise concerns policy changes (L139). SECURITY.md covers inbound reports only.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B6.3": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "No fixed retention period; personal data kept \"for the period of time needed for legitimate business purposes\", longer where law requires. Deletion on request, with residual copies in backups removed over time.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "checked_at": "2026-10-09",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/privacy-policy.md#L105-L127",
              "path": "docs/docs/privacy-policy.md",
              "detail": "Privacy policy sections on deletion requests (L109) and retention (L125-L127).",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Cross-reference CROPS P2.",
          "checked_at": "2026-10-09"
        },
        "B6.4": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "The privacy policy calls 0xbow a data processor in general and a data controller for EU residents under GDPR. No DPIA is mentioned.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "checked_at": "2026-10-09",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/privacy-policy.md#L17-L59",
              "path": "docs/docs/privacy-policy.md",
              "detail": "L17 states 0xbow is the data processor unless stated otherwise; L57 states it is the Data Controller for EU residents.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The two roles are stated inconsistently in the same document.",
          "checked_at": "2026-10-09"
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-core: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-website: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": true,
                "detail": "rules: required_signatures, pull_request, required_status_checks, deletion, non_fast_forward"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/rules/branches/main",
              "detail": "0xbow-io/privacy-pools-core: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/rules/branches/main",
              "detail": "0xbow-io/privacy-pools-website: rules: required_signatures, pull_request, required_status_checks, deletion, non_fast_forward",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": true,
                "detail": "8 workflow file(s)"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": true,
                "detail": "3 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-core: 8 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-website: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-core: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-website: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-core: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-website: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": true,
                "detail": "latest tags: v1.3.0, v1.2.1, v1.2.0"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": true,
                "detail": "latest tags: v2.15.0, v2.14.10, v2.14.1"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/tags",
              "detail": "0xbow-io/privacy-pools-core: latest tags: v1.3.0, v1.2.1, v1.2.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/tags",
              "detail": "0xbow-io/privacy-pools-website: latest tags: v2.15.0, v2.14.10, v2.14.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/commits?per_page=10",
              "detail": "0xbow-io/privacy-pools-core: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/commits?per_page=10",
              "detail": "0xbow-io/privacy-pools-website: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": true,
                "detail": "6 release(s) with notes"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": true,
                "detail": "CHANGELOG file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-core: 6 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-website: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "0xbow-io/privacy-pools-core",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "0xbow-io/privacy-pools-website",
                "ok": true,
                "detail": "contribution section in README"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-core/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-core: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/0xbow-io/privacy-pools-website/contents/?ref=main",
              "detail": "0xbow-io/privacy-pools-website: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Logical and integration architecture (contracts, ZK, ASP layers; deposit, withdrawal and ragequit flows; SDK and relayer reference) in the core repo docs. No infrastructure view of the hosted ASP.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "checked_at": "2026-10-09",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/layers/asp.md#L1-L56",
              "path": "docs/docs/layers/asp.md",
              "detail": "docs/docs/layers (asp, contracts, zk), docs/docs/protocol (deposit, withdrawal, ragequit) and docs/docs/reference (circuits, contracts, sdk), also served at docs.privacypools.com.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "0xbow Limited (terms also say \"Oxbow Ltd.\"); governing law and exclusive venue Delaware, JAMS arbitration. Place of incorporation not stated.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "checked_at": "2026-10-09",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/toc.md#L5-L31",
              "path": "docs/docs/toc.md",
              "detail": "Terms of Use preamble naming the counterparty; section 14 (L474-L479) sets Delaware law.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.privacypools.com/toc",
              "detail": "Terms of Use as served on the docs site.",
              "quote": "0xbow Limited (hereinafter \"0xbow\", \"we\", or \"us\") maintains the website",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Onchain fee switch. The vetting fee (0.5% on ETH and USDC deposits) accrues in the Entrypoint and is withdrawable by OWNER_ROLE (0xbow's Safe). No other funding source is published.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "checked_at": "2026-10-09",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/packages/contracts/src/contracts/Entrypoint.sol#L264-L272",
              "path": "packages/contracts/src/contracts/Entrypoint.sol",
              "detail": "withdrawFees(asset, recipient) sends the Entrypoint's whole balance of an asset to a recipient chosen by OWNER_ROLE.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C1",
              "index": 3
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.3": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "0xbow may terminate access to the website and functionalities at any time without limit; vetting fees are non-refundable. Funds stay in the immutable pools and the depositor can always ragequit without 0xbow (CROPS S4).",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "d494b63e79f33bb2b0c8ece6cdacdca465c3b884",
              "checked_at": "2026-10-09",
              "url": "https://github.com/0xbow-io/privacy-pools-core/blob/d494b63e79f33bb2b0c8ece6cdacdca465c3b884/docs/docs/toc.md#L260-L270",
              "path": "docs/docs/toc.md",
              "detail": "Rules-of-conduct section reserving an unlimited right to terminate access; section 5 (L186-L192) makes vetting fees non-refundable.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B12.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "unknown",
          "note": "The ASP's vetting is closed. 0xbow.io says the ASP \"continuously monitors transactions\" and conducts \"Know Your Transaction\", and the terms describe a due diligence process, but no source says whether it is rule-based, vendor-supplied or uses AI. No ASP code is published.",
          "checked_at": "2026-10-09"
        }
      }
    },
    "railgun": {
      "slug": "railgun",
      "fees": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "0.25% of the shielded amount (shieldFee = 25 bps)",
            "basis": "Contract parameter on the RailgunSmartWallet proxy, sent to the treasury contract; changeFee is owner-only (RAIL governance vote, at least 7 days) and capped at 50%. Unchanged since one FeeChange event at block 14737691.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "0.25% of the unshielded amount (unshieldFee = 25 bps)",
            "basis": "Same contract parameter; deducted from the note value on unshield, so the receiving public address gets the amount net of the fee.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Broadcaster premium, set by each broadcaster as a % of gas (docs say generally ~10%), paid in the transacted token",
            "basis": "Optional; set per broadcaster over Waku, not by the contracts. Self-relaying avoids it but pays gas from a public address.",
            "evidence_index": 2
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Ethereum gas for shield, transact and unshield",
            "basis": "Paid in ETH when self-signing, or folded into the broadcaster premium in the transacted token.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://sourcify.dev/server/v2/contract/1/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
            "address": "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
            "block_number": 26153698,
            "detail": "shieldFee() and unshieldFee() both return 25 (basis points of 10,000); nftFee() returns 0; treasury() = 0xE8A8…FF40. The only FeeChange event since deployment (block 14737691, tx 0x2bd98cd1…2361) set 25/25/0.",
            "checked_at": "2026-10-09",
            "recheck": "cast call 0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9 \"unshieldFee()(uint120)\" --rpc-url https://ethereum-rpc.publicnode.com",
            "check": {
              "call": "0x053ed12a",
              "expect": "0x0000000000000000000000000000000000000000000000000000000000000019"
            },
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/Railgun-Privacy/contract/blob/36bcf5ed7cf94bfafb6e1a303e1832c769c16780/contracts/logic/RailgunLogic.sol#L316-L358",
            "commit": "36bcf5ed7cf94bfafb6e1a303e1832c769c16780",
            "path": "contracts/logic/RailgunLogic.sol",
            "detail": "transferTokenOut splits the note value with getFee(value, inclusive, unshieldFee), sends the base to the recipient and the fee to the treasury, and emits Unshield(to, token, base, fee). changeFee (L141-L155) is onlyOwner and caps each fee at BASIS_POINTS / 2.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.railgun.org/wiki/learn/railgun-deductions.md",
            "detail": "Railgun's docs describe the 0.25% protocol deduction and broadcaster premiums set by individual broadcasters.",
            "quote": "Broadcaster Premiums are up to the individual Broadcasters themselves",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09"
      },
      "custody_model": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with S1 (2) finding. Notes are spendable only with the owner's keys and no admin function moves balances; the residual risk is an upgrade after a public RAIL vote with a 7-day minimum, which S1 already records.",
        "checked_at": "2026-10-09"
      },
      "licences": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "No operating entity runs the rail. The contracts are governed onchain by RAIL stakers (ProxyAdmin owned by the Delegator, owned by the Voting contract; see C1), and broadcasters are independent operators. No company is named as provider in the docs or GitHub organisations.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "cashout": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "Token-to-address rail. The payee unshields tokens to an address it controls; converting them to local currency is outside the protocol.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "maturity": {
        "first_deployment": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "date": "2022-05-01",
            "block": 14693013,
            "what": "RailgunSmartWallet proxy 0xFA70…a4b9 created (tx 0x13954e0d…22aa) by 0x76EB…4624; first implementation set at block 14737691 (2022-05-08)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9?fields=deployment",
              "address": "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "block_number": 14693013,
              "detail": "Sourcify creation data gives tx 0x13954e0d1af4c619efbd502299e78e116d1309b2b85c15ac6fe09838bb8622aa at block 14693013; the receipt (read via rpc.mevblocker.io) has contractAddress 0xfa70…a4b9 and status 1; block 14693013 is dated 2022-05-01 UTC.",
              "checked_at": "2026-10-09",
              "recheck": "cast receipt 0x13954e0d1af4c619efbd502299e78e116d1309b2b85c15ac6fe09838bb8622aa contractAddress --rpc-url https://rpc.mevblocker.io"
            }
          ],
          "note": "The Delegator's first GrantPermission logs (block 12977000, 2021-08-07) show the governance stack predates this proxy; an earlier settlement contract, if any, is not in the provider's contract list and was not traced.",
          "checked_at": "2026-10-09"
        },
        "entity": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.railgun.org/wiki/rail-token/protocol-governance.md",
              "detail": "The docs describe changes as onchain protocol requests decided by RAIL stakers and name no company; the full docs index (docs.railgun.org/wiki/llms.txt), railgun.org and the Railgun-Privacy and Railgun-Community GitHub organisations (no company field) were searched for a legal entity.",
              "quote": "Treasury funds never pass through a developer or team wallet, during an upgrade or otherwise.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/orgs/Railgun-Privacy",
              "detail": "GitHub org Railgun-Privacy: name Railgun, company, blog, location and email empty; Railgun-Community lists only https://www.railgun.org.",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "No maintaining legal entity is disclosed. Railway Wallet, the reference client, is published by the Right to Privacy Foundation, which is not the Railgun protocol's maintainer.",
          "checked_at": "2026-10-09"
        },
        "incidents": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "address": "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "block_number": 26153698,
              "detail": "eth_getLogs over the proxy from its creation block (14693013) to latest returns no ProxyPause events (topic0 0xa51641ae…bb6f); the only ProxyUnpause is in the setup transaction at block 14737691.",
              "checked_at": "2026-10-09",
              "recheck": "cast logs --address 0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9 0xa51641ae9e6ff3082f83f718f043efc36fa8eb06274cd78c3e7251af263ebb6f --from-block 14693013 --rpc-url https://rpc.mevblocker.io"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/security-advisories",
              "detail": "No published security advisories for Railgun-Privacy/contract or Railgun-Community/engine.",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "No post-mortem found in docs.railgun.org (full index searched) or the repos. Third-party reports of illicit use are not incidents of the rail and are not recorded.",
          "checked_at": "2026-10-09"
        },
        "changes": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2022-05-08",
              "summary": "Proxy initialised with its first implementation (0xbcfa…541a), fees set to 25/25 bps and treasury 0xc851…4d6c; proxy unpaused.",
              "url": "https://etherscan.io/tx/0x2bd98cd135e2eaf7b7239bb4951a043f655629b5d0f0ca12334ce05718512361"
            },
            {
              "date": "2022-07-24",
              "summary": "Treasury changed to 0xE8A8…FF40 (TreasuryChange).",
              "url": "https://etherscan.io/tx/0x75671d8d03312847db13e98bafb021f17ccda2ca170e9945b33ad8ed5fca812b"
            },
            {
              "date": "2022-11-29",
              "summary": "Implementation upgraded to 0x3216…e13b (ProxyUpgrade).",
              "url": "https://etherscan.io/tx/0xab0625746a64ed88fd040a39bdbe9ed930328d9b09245b36cd1d9a64444dad95"
            },
            {
              "date": "2023-03-09",
              "summary": "Implementation upgraded to 0xc0be…09cc (ProxyUpgrade).",
              "url": "https://etherscan.io/tx/0xe001ac69697083957933db13ff27c56769ce8826d4ab676b3965d7a44b9f0668"
            },
            {
              "date": "2025-07-28",
              "summary": "Implementation upgraded to 0xb4f2…d89b (ProxyUpgrade).",
              "url": "https://etherscan.io/tx/0xfc6cda4a6e9b8e2d055a50212551e6daa8ec180ad7aced11d00ae71e1d0eab6e"
            },
            {
              "date": "2026-08-14",
              "summary": "Implementation upgraded to the current 0xD662…6A0C (ProxyUpgrade), deployed at block 25641630; adds Action events and TokenBlocklist.",
              "url": "https://etherscan.io/tx/0x7ac142845ccd9f156d992099a7ca8d6cb52655f4153cc49c48c38c8966a6b3ad"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "address": "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "block_number": 26153698,
              "detail": "ProxyUpgrade, FeeChange and TreasuryChange logs on the proxy since block 14693013 (via rpc.mevblocker.io), block dates from block headers. Upgrades at blocks 14737691, 16076750, 16790263, 23018635, 25753684; one FeeChange (14737691); TreasuryChange at 14737691 and 15202637.",
              "checked_at": "2026-10-09",
              "recheck": "cast logs --address 0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9 0x85aeb0b8dd2de94a068da6d2ccd785fea888eee68ec95d9a17c74446a865839d --from-block 14693013 --rpc-url https://rpc.mevblocker.io"
            }
          ],
          "note": "Each upgrade after setup required a passed RAIL governance proposal (ProxyAdmin is owned by the Delegator and the Voting contract). The proposal documents behind each upgrade were not read; the transaction is the primary source cited.",
          "checked_at": "2026-10-09"
        }
      },
      "volume": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "unknown",
        "spec": {
          "chain_id": 1,
          "addresses": [
            "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9"
          ],
          "topic0": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
          "event": "Unshield(address to, (uint8 tokenType, address tokenAddress, uint256 tokenSubID) token, uint256 amount, uint256 fee)",
          "amount_word": 4,
          "token_word": 2,
          "window_days": 30,
          "exclusions": "Counts unshields only (value leaving the shielded pool to public addresses, net of the 0.25% fee). Private 0zk-to-0zk transfers, shields and RelayAdapt swaps are not included; ERC721 unshields count as amount 1. BSC, Polygon and Arbitrum deployments are excluded."
        },
        "note": "Judgment call. Shielded 0zk transfers hide amount, token and parties, so the payments themselves are not observable; the spec measures pool exits (Unshield) on the listed proxy, a lower bound on payee settlement to public addresses. Data words verified on a live log at block 26148878 (word 2 = USDT, word 4 = amount). Not computed; the maintainer runs scripts/volumes.mjs.",
        "reason": "not computed on 2026-10-19: eth_getLogs: Archive requests require a personal token. Get one at: https://www.allnodes.com/publicnode"
      },
      "facts": {
        "B1.4": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "ABDK reviewed an early version of the contracts and circuits; no audit of the deployed implementation was found. See CROPS S6.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/contents/?ref=main",
              "detail": "Railgun-Privacy/contract: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/contents/?ref=main",
              "detail": "Railgun-Privacy/circuits-v2: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/contents/?ref=main",
              "detail": "Railgun-Community/engine: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/contents/?ref=main",
              "detail": "Railgun-Community/wallet: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/contents/?ref=main",
              "detail": "Railgun-Community/shared-models: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/contents/?ref=master",
              "detail": "Railgun-Community/deployments: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/contents/?ref=main",
              "detail": "Railgun-Community/waku-broadcaster-client: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/contents/?ref=main",
              "detail": "Railgun-Community/private-proof-of-innocence: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/contents/?ref=main",
              "detail": "Railgun-Community/subsquid-integration: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/contents/?ref=main",
              "detail": "Railway-Wallet/Railway-Wallet: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/contents/?ref=main",
              "detail": "Railgun-Privacy/contract: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/contents/?ref=main",
              "detail": "Railgun-Privacy/circuits-v2: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/contents/?ref=main",
              "detail": "Railgun-Community/engine: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/contents/?ref=main",
              "detail": "Railgun-Community/wallet: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/contents/?ref=main",
              "detail": "Railgun-Community/shared-models: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/contents/?ref=master",
              "detail": "Railgun-Community/deployments: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/contents/?ref=main",
              "detail": "Railgun-Community/waku-broadcaster-client: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/contents/?ref=main",
              "detail": "Railgun-Community/private-proof-of-innocence: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/contents/?ref=main",
              "detail": "Railgun-Community/subsquid-integration: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/contents/?ref=main",
              "detail": "Railway-Wallet/Railway-Wallet: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": true,
                "detail": "deployment configuration: docker-compose.yml"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/contents/?ref=main",
              "detail": "Railgun-Privacy/contract: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/contents/?ref=main",
              "detail": "Railgun-Privacy/circuits-v2: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/contents/?ref=main",
              "detail": "Railgun-Community/engine: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/contents/?ref=main",
              "detail": "Railgun-Community/wallet: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/contents/?ref=main",
              "detail": "Railgun-Community/shared-models: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/contents/?ref=master",
              "detail": "Railgun-Community/deployments: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/contents/?ref=main",
              "detail": "Railgun-Community/waku-broadcaster-client: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/contents/?ref=main",
              "detail": "Railgun-Community/private-proof-of-innocence: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/contents/?ref=main",
              "detail": "Railgun-Community/subsquid-integration: deployment configuration: docker-compose.yml",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/contents/?ref=main",
              "detail": "Railway-Wallet/Railway-Wallet: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, required_linear_history"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, required_linear_history"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, required_linear_history"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/rules/branches/main",
              "detail": "Railgun-Privacy/contract: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/rules/branches/main",
              "detail": "Railgun-Privacy/circuits-v2: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/rules/branches/main",
              "detail": "Railgun-Community/engine: rules: deletion, non_fast_forward, pull_request, required_linear_history",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/rules/branches/main",
              "detail": "Railgun-Community/wallet: rules: deletion, non_fast_forward, pull_request, required_linear_history",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/rules/branches/main",
              "detail": "Railgun-Community/shared-models: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/rules/branches/master",
              "detail": "Railgun-Community/deployments: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/rules/branches/main",
              "detail": "Railgun-Community/waku-broadcaster-client: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/rules/branches/main",
              "detail": "Railgun-Community/private-proof-of-innocence: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/rules/branches/main",
              "detail": "Railgun-Community/subsquid-integration: rules: deletion, non_fast_forward, pull_request, required_linear_history",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/rules/branches/main",
              "detail": "Railway-Wallet/Railway-Wallet: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": false,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": true,
                "detail": "5 workflow file(s)"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": true,
                "detail": "3 workflow file(s)"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": true,
                "detail": "4 workflow file(s)"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": true,
                "detail": "3 workflow file(s)"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": true,
                "detail": "2 workflow file(s)"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/contents/?ref=main",
              "detail": "Railgun-Privacy/contract: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/contents/?ref=main",
              "detail": "Railgun-Privacy/circuits-v2: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/contents/?ref=main",
              "detail": "Railgun-Community/engine: 5 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/contents/?ref=main",
              "detail": "Railgun-Community/wallet: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/contents/?ref=main",
              "detail": "Railgun-Community/shared-models: 4 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/contents/?ref=master",
              "detail": "Railgun-Community/deployments: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/contents/?ref=main",
              "detail": "Railgun-Community/waku-broadcaster-client: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/contents/?ref=main",
              "detail": "Railgun-Community/private-proof-of-innocence: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/contents/?ref=main",
              "detail": "Railgun-Community/subsquid-integration: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/contents/?ref=main",
              "detail": "Railway-Wallet/Railway-Wallet: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/contents/?ref=main",
              "detail": "Railgun-Privacy/contract: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/contents/?ref=main",
              "detail": "Railgun-Privacy/circuits-v2: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/contents/?ref=main",
              "detail": "Railgun-Community/engine: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/contents/?ref=main",
              "detail": "Railgun-Community/wallet: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/contents/?ref=main",
              "detail": "Railgun-Community/shared-models: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/contents/?ref=master",
              "detail": "Railgun-Community/deployments: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/contents/?ref=main",
              "detail": "Railgun-Community/waku-broadcaster-client: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/contents/?ref=main",
              "detail": "Railgun-Community/private-proof-of-innocence: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/contents/?ref=main",
              "detail": "Railgun-Community/subsquid-integration: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/contents/?ref=main",
              "detail": "Railway-Wallet/Railway-Wallet: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/contents/?ref=main",
              "detail": "Railgun-Privacy/contract: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/contents/?ref=main",
              "detail": "Railgun-Privacy/circuits-v2: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/contents/?ref=main",
              "detail": "Railgun-Community/engine: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/contents/?ref=main",
              "detail": "Railgun-Community/wallet: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/contents/?ref=main",
              "detail": "Railgun-Community/shared-models: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/contents/?ref=master",
              "detail": "Railgun-Community/deployments: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/contents/?ref=main",
              "detail": "Railgun-Community/waku-broadcaster-client: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/contents/?ref=main",
              "detail": "Railgun-Community/private-proof-of-innocence: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/contents/?ref=main",
              "detail": "Railgun-Community/subsquid-integration: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/contents/?ref=main",
              "detail": "Railway-Wallet/Railway-Wallet: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": true,
                "detail": "latest tags: v9.6.0, v9.5.4, v9.5.3"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": true,
                "detail": "latest tags: v10.9.0, v10.8.6, v10.8.5"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": true,
                "detail": "latest tags: v8.0.1, v8.0.0, v7.6.2"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": true,
                "detail": "latest tags: v9.1.1, v9.1.0, v9.0.6"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": true,
                "detail": "latest tags: v5.26.1, v5.24.21, v5.24.18"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/tags",
              "detail": "Railgun-Privacy/contract: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/tags",
              "detail": "Railgun-Privacy/circuits-v2: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/tags",
              "detail": "Railgun-Community/engine: latest tags: v9.6.0, v9.5.4, v9.5.3",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/tags",
              "detail": "Railgun-Community/wallet: latest tags: v10.9.0, v10.8.6, v10.8.5",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/tags",
              "detail": "Railgun-Community/shared-models: latest tags: v8.0.1, v8.0.0, v7.6.2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/tags",
              "detail": "Railgun-Community/deployments: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/tags",
              "detail": "Railgun-Community/waku-broadcaster-client: latest tags: v9.1.1, v9.1.0, v9.0.6",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/tags",
              "detail": "Railgun-Community/private-proof-of-innocence: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/tags",
              "detail": "Railgun-Community/subsquid-integration: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/tags",
              "detail": "Railway-Wallet/Railway-Wallet: latest tags: v5.26.1, v5.24.21, v5.24.18",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": true,
                "detail": "5 of 10 recent commits signed"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": false,
                "detail": "0 of 1 recent commits signed"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/commits?per_page=10",
              "detail": "Railgun-Privacy/contract: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/commits?per_page=10",
              "detail": "Railgun-Privacy/circuits-v2: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/commits?per_page=10",
              "detail": "Railgun-Community/engine: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/commits?per_page=10",
              "detail": "Railgun-Community/wallet: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/commits?per_page=10",
              "detail": "Railgun-Community/shared-models: 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/commits?per_page=10",
              "detail": "Railgun-Community/deployments: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/commits?per_page=10",
              "detail": "Railgun-Community/waku-broadcaster-client: 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/commits?per_page=10",
              "detail": "Railgun-Community/private-proof-of-innocence: 5 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/commits?per_page=10",
              "detail": "Railgun-Community/subsquid-integration: 0 of 1 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/commits?per_page=10",
              "detail": "Railway-Wallet/Railway-Wallet: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": true,
                "detail": "10 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/contents/?ref=main",
              "detail": "Railgun-Privacy/contract: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/contents/?ref=main",
              "detail": "Railgun-Privacy/circuits-v2: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/contents/?ref=main",
              "detail": "Railgun-Community/engine: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/contents/?ref=main",
              "detail": "Railgun-Community/wallet: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/contents/?ref=main",
              "detail": "Railgun-Community/shared-models: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/contents/?ref=master",
              "detail": "Railgun-Community/deployments: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/contents/?ref=main",
              "detail": "Railgun-Community/waku-broadcaster-client: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/contents/?ref=main",
              "detail": "Railgun-Community/private-proof-of-innocence: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/contents/?ref=main",
              "detail": "Railgun-Community/subsquid-integration: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/contents/?ref=main",
              "detail": "Railway-Wallet/Railway-Wallet: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "Railgun-Privacy/contract",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Railgun-Privacy/circuits-v2",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Railgun-Community/engine",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Railgun-Community/wallet",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "Railgun-Community/shared-models",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Railgun-Community/deployments",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Railgun-Community/waku-broadcaster-client",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Railgun-Community/private-proof-of-innocence",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "Railgun-Community/subsquid-integration",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "Railway-Wallet/Railway-Wallet",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/contract/contents/?ref=main",
              "detail": "Railgun-Privacy/contract: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Privacy/circuits-v2/contents/?ref=main",
              "detail": "Railgun-Privacy/circuits-v2: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/engine/contents/?ref=main",
              "detail": "Railgun-Community/engine: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/wallet/contents/?ref=main",
              "detail": "Railgun-Community/wallet: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/shared-models/contents/?ref=main",
              "detail": "Railgun-Community/shared-models: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/deployments/contents/?ref=master",
              "detail": "Railgun-Community/deployments: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/waku-broadcaster-client/contents/?ref=main",
              "detail": "Railgun-Community/waku-broadcaster-client: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/private-proof-of-innocence/contents/?ref=main",
              "detail": "Railgun-Community/private-proof-of-innocence: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railgun-Community/subsquid-integration/contents/?ref=main",
              "detail": "Railgun-Community/subsquid-integration: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Railway-Wallet/Railway-Wallet/contents/?ref=main",
              "detail": "Railway-Wallet/Railway-Wallet: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Logical architecture only (contracts, UTXO Merkle tree, zk-SNARKs, broadcasters, SDK) on docs.railgun.org; integration via the SDK and Adapt Modules pages. No infrastructure view, as there is no operator-run infrastructure.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.railgun.org/wiki/learn/privacy-system.md",
              "detail": "The privacy-system page and its children (zero-knowledge cryptography, trusted setup, community broadcasters) describe the components; integrating-railgun pages cover SDKs and Adapt Modules.",
              "quote": "The RAILGUN privacy system is a series of smart contracts that privatizes blockchain interactions.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Onchain fee switch. 0.25% on shield and unshield goes to the treasury contract, distributed to RAIL stakers (4.2% of the treasury every two weeks per the docs). No foundation or grant funding of maintenance was found.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "address": "0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
              "block_number": 26153698,
              "detail": "shieldFee() = 25 and unshieldFee() = 25; treasury() = 0xE8A8B458BcD1Ececc6b6b58F80929b29cCecFF40.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x01c37790",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000019"
              },
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.railgun.org/wiki/rail-token/rail-security-rewards.md",
              "detail": "Treasury allocation to RAIL stakers.",
              "quote": "4.2% of the treasury tokens are allocated to the claiming mechanism every 2 weeks.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The fees reward stakers, not a named maintainer; how contract and SDK development is paid for is not documented.",
          "checked_at": "2026-10-09"
        },
        "B12.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.railgun.org/wiki/learn/common-misconceptions.md",
              "detail": "The only screening in the path is the optional PPOI layer, which checks new shields against public lists; the contracts process transactions with or without it. Contracts (grep for sanction/ofac/country) and SDK (OFAC list check) contain list lookups only, no model or AI component.",
              "quote": "is an optional compliance layer, separate from the core RAILGUN contracts, that screens new shields against public bad-actor lists.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        }
      }
    },
    "request-network": {
      "slug": "request-network",
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "0.9% per transaction, capped at $500 (hosted API path)",
            "basis": "Request Network pricing page; the docs say the rate can change, is not published there, and is returned per payment in metadata.protocolFee; the payer bears it by default.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "none in the contract (open protocol path)",
            "basis": "ERC20FeeProxy takes no protocol fee; feeAmount and feeAddress are call parameters chosen by whoever builds the payment (for example an integrator's platform fee).",
            "evidence_index": 2
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "gas included on EVM chains (hosted API path)",
            "basis": "Pricing page; on Tron the payer pays a flat $3.99 per transaction.",
            "evidence_index": 1
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Base sample 2026-10-07, about 0.0000025 ETH (217,904 gas at 0.0116 gwei plus L1 fee)",
            "basis": "Gas of one live payment on the open path (tx 0x2580…3d4e, block 52282170); that call also ran an Across fill, so a direct proxy call costs less. Varies with Base gas price.",
            "evidence_index": 3
          },
          {
            "kind": "network",
            "paid_by": "payee",
            "amount": "0.0999 xDAI per stored request (Gnosis storage fee, up to 1000 bytes)",
            "basis": "RequestOpenHashSubmitter.getFeesAmount(1000) on Gnosis Chain; paid by whoever stores the request (usually the payee or its Request Node); the fee parameters are set by the Request admin Safe.",
            "evidence_index": 4
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://request.network/pricing/",
            "detail": "Pricing page states a flat 0.9% fee per transaction capped at $500, no monthly, setup or minimum fees.",
            "checked_at": "2026-10-09",
            "quote": "Flat fee on transaction volume, capped at $500 per transaction",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://request.network/pricing/",
            "detail": "Pricing page says gas is included on EVM chains and Tron payers pay a flat $3.99.",
            "checked_at": "2026-10-09",
            "quote": "On EVM chains gas is included",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/RequestNetwork/requestNetwork/blob/749b13070bcb88be4a10b8d59fcf3705339d43e0/packages/smart-contracts/src/contracts/ERC20FeeProxy.sol#L34-L58",
            "commit": "749b13070bcb88be4a10b8d59fcf3705339d43e0",
            "path": "packages/smart-contracts/src/contracts/ERC20FeeProxy.sol",
            "detail": "transferFromWithReferenceAndFee moves _amount to the payee and _feeAmount to _feeAddress, both supplied by the caller; the contract has no fee of its own.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://basescan.org/tx/0x2580e807b575a321c20e3134eea8e18a0edba56ae97ca25b315215e0a7113d4e",
            "chain_id": 8453,
            "block_number": 52282170,
            "detail": "Receipt read 2026-10-09: gasUsed 217904, effectiveGasPrice 11605490 wei, l1Fee 5950085349 wei; the ERC20FeeProxy TransferWithReferenceAndFee log pays 3.0 USDC with feeAmount 0. Block time 2026-10-07 06:14 UTC.",
            "checked_at": "2026-10-09",
            "recheck": "cast receipt 0x2580e807b575a321c20e3134eea8e18a0edba56ae97ca25b315215e0a7113d4e --rpc-url https://mainnet.base.org"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://gnosisscan.io/address/0x268C146Afb4790902Ee26A6D2d3aff968623Ec80",
            "address": "0x268C146Afb4790902Ee26A6D2d3aff968623Ec80",
            "chain_id": 100,
            "block_number": 48666105,
            "detail": "getFeesAmount(1000) and minimumFee() on RequestOpenHashSubmitter both return 99900000000000000 wei (0.0999 xDAI) at Gnosis block 48666105.",
            "checked_at": "2026-10-09",
            "recheck": "cast call 0x268C146Afb4790902Ee26A6D2d3aff968623Ec80 \"getFeesAmount(uint256)(uint256)\" 1000 --rpc-url https://rpc.gnosischain.com"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/api-features/protocol-fees.mdx#L6-L25",
            "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
            "path": "api-features/protocol-fees.mdx",
            "detail": "Docs say a protocol fee applies to all API payments, the rate can change and is not published in the docs, and the payer bears it by default.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Two fee regimes. The open protocol path (the CROPS unit) charges no protocol fee in contract; the hosted API path charges 0.9% and includes gas. FX applies only to conversion payments, through Chainlink rates in ChainlinkConversionPath, and no FX margin is stated. No limits are published beyond the $500 fee cap and API rate limits.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          },
          {
            "criterion": "S1",
            "index": 2
          }
        ],
        "note": "Agrees with S1 (score 1). Funds move payer to payee in one call and are never held. The disclosed risk is that the 3-of-7 admin Safe can repoint Erc20ConversionProxy's delegatecall target and so redirect future conversion payments or open allowances; it does not hold funds.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://request.network/legal-notice/",
            "detail": "Legal notice names the Swiss foundation and its register number and cites no licence or regulator.",
            "checked_at": "2026-10-09",
            "quote": "Request Network is a Swiss Stiftung",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://request.network/api-terms-and-conditions/",
            "detail": "API terms (last update 2025-12-22) state the foundation does not custody funds or process financial transactions; no licence is cited anywhere in the terms.",
            "checked_at": "2026-10-09",
            "quote": "REQUEST NETWORK DOES NOT CUSTODY FUNDS OR PROCESS FINANCIAL TRANSACTIONS",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE422666391",
            "archive": "data/archive/request-network-ops-uid-register.txt",
            "detail": "Swiss UID register entry for the foundation (commercial register and VAT data only; the UID register carries no financial licences).",
            "checked_at": "2026-10-09",
            "quote": "Request Network Stiftung",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Searched: the legal notice, API terms, privacy policy and pricing page (no licence or regulator named); the Swiss UID register entry; a finma.ch site search for \"Request Network\" (2 unrelated pages, no authorisation). Not searched: FINMA's authorised-institutions application and the Swiss AML self-regulatory organisations' member lists. Off-ramp flows on the hosted API run through Request Tech, whose licences were not looked up.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "On the open protocol path the payee receives the token in its own wallet; converting it to local currency is outside the protocol.",
        "burden": "institution",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/api-features/crypto-to-fiat-payments.mdx#L8",
            "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
            "path": "api-features/crypto-to-fiat-payments.mdx",
            "detail": "The hosted API offers an optional crypto-to-fiat flow through Request Tech off-ramp infrastructure, with payer KYC and a registered bank account; the docs give no fee, limit or country terms for it.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The optional Request Tech off-ramp is not recorded as a cash-out row because no first-party fee, limit or country terms were found for it.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2024-02-20",
            "block": 10827274,
            "what": "ERC20FeeProxy 0.2.0 on Base (tx 0x6db84f…0055, CREATE2). EthereumFeeProxy was deployed at 10827264 and Erc20ConversionProxy at 10827277, the same day."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814?fields=deployment",
              "address": "0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
              "chain_id": 8453,
              "block_number": 10827274,
              "detail": "Sourcify creation data gives transactionHash 0x6db84fa34fc60ad3217e532fc9cbe1b7514e2a1abf50e2b45bb21e3ba0220055, blockNumber 10827274, deployer 0x4E64C2d06d19D13061e62E291b2C4e9fe5679b93; the block timestamp is 2024-02-20 UTC.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://sourcify.dev/server/v2/contract/8453/0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814?fields=deployment\" && cast block 10827274 --field timestamp --rpc-url https://mainnet.base.org"
            }
          ],
          "note": "This is the Base deployment, the unit of assessment. Request Network ran on Ethereum mainnet years earlier; that history is outside the unit.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Request Network Stiftung (Request Network Foundation)",
            "jurisdiction": "CH-ZG",
            "register_url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE422666391",
            "registration_number": "CHE-422.666.391"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE422666391",
              "archive": "data/archive/request-network-ops-uid-register.txt",
              "detail": "UID register entry, status active, legal form foundation (Stiftung), commercial-register reference CH-170.7.000.846-1, domicile c/o Coin Finance AG, Gartenstrasse 5, 6300 Zug.",
              "checked_at": "2026-10-09",
              "quote": "CH-170.7.000.846-1",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/legal-notice/",
              "detail": "Legal notice names the foundation, its register number CHE-422.666.391 and a Baarerstrasse 82 (c/o Abafin Treuhand AG) address in Zug.",
              "checked_at": "2026-10-09",
              "quote": "Request Network is a Swiss Stiftung",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The legal notice and API terms give a Baarerstrasse 82 c/o address; the UID register (last checked 2026-09-28) gives Gartenstrasse 5 c/o Coin Finance AG. The register is the primary source.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/security-advisories",
              "detail": "The repository's published security advisories list is empty.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/RequestNetwork/requestNetwork/security-advisories --jq length"
            }
          ],
          "note": "Searched: GitHub security advisories for the monorepo, the docs repo release notes, the status page (status.request.network, history is client-rendered and was not read), and the CROPS S6 search (no audit, no bounty). No incident affecting the Base payment contracts was found. Third-party incident databases were not used.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-12-22",
              "summary": "API terms and conditions updated (current version); they name the Swiss foundation as operator of the API and reserve the right to suspend access without notice.",
              "url": "https://request.network/api-terms-and-conditions/"
            },
            {
              "date": "2026-07-01",
              "summary": "Hosted API release notes add an orchestrator fee layer stacking on the protocol fee, Safe multisig payers, gasless approvals and Merkle Science KYT (docs commit 9152cc23).",
              "url": "https://github.com/RequestNetwork/mintlify-docs/commit/9152cc23c6606b86e68606e2188408300de79092"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/api-terms-and-conditions/",
              "detail": "API terms page carries its update date.",
              "checked_at": "2026-10-09",
              "quote": "Last Update: December 22, 2025",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/release-notes/request-api.mdx#L25-L30",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "release-notes/request-api.mdx",
              "detail": "2026-Q2 release note introducing orchestrators and the configurable orchestrator fee model; git log dates the docs change to 2026-07-01 (9152cc23).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The Base payment contracts are immutable and unchanged since deployment. Release notes are labelled by quarter, so dates come from the docs commit.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 8453,
          "addresses": [
            "0x1892196E80C4c17ea5100Da765Ab48c1fE2Fb814",
            "0x8296D56321cf207925a7804E5A8E3F579838e6Ad"
          ],
          "topic0": "0x9f16cbcc523c67a60c450e5ffe4f3b7b6dbe772e7abcadb2686ce029a9a0a2b6",
          "event": "TransferWithReferenceAndFee(address tokenAddress, address to, uint256 amount, bytes indexed paymentReference, uint256 feeAmount, address feeAddress)",
          "token_word": 0,
          "amount_word": 2,
          "window_days": 30,
          "exclusions": "Payee amount only (word 2); feeAmount (word 3) is excluded. Erc20ConversionProxy delegatecalls ERC20FeeProxy, so conversion payments emit the same event from 0x8296…e6Ad and are counted once. Native payments through EthereumFeeProxy (different event) are not counted. Gross observed, including tests and self-payments."
        },
        "note": "Spec checked against the live log in tx 0x2580…3d4e (word 0 USDC, word 2 = 3000000). Not computed; the maintainer runs scripts/volumes.mjs.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: eth_getLogs: request limit reached"
      },
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/contents/?ref=master",
              "detail": "RequestNetwork/requestNetwork: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/payments-subgraph: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/storage-subgraph: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/contents/?ref=main",
              "detail": "RequestNetwork/request-helm-charts: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/contents/?ref=main",
              "detail": "RequestNetwork/docker-images: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/contents/?ref=main",
              "detail": "RequestNetwork/web-components: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/contents/?ref=main",
              "detail": "RequestNetwork/invoicing-template: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/contents/?ref=main",
              "detail": "RequestNetwork/easy-invoice: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/contents/?ref=main",
              "detail": "RequestNetwork/mintlify-docs: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "not_applicable",
          "reason": "No closed component is required on the open protocol path, so patching the components an institution runs falls to it. For the optional hosted API, no patch timeline is published; the docs promise only security fixes for the previous API version for 6 months.",
          "burden": "institution",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/release-notes/index.mdx#L31-L35",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "release-notes/index.mdx",
              "detail": "Version support says the previous API version gets security updates and critical bug fixes for 6 months; no time-to-patch commitment by severity.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": true,
                "detail": "scanning step in a workflow"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/contents/?ref=master",
              "detail": "RequestNetwork/requestNetwork: scanning step in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/payments-subgraph: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/storage-subgraph: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/contents/?ref=main",
              "detail": "RequestNetwork/request-helm-charts: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/contents/?ref=main",
              "detail": "RequestNetwork/docker-images: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/contents/?ref=main",
              "detail": "RequestNetwork/web-components: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/contents/?ref=main",
              "detail": "RequestNetwork/invoicing-template: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/contents/?ref=main",
              "detail": "RequestNetwork/easy-invoice: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/contents/?ref=main",
              "detail": "RequestNetwork/mintlify-docs: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Status page at status.request.network for the hosted API; no post-mortem found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.request.network",
              "detail": "Hosted status page (UptimeRobot) with uptime history and email subscription; incident history is client-rendered and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Request Network Status",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/release-notes/index.mdx#L25-L40",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "release-notes/index.mdx",
              "detail": "Docs point integrators to the status page for critical updates.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "Browser calls to the hosted API use a static x-client-id plus the Origin header, scoped to allowed domains and revocable; no OAuth, OpenID Connect or JWT.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/api-reference/authentication.mdx#L8-L20",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "api-reference/authentication.mdx",
              "detail": "Two modes, x-api-key for servers and x-client-id with Origin for browsers.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S5",
              "index": 2
            }
          ],
          "note": "Applies only to the optional hosted API; the open SDK path has no API.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Server calls use a static x-api-key header; webhooks are HMAC-SHA256 signed. No key scoping, expiry or rotation schedule is documented.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/api-reference/authentication.mdx#L22-L31",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "api-reference/authentication.mdx",
              "detail": "API key authentication for backend calls via the x-api-key header.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S5",
              "index": 1
            },
            {
              "criterion": "S5",
              "index": 2
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Privacy policy lists encryption in transit and at storage, two-factor and role-based authentication, continuous monitoring and restricted admin server access; no data classification or TLS version is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/privacy-policy/",
              "detail": "Protection measures section of the privacy policy (last update 2025-03-19).",
              "checked_at": "2026-10-09",
              "quote": "Encryption during exchanges and storage",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Retention per purpose, from 2 years (account and service-use data, after last use if not closed) to 5 years (support requests); data stored in Europe. Termination of an API account is by email request; deletion on termination is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/privacy-policy/",
              "detail": "Retention table in the privacy policy.",
              "checked_at": "2026-10-09",
              "quote": "2 years after the last use of Your account if not closed",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/api-terms-and-conditions/",
              "detail": "API terms termination clause.",
              "checked_at": "2026-10-09",
              "quote": "To request account closure, contact us at support.api@request.network",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 2
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Request Network is controller for its sites and services and acts as processor for data handled on a customer's behalf (that processing is outside the policy). No DPIA is mentioned.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/privacy-policy/",
              "detail": "Definitions section names the controller and excludes processing as processor.",
              "checked_at": "2026-10-09",
              "quote": "Here, the Data controller is Request Network.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": true,
                "detail": "deployment configuration: docker-compose.yml"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": true,
                "detail": "deployment configuration: docker-compose.yml"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": true,
                "detail": "deployment configuration: charts/"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": true,
                "detail": "deployment configuration: docker-compose.yml"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/contents/?ref=master",
              "detail": "RequestNetwork/requestNetwork: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/payments-subgraph: deployment configuration: docker-compose.yml",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/storage-subgraph: deployment configuration: docker-compose.yml",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/contents/?ref=main",
              "detail": "RequestNetwork/request-helm-charts: deployment configuration: charts/",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/contents/?ref=main",
              "detail": "RequestNetwork/docker-images: deployment configuration: docker-compose.yml",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/contents/?ref=main",
              "detail": "RequestNetwork/web-components: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/contents/?ref=main",
              "detail": "RequestNetwork/invoicing-template: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/contents/?ref=main",
              "detail": "RequestNetwork/easy-invoice: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/contents/?ref=main",
              "detail": "RequestNetwork/mintlify-docs: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": true,
                "detail": "rules: pull_request, deletion, non_fast_forward"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/rules/branches/master",
              "detail": "RequestNetwork/requestNetwork: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/rules/branches/main",
              "detail": "RequestNetwork/payments-subgraph: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/rules/branches/main",
              "detail": "RequestNetwork/storage-subgraph: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/rules/branches/main",
              "detail": "RequestNetwork/request-helm-charts: rules: pull_request, deletion, non_fast_forward",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/rules/branches/main",
              "detail": "RequestNetwork/docker-images: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/rules/branches/main",
              "detail": "RequestNetwork/web-components: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/rules/branches/main",
              "detail": "RequestNetwork/invoicing-template: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/rules/branches/main",
              "detail": "RequestNetwork/easy-invoice: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/rules/branches/main",
              "detail": "RequestNetwork/mintlify-docs: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": true,
                "detail": "7 workflow file(s)"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": true,
                "detail": "4 workflow file(s)"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": true,
                "detail": "4 workflow file(s)"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": false,
                "detail": "4 workflow file(s)"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": false,
                "detail": "6 workflow file(s)"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": true,
                "detail": "5 workflow file(s)"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": true,
                "detail": "6 workflow file(s)"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": true,
                "detail": "6 workflow file(s)"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "2 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/contents/?ref=master",
              "detail": "RequestNetwork/requestNetwork: 7 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/payments-subgraph: 4 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/storage-subgraph: 4 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/contents/?ref=main",
              "detail": "RequestNetwork/request-helm-charts: 4 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/contents/?ref=main",
              "detail": "RequestNetwork/docker-images: 6 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/contents/?ref=main",
              "detail": "RequestNetwork/web-components: 5 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/contents/?ref=main",
              "detail": "RequestNetwork/invoicing-template: 6 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/contents/?ref=main",
              "detail": "RequestNetwork/easy-invoice: 6 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/contents/?ref=main",
              "detail": "RequestNetwork/mintlify-docs: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/contents/?ref=master",
              "detail": "RequestNetwork/requestNetwork: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/payments-subgraph: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/storage-subgraph: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/contents/?ref=main",
              "detail": "RequestNetwork/request-helm-charts: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/contents/?ref=main",
              "detail": "RequestNetwork/docker-images: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/contents/?ref=main",
              "detail": "RequestNetwork/web-components: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/contents/?ref=main",
              "detail": "RequestNetwork/invoicing-template: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/contents/?ref=main",
              "detail": "RequestNetwork/easy-invoice: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/contents/?ref=main",
              "detail": "RequestNetwork/mintlify-docs: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/contents/?ref=master",
              "detail": "RequestNetwork/requestNetwork: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/payments-subgraph: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/storage-subgraph: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/contents/?ref=main",
              "detail": "RequestNetwork/request-helm-charts: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/contents/?ref=main",
              "detail": "RequestNetwork/docker-images: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/contents/?ref=main",
              "detail": "RequestNetwork/web-components: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/contents/?ref=main",
              "detail": "RequestNetwork/invoicing-template: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/contents/?ref=main",
              "detail": "RequestNetwork/easy-invoice: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/contents/?ref=main",
              "detail": "RequestNetwork/mintlify-docs: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": true,
                "detail": "latest tags: v0.12.0, v0.10.0, requestnetworkartifacts@1.6.0"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": false,
                "detail": "latest tags: request-node-0.9.0, request-node-0.8.1, request-node-0.8.0"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": false,
                "detail": "latest tags: requestnetwork_request-ipfs_0.4.23-2, request-node-0.29.0, request-node-0.27.0"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": true,
                "detail": "latest tags: 0.13.0, 0.12.1, 0.12.0"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": true,
                "detail": "latest tags: 0.15.0, 0.14.0, 0.13.0"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/tags",
              "detail": "RequestNetwork/requestNetwork: latest tags: v0.12.0, v0.10.0, requestnetworkartifacts@1.6.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/tags",
              "detail": "RequestNetwork/payments-subgraph: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/tags",
              "detail": "RequestNetwork/storage-subgraph: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/tags",
              "detail": "RequestNetwork/request-helm-charts: latest tags: request-node-0.9.0, request-node-0.8.1, request-node-0.8.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/tags",
              "detail": "RequestNetwork/docker-images: latest tags: requestnetwork_request-ipfs_0.4.23-2, request-node-0.29.0, request-node-0.27.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/tags",
              "detail": "RequestNetwork/web-components: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/tags",
              "detail": "RequestNetwork/invoicing-template: latest tags: 0.13.0, 0.12.1, 0.12.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/tags",
              "detail": "RequestNetwork/easy-invoice: latest tags: 0.15.0, 0.14.0, 0.13.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/tags",
              "detail": "RequestNetwork/mintlify-docs: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/commits?per_page=10",
              "detail": "RequestNetwork/requestNetwork: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/commits?per_page=10",
              "detail": "RequestNetwork/payments-subgraph: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/commits?per_page=10",
              "detail": "RequestNetwork/storage-subgraph: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/commits?per_page=10",
              "detail": "RequestNetwork/request-helm-charts: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/commits?per_page=10",
              "detail": "RequestNetwork/docker-images: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/commits?per_page=10",
              "detail": "RequestNetwork/web-components: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/commits?per_page=10",
              "detail": "RequestNetwork/invoicing-template: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/commits?per_page=10",
              "detail": "RequestNetwork/easy-invoice: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/commits?per_page=10",
              "detail": "RequestNetwork/mintlify-docs: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": true,
                "detail": "10 release(s) with notes"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/contents/?ref=master",
              "detail": "RequestNetwork/requestNetwork: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/payments-subgraph: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/storage-subgraph: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/contents/?ref=main",
              "detail": "RequestNetwork/request-helm-charts: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/contents/?ref=main",
              "detail": "RequestNetwork/docker-images: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/contents/?ref=main",
              "detail": "RequestNetwork/web-components: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/contents/?ref=main",
              "detail": "RequestNetwork/invoicing-template: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/contents/?ref=main",
              "detail": "RequestNetwork/easy-invoice: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/contents/?ref=main",
              "detail": "RequestNetwork/mintlify-docs: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "RequestNetwork/requestNetwork",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "RequestNetwork/payments-subgraph",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "RequestNetwork/storage-subgraph",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "RequestNetwork/request-helm-charts",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "RequestNetwork/docker-images",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "RequestNetwork/web-components",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "RequestNetwork/invoicing-template",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "RequestNetwork/easy-invoice",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "RequestNetwork/mintlify-docs",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/requestNetwork/contents/?ref=master",
              "detail": "RequestNetwork/requestNetwork: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/payments-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/payments-subgraph: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/storage-subgraph/contents/?ref=main",
              "detail": "RequestNetwork/storage-subgraph: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/request-helm-charts/contents/?ref=main",
              "detail": "RequestNetwork/request-helm-charts: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/docker-images/contents/?ref=main",
              "detail": "RequestNetwork/docker-images: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/web-components/contents/?ref=main",
              "detail": "RequestNetwork/web-components: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/invoicing-template/contents/?ref=main",
              "detail": "RequestNetwork/invoicing-template: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/easy-invoice/contents/?ref=main",
              "detail": "RequestNetwork/easy-invoice: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/RequestNetwork/mintlify-docs/contents/?ref=main",
              "detail": "RequestNetwork/mintlify-docs: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical view (request lifecycle across IPFS, Gnosis storage and payment contracts) in the docs repo; integration and infrastructure for self-hosting in the Request Node README and Helm chart. No single architecture document covers all three views or the hosted API.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/resources/lifecycle-of-a-request.mdx#L1-L43",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "resources/lifecycle-of-a-request.mdx",
              "detail": "Lifecycle page with a diagram covering create, update, pay and detect, naming IPFS, the Gnosis storage contract, payment contracts and the payments subgraph.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C3",
              "index": 1
            },
            {
              "criterion": "O4",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Request Network Stiftung (Request Network Foundation), Zug, Switzerland, CHE-422.666.391; API terms under Swiss law, courts of Zug.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE422666391",
              "archive": "data/archive/request-network-ops-uid-register.txt",
              "detail": "UID register entry for the foundation.",
              "checked_at": "2026-10-09",
              "quote": "Request Network Stiftung",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/api-terms-and-conditions/",
              "detail": "API terms name the foundation as operator of the API.",
              "checked_at": "2026-10-09",
              "quote": "Request Network Foundation, a Swiss foundation (Stiftung)",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Only relevant to the optional hosted API; the open path needs no contract with anyone.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Per-transaction protocol fee on hosted API payments (0.9%, capped at $500) collected by the foundation; the open fee proxies carry no fee.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/pricing/",
              "detail": "Pricing page states the fee and that there are no monthly or setup fees.",
              "checked_at": "2026-10-09",
              "quote": "Flat fee on transaction volume, capped at $500 per transaction",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No annual report or treasury statement was found; the foundation's other funding (for example REQ token holdings) is not evidenced here.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Either side can end API access; Request may suspend or revoke credentials without notice, and deactivates credentials unused for 12 months with one month's notice. Funds are never held, so termination does not affect funds.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://request.network/api-terms-and-conditions/",
              "detail": "Account suspension and deletion section of the API terms.",
              "checked_at": "2026-10-09",
              "quote": "Such actions may be taken without prior notice and shall not entitle you to any compensation",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S1",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Optional automated wallet screening (Hypernative by default, Merkle Science optional) on the hosted Secure Payment page, enabled per destination; the docs describe it as rules and exposure thresholds, not a learned model. No automated decision in the open protocol path.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/use-cases/hypernative-standard-screening-policy.mdx#L8-L19",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "use-cases/hypernative-standard-screening-policy.mdx",
              "detail": "Payer and recipient wallets are screened against Hypernative's risk database before authorisation when enabled; users may opt out; the policy uses rules and thresholds maintained by Hypernative.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            },
            {
              "criterion": "C4",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "Screening categories, thresholds and a per-destination opt-out (override) are published; monitoring, validation, decommissioning and bias evaluation of the screening are not documented.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/RequestNetwork/mintlify-docs/blob/1845bc537542f65a5e8c9826ebccc3ba053c4fd1/use-cases/hypernative-standard-screening-policy.mdx#L17-L64",
              "commit": "1845bc537542f65a5e8c9826ebccc3ba053c4fd1",
              "path": "use-cases/hypernative-standard-screening-policy.mdx",
              "detail": "Opt-out statement, high-risk categories and exposure thresholds table.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      }
    },
    "rizon-card": {
      "slug": "rizon-card",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement from Rizon (site, Terms, privacy policy, help centre \"How secure is Rizon?\"). Rain lists SOC 2 Type II and PCI DSS, not ISO 27001.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "attested",
          "value": "Rizon states nothing. Partner (Rain): SOC 2 Type II and PCI DSS, reports available to partners on request through its trust center; not read.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page (Signify Holdings, Inc.), section \"Security reports and policies\"; the trust center at trust.rain.xyz is a client-rendered Vanta page and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Partners and prospective partners can request our SOC 2 report, PCI DSS attestation, penetration test summary, and security policies through our trust center",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy (last updated 16 July 2026), Security section.",
              "checked_at": "2026-10-09",
              "quote": "Rain maintains SOC 2 Type II certification",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "attested",
          "value": "Rizon says the per-user vault is deployed and maintained by Rain; Rain says its smart contracts are independently audited before launch and per chain. No report is linked and no Rizon contract address is published (CROPS S6 unknown). Nothing covers the Rizon app.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/11173615-secure-reliable",
              "detail": "Rizon help centre, \"Secure & reliable\" (30 April 2025).",
              "checked_at": "2026-10-09",
              "quote": "This vault is deployed and maintained by Rain Cards",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Smart contract audits\"; no report is linked from the page.",
              "checked_at": "2026-10-09",
              "quote": "Our smart contracts are reviewed by independent auditors before launch and again for each new chain we support",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "attested",
          "value": "Rizon states nothing. Partner (Rain): a penetration test summary is available to partners through its trust center.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page (Signify Holdings, Inc.), section \"Security reports and policies\"; the trust center at trust.rain.xyz is a client-rendered Vanta page and was not read.",
              "checked_at": "2026-10-09",
              "quote": "Partners and prospective partners can request our SOC 2 report, PCI DSS attestation, penetration test summary, and security policies through our trust center",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "evidenced",
          "value": "Rizon states nothing. Partner (Rain): code peer-reviewed and automatically scanned before production; no cadence stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Secure development\".",
              "checked_at": "2026-10-09",
              "quote": "Code is peer-reviewed and automatically scanned for vulnerabilities before it reaches production",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No patch timelines from Rizon or Rain.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "evidenced",
          "value": "Rizon makes no incident-notification commitment in its Terms or privacy policy. Partner (Rain): documented incident response plan that keeps partners informed; no time stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Detection and response\".",
              "checked_at": "2026-10-09",
              "quote": "Security events are monitored centrally, and a documented incident response plan guides how we act and keep partners informed",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "The help centre says funds stay accessible if Rizon stops operating because the wallet is non-custodial; that is a claim about exit, not a recovery plan (see CROPS S4, unknown).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Rizon publishes no status page. Partner (Rain): status.rain.xyz with incident history; no post-mortems found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/",
              "detail": "Rain Platform Status (cState), with components for onboarding, API, card issuing, authorizations, disputes and collateral, and a paged incident history back to 2025.",
              "checked_at": "2026-10-09",
              "quote": "We continuously monitor the performance and availability of our services",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/",
              "detail": "Read the incident pages listed on status.rain.xyz pages 1 to 3 (2025-06-12 to 2026-09-28) on 2026-10-09. Updates give a one-line cause at most (partner OS patching, payment processor, expired certificate, processor rules engine); the 2026-09-28 incident says the root cause is still being investigated, and no post-mortem is linked from any incident.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/ | grep -i \"root cause\""
            }
          ],
          "note": "Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Rizon states it uses multi-factor authentication and biometric login; the Privy wallet uses Face ID, passkeys and biometric verification. The factors and whether MFA is mandatory are not specified.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/13441542-how-secure-is-rizon",
              "detail": "Rizon help centre, \"How secure is Rizon?\" (20 January 2026).",
              "checked_at": "2026-10-09",
              "quote": "We use advanced encryption, multi-factor authentication, and biometric login to keep your account safe",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "No public API documentation; dashboard.getrizon.com is a business login shell (CROPS research log).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Rizon: \"advanced encryption\" (no detail). Partner (Rain): encryption in transit and at rest, PCI DSS for card data. Observed: www.getrizon.com refuses TLS 1.1 and accepts TLS 1.2. No data classification.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/13441542-how-secure-is-rizon",
              "detail": "Rizon help centre, \"How secure is Rizon?\".",
              "checked_at": "2026-10-09",
              "quote": "We use advanced encryption",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Security section: encryption in transit and at rest, access controls, multifactor authentication, tokenization, PCI DSS for card data.",
              "checked_at": "2026-10-09",
              "quote": "encryption of sensitive data in transit and at rest",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://www.getrizon.com",
              "detail": "openssl s_client -tls1_1 to www.getrizon.com:443 failed with alert protocol version; -tls1_2 negotiated an ECDHE cipher. Run 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect www.getrizon.com:443 -servername www.getrizon.com -tls1_1; echo | openssl s_client -connect www.getrizon.com:443 -servername www.getrizon.com -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Retention table in the privacy policy: AML/KYC data up to 8 years after the relationship ends under Lithuanian AML law (extendable by 2 years); advertising and social media data up to 5 years; marketing until consent is withdrawn. Card data at Rain: five years or longer after closure (Rain policy).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/privacy-policy",
              "detail": "Rizon privacy policy (effective 24 April 2025), purposes, legal bases and retention table.",
              "checked_at": "2026-10-09",
              "quote": "Up to 8 (eight) years as provided in the Law on Prevention of Money Laundering and Terrorist Financing of the Republic of Lithuania",
              "archive": "data/archive/rizon-card-ops-privacy-policy.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Retention section.",
              "checked_at": "2026-10-09",
              "quote": "Customer identification records, transaction records, and related regulated financial services records may be retained for five years or longer following account closure",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Rizon Global, Inc. processes data under the GDPR and Lithuanian law; the policy does not use the terms controller or processor and makes no DPIA statement. Card issuance data is controlled by Nimbus LLC (Third National) under Rain's policy.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/privacy-policy",
              "detail": "Rizon privacy policy, Purpose and Scope.",
              "checked_at": "2026-10-09",
              "quote": "such as the EU General Data Protection Regulation",
              "archive": "data/archive/rizon-card-ops-privacy-policy.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Entity Roles and Data Flows: Nimbus LLC d/b/a Third National is controller for card issuance.",
              "checked_at": "2026-10-09",
              "quote": "For card issuance and customer account services, Nimbus LLC generally acts as a controller",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "evidenced",
          "value": "Rizon states nothing. Partner (Rain): security events monitored centrally; no SIEM or endpoint detection named.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.rain.xyz/security",
              "detail": "Rain security page, \"Detection and response\".",
              "checked_at": "2026-10-09",
              "quote": "Security events are monitored centrally, and a documented incident response plan guides how we act and keep partners informed",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Rizon names Rain (Signify Holdings Inc. and its subsidiary Nimbus LLC) as provider of the card, smart contract wallets and transfers, so Rain's security and status pages are recorded as the partner's position.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical view only, in a help article: Privy creates the embedded wallet on the device; deposits go to an onchain vault deployed and maintained by Rain, with the Rizon wallet as its controller. No infrastructure or integration architecture and no contract addresses.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/11173615-secure-reliable",
              "detail": "Rizon help centre, \"Secure & reliable\".",
              "checked_at": "2026-10-09",
              "quote": "This vault is deployed and maintained by Rain Cards",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Rizon Global, Inc., a Delaware C corporation (registered agent at 131 Continental Dr, Newark, DE), with Rizon Technologies, UAB (Lithuania) as commercial agent authorised to conclude agreements in its name; the card terms are three-party with the issuer Third National.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/terms-of-service",
              "detail": "Rizon Terms of Service (effective 30 April 2025), opening paragraph; section 5.3 on Rizon Technologies, UAB.",
              "checked_at": "2026-10-09",
              "quote": "a Delaware C Corporation company established with its registered agent address at 131 Continental Dr Suite 305, Newark, DE 19713 US",
              "archive": "data/archive/rizon-card-ops-terms-of-service.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/11822548-rizon-global-inc-spend-card-terms",
              "detail": "Rizon Global, Inc. Spend Card Terms, Defined Terms.",
              "checked_at": "2026-10-09",
              "quote": "The issuer for this card program is Third National.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Customer fees and subscriptions: paid plans (Gold $3.99/month, Emerald $6.99/month per the help centre), card issuance, FX, small-transaction, ATM, trading and payout fees. No financial statements or funding statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/13441035-are-there-any-fees-for-using-rizon",
              "detail": "Rizon help centre, \"Are there any fees for using Rizon?\" (26 August 2026), plan comparison.",
              "checked_at": "2026-10-09",
              "quote": "Monthly Price Free $3.99/mo $6.99/mo",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Rizon or its partners may suspend, restrict or terminate the account temporarily or permanently, and may cancel or delay pending transactions including card off-ramp; the user can export the Privy wallet and disconnect once the smart-contract balance is zero. The issuer may cancel the card with or without notice. AML data is kept up to 8 years (B6.3).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/terms-of-service",
              "detail": "Rizon Terms of Service, Account Suspension, Restriction, and Termination by Rizon.",
              "checked_at": "2026-10-09",
              "quote": "We on our Partners reserve the right to suspend, restrict, or terminate your Account",
              "archive": "data/archive/rizon-card-ops-terms-of-service.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/terms-of-service",
              "detail": "Rizon Terms of Service, wallet export and disconnection.",
              "checked_at": "2026-10-09",
              "quote": "Once your smart contract held balance reaches zero as reflect through the App, your Digital Wallet is effectively disconnected form the App and Rain account",
              "archive": "data/archive/rizon-card-ops-terms-of-service.txt",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Rizon says it does not use automated decision-making; its card partner Rain uses automated systems for fraud detection, sanctions screening, transaction monitoring and eligibility. Machine learning is not mentioned by either.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/privacy-policy",
              "detail": "Rizon privacy policy, Automated Decision Making.",
              "checked_at": "2026-10-09",
              "quote": "We do not use automated decision-making technologies",
              "archive": "data/archive/rizon-card-ops-privacy-policy.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Automated Processing and Decision-Making.",
              "checked_at": "2026-10-09",
              "quote": "We may use automated systems to support fraud detection, sanctions screening, transaction monitoring, identity verification, biometric matching, eligibility assessments, and risk management",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "Only Rain's override path (human review where law grants it). No monitoring, validation, decommissioning or bias documentation.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://legal.raincards.xyz/legal/privacy-policy",
              "detail": "Rain privacy policy, Automated Processing and Decision-Making: available where applicable law grants the right.",
              "checked_at": "2026-10-09",
              "quote": "request human review, express your point of view, and contest the decision",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Virtual card $10 (free on Gold and Emerald); physical card $49.99 Standard, $24.99 Gold, free Emerald",
            "basis": "Help centre plan comparison; the Global card terms state $10 per virtual card; the site pricing page says \"check app\".",
            "evidence_index": 1
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Optional plans: Gold $3.99/month, Emerald $6.99/month",
            "basis": "Help centre plan comparison; the site advertises Emerald \"from just $5.59/month\".",
            "evidence_index": 1
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Non-USD card spend 1.7% + $0.10 (Standard); 1.275% Gold; 1.02% Emerald",
            "basis": "Site pricing page and help centre; set by Rizon and changeable.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Global card terms: FX fee 1.7% + $0.30, cross-border 0%; US card terms: 1.7% + $0.10",
            "basis": "Card terms Important Disclosures (Global effective 27 June 2026); conflicts with the $0.10 on the pricing page.",
            "evidence_index": 2
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Small transaction fee $0.50 per charge under $1 after 5 free a month ($0.38 Gold, $0.25 Emerald)",
            "basis": "Help centre plan comparison.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM $1 + 0.65% (Standard and Gold); $0.10 Emerald",
            "basis": "Help centre plan comparison and physical card article.",
            "evidence_index": 1
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Onchain withdrawal or international send: network fee + 0.1%",
            "basis": "Site pricing page.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.getrizon.com/fees-and-limits",
            "detail": "Rizon site \"Fees and limits\": deposits free, USD card spend free, non-USD 1.7% + $0.1 (1.02% with Emerald), send and onchain withdrawal network fee + 0.1%, no limits; card issuance \"check app\".",
            "checked_at": "2026-10-09",
            "quote": "Card spend (non-USD transactions) 1.7% + $0.1 1.02 % 1.7% + $0.1",
            "archive": "data/archive/rizon-card-ops-fees-and-limits.txt",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/13441035-are-there-any-fees-for-using-rizon",
            "detail": "Rizon help centre, \"Are there any fees for using Rizon?\", full plan comparison (FX, small-transaction, ATM, card prices).",
            "checked_at": "2026-10-09",
            "quote": "Physical Visa Platinum Card $49.99 $24.99 (50% off) Free Virtual Visa Platinum Card $10 Free Free",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/11822548-rizon-global-inc-spend-card-terms",
            "detail": "Rizon Global, Inc. Spend Card Terms, Important Disclosures effective 2026-06-27; virtual card issuance $10 per card.",
            "checked_at": "2026-10-09",
            "quote": "Foreign Exchange Fee (non USD): 1.7% + $0.3 - Cross Border Fee: 0%",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/11822498-rizon-us-spend-card-terms",
            "detail": "Rizon US Spend Card Terms, account opening disclosures (international transaction fee).",
            "checked_at": "2026-10-09",
            "quote": "1.7% + $0.1 of each transaction in U.S. dollars",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The FX fixed component differs between the Global card terms ($0.30) and the pricing pages ($0.10); both are recorded. Pay-in and pay-out fees for virtual accounts are discounted by plan but the base amounts are not published.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "unknown",
        "note": "CROPS S1 is unknown: no collateral contract can be tied to Rizon. Rizon says balances sit in a Rain-deployed vault controlled by the user's Privy wallet and that Rizon never has access; the card terms let the issuer liquidate collateral. Unverified, so no custody model is recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "attested",
        "value": [
          {
            "entity": "Nimbus LLC d/b/a Third National",
            "holder": "partner",
            "country": "US",
            "regulator": "Not named in any document",
            "type": "Licensed lender and money transmitter; Visa-authorized card issuer (as stated by Rain)",
            "activities": "Card issuance for the Rizon card; Rain (Signify Holdings, Inc.) as programme manager.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.getrizon.com/fees-and-limits",
            "detail": "Rizon site footer: Rain operates under its own regulatory authorizations; Rizon provides no regulated services.",
            "checked_at": "2026-10-09",
            "quote": "provided solely by Signify Holdings Inc. and its subsidiary Nimbus LLC (Rain), a third-party licensed financial service provider",
            "archive": "data/archive/rizon-card-ops-fees-and-limits.txt",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://legal.raincards.xyz/legal/privacy-policy",
            "detail": "Rain privacy policy, Entity Roles and Data Flows: describes Nimbus LLC, doing business as Third National, without naming a regulator, state or licence number.",
            "checked_at": "2026-10-09",
            "quote": "is a licensed lender, money transmitter and Visa-authorized card issuer",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "trace",
            "url": "https://api.fdic.gov/banks/institutions?search=NAME:%22Third%20National%22&fields=NAME,CERT,ACTIVE,CITY,STNAME&limit=20",
            "detail": "FDIC BankFind institutions API, run 2026-10-09: the closest matches for \"Third National\" are other banks (Fifth Third Bank, N.A. and inactive banks); a search for NAME:Nimbus with ACTIVE:1 returns 0 institutions. NMLS Consumer Access returned HTTP 403 to a scripted request and was not bypassed; the Puerto Rico OCIF licence check (concesionarios.ocif.pr.gov) failed the TLS handshake.",
            "checked_at": "2026-10-09",
            "recheck": "curl -s 'https://api.fdic.gov/banks/institutions?search=NAME:Nimbus&filters=ACTIVE:1&fields=NAME,CERT' | grep -o '\"total\":[0-9]*'"
          }
        ],
        "note": "Attested only: Rizon and Rain both call Nimbus LLC (Third National) licensed, but no regulator, state or number is given and no register entry was found. FDIC BankFind lists no institution named Third National or Nimbus; NMLS Consumer Access blocked scripted access; the Puerto Rico OCIF check could not be reached. Rizon Technologies, UAB applies Lithuanian AML law (privacy policy) but no Lithuanian registration was found; the Registry Centre list of crypto operators returned HTTP 403. Rizon states it provides no regulated services.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Third National (issuer), Rain, Visa",
            "fee": "USD free; non-USD 1.7% + $0.10 (plan discounts; card terms say + $0.30)",
            "limits": "No Rizon spending limit.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Third National (issuer), Visa",
            "fee": "$1 + 0.65% ($0.10 on Emerald)",
            "limits": "Physical card only; up to 3 withdrawals per 24 hours, $250 each; physical cards ship only to the listed countries.",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Not named (Rizon local payouts)",
            "fee": "Not published (plan discounts on pay-out fees)",
            "limits": "Send stablecoins and deliver fiat to bank accounts in 50+ countries; professional and business payments only.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/11822548-rizon-global-inc-spend-card-terms",
            "detail": "Rizon Global, Inc. Spend Card Terms, Defined Terms.",
            "checked_at": "2026-10-09",
            "quote": "The issuer for this card program is Third National.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/14896266-rizon-visa-platinum-physical-card",
            "detail": "Rizon help centre, Visa Platinum physical card (8 August 2026): ATM limits and delivery countries.",
            "checked_at": "2026-10-09",
            "quote": "The ATM withdrawal fee is $1 + 0.65% of the withdrawn amount.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://intercom.help/rizon/en/articles/14883654-rizon-virtual-accounts-global-payouts",
            "detail": "Rizon help centre, virtual accounts and global payouts (9 June 2026), with the payout currency list.",
            "checked_at": "2026-10-09",
            "quote": "Local Currency Payouts allow you to send funds directly to bank accounts in 50+ countries",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "The physical-card delivery list differs from the nationality allowlist in the provider file (it adds, for example, Bolivia, Kenya and South Africa); ALL follows the availability list. The payout partner and per-country fees are not published.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2025-04-30",
            "what": "Rizon Terms of Service effective, covering the Rain card off-ramp; earliest dated first-party document for the card"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/terms-of-service",
              "detail": "Rizon Terms of Service header; the Terms describe the Rain-managed smart contract behind the card off-ramp.",
              "checked_at": "2026-10-09",
              "quote": "Effective Date: April 30, 2025",
              "archive": "data/archive/rizon-card-ops-terms-of-service.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/blog/spend-stablecoins-anywhere-rizons-partnership-with-rain",
              "detail": "Rizon blog post dated 18 August 2025 announcing the Rain partnership.",
              "checked_at": "2026-10-09",
              "quote": "partnered with Rain to turn stablecoins into money",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The current Terms may have been revised since without a new effective date. The Rain partnership was announced on the Rizon blog on 2025-08-18; the current Global card terms are effective 2026-06-27.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Rizon Global, Inc.",
            "jurisdiction": "US-DE"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/terms-of-service",
              "detail": "Rizon Terms of Service, opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "a Delaware C Corporation company established with its registered agent address at 131 Continental Dr Suite 305, Newark, DE 19713 US",
              "archive": "data/archive/rizon-card-ops-terms-of-service.txt",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Not checked in the Delaware register (interactive search). The commercial agent Rizon Technologies, UAB (Lithuania) was not checked in the Lithuanian Register of Legal Entities.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-09-28",
              "summary": "Rain platform: unexpected card declines and API issues for some partners, 18:53 to 19:35 UTC; root cause still under investigation. Rain-wide; which programmes were affected is not stated.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/"
            },
            {
              "date": "2026-06-25",
              "summary": "Rain platform: elevated API error rates for 3h32m, caused by an expired encryption certificate.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-06-25-elevated-api-error-rate/"
            },
            {
              "date": "2026-06-03",
              "summary": "Rain platform: partial outage affecting card authorizations for 9 minutes, attributed to operating-system patching at a partner.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-06-03-payments-partner-outage/"
            },
            {
              "date": "2026-05-05",
              "summary": "Rain platform: elevated card declines for 3h10m from a partial outage at its payment processor.",
              "funds_lost": "unknown",
              "url": "https://status.rain.xyz/issues/2026-05-05-elevated-authorization-declines/"
            },
            {
              "date": "2026-01-02",
              "summary": "Rain platform: elevated card declines for 1h15m from an incident in the processor rules engine; Rain stated funds were safe.",
              "funds_lost": "no",
              "url": "https://status.rain.xyz/issues/2026-01-02-payementology-rules-declines/"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-09-28-api-issues-unexpected-declines/",
              "detail": "Rain status incident 2026-09-28.",
              "checked_at": "2026-10-09",
              "quote": "We are investigating an issue that is causing unexpected declines for transactions",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-06-25-elevated-api-error-rate/",
              "detail": "Rain status incident 2026-06-25.",
              "checked_at": "2026-10-09",
              "quote": "The issue was caused by an expired encryption certificate",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-06-03-payments-partner-outage/",
              "detail": "Rain status incident 2026-06-03.",
              "checked_at": "2026-10-09",
              "quote": "Our partner has identified the cause as operating system patching activity on their side",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-05-05-elevated-authorization-declines/",
              "detail": "Rain status incident 2026-05-05.",
              "checked_at": "2026-10-09",
              "quote": "The incident was related to our payment processor and has been mitigated",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.rain.xyz/issues/2026-01-02-payementology-rules-declines/",
              "detail": "Rain status incident 2026-01-02.",
              "checked_at": "2026-10-09",
              "quote": "Funds are safe and Rain infrastructure is working as intended",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No Rizon incident report found on getrizon.com, its blog or help centre. The entries are Rain platform incidents from status.rain.xyz (Rizon names Rain as its card provider); the pages do not say which programmes were affected.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-04-24",
              "summary": "Rizon privacy policy effective (GDPR and Lithuanian law; AML retention up to 8 years).",
              "url": "https://www.getrizon.com/privacy-policy"
            },
            {
              "date": "2025-04-30",
              "summary": "Rizon Terms of Service effective (Rizon Global, Inc.; Rizon Technologies, UAB as agent).",
              "url": "https://www.getrizon.com/terms-of-service"
            },
            {
              "date": "2025-08-18",
              "summary": "Rain partnership announced on the Rizon blog.",
              "url": "https://www.getrizon.com/blog/spend-stablecoins-anywhere-rizons-partnership-with-rain"
            },
            {
              "date": "2026-06-27",
              "summary": "Rizon Global card terms disclosures effective: FX 1.7% + $0.30, cross-border 0%, virtual card $10.",
              "url": "https://intercom.help/rizon/en/articles/11822548-rizon-global-inc-spend-card-terms"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.getrizon.com/privacy-policy",
              "detail": "Rizon privacy policy header.",
              "checked_at": "2026-10-09",
              "quote": "Effective Date: April 24, 2025",
              "archive": "data/archive/rizon-card-ops-privacy-policy.txt",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://intercom.help/rizon/en/articles/11822548-rizon-global-inc-spend-card-terms",
              "detail": "Rizon Global, Inc. Spend Card Terms, Important Disclosures.",
              "checked_at": "2026-10-09",
              "quote": "Effective as of 2026-06-27",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "Incumbent: the provider file lists no contracts, so there is nothing a volume spec could be computed over; card settlement runs offchain through the issuer and Visa.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "notes": "Incumbent card app by Rizon Global, Inc. over Rain (Signify Holdings, Inc. / Nimbus LLC) and Privy, issued by Third National. Partner-level facts are labelled \"Partner (Rain)\". getrizon.com pages are cited with archives because the site intermittently served pages without their text to scripted fetches. No repository facts apply."
    },
    "safepal-card": {
      "slug": "safepal-card",
      "facts": {
        "B1.4": {
          "status": "unknown",
          "note": "Fiat24's documents mention no audit or bug bounty (CROPS S6 unknown); SafePal's wallet app is closed and not reviewed here.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Account access is by the cardholder's own Arbitrum wallet holding the Fiat24 account NFT (no separate login factor is documented); online card purchases are confirmed with a one-time password sent by email.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
              "detail": "Fiat24 user manual, MasterCard Debit, one-time password section.",
              "checked_at": "2026-10-09",
              "quote": "One-time Password (OTP) per Email",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "Fiat24 Terms of Use, account token held in the user's wallet.",
              "checked_at": "2026-10-09",
              "quote": "Without it, your wallet cannot connect to any Services",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Fiat24 states only that it uses industry standard security measures; no data classification, encryption at rest or TLS commitment is published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Fiat24 Privacy Policy (effective 14 February 2023) section 5.",
              "checked_at": "2026-10-09",
              "quote": "We employ industry standard security measures designed to protect the security of all information submitted through the Services",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Information is kept as long as necessary for the stated purposes and as required by law, then deleted or de-identified; no period is stated (see CROPS P2 for what is collected).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Fiat24 Privacy Policy section 5.",
              "checked_at": "2026-10-09",
              "quote": "We retain information we collect as long as it is necessary and relevant to fulfill the purposes outlined in this privacy policy",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "SR Saphirstein AG (Fiat24), Zurich, is the company responsible under its privacy policy; SafePal's own role as wallet front end is not described there. DPIA availability not found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/privacy-policy",
              "detail": "Fiat24 Privacy Policy opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "entered in the Commercial Register of the Canton of Zurich under the number CHE-256.014.995",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Fiat24's developer guide documents contract addresses, functions and the card authorisation flow (integration and part of the logical architecture); infrastructure architecture and SafePal's app are not documented.",
          "refs": [
            {
              "criterion": "O4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "SR Saphirstein AG (Fiat24), Zurich, Switzerland (CHE-256.014.995) provides the account and the card; SafePal says Fiat24 solely handles compliance and licensing.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "Fiat24 Terms of Use, section 1.",
              "checked_at": "2026-10-09",
              "quote": "has a license as a fintech company according to Article 1b of the Swiss Banking Act",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE256014995",
              "detail": "Swiss UID register, SR Saphirstein AG, Aktiengesellschaft, Bellerivestrasse 245, 8008 Zurich; commercial register status active.",
              "checked_at": "2026-10-09",
              "quote": "CHE-256.014.995",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.safepal.com/en/bank",
              "detail": "SafePal card page, footnote 1.",
              "checked_at": "2026-10-09",
              "quote": "which solely handles the compliance and licensing aspect",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Fiat24 may close an account with two months' notice (immediately if the balance is zero) or without notice on breach, and may force a payout of the client's assets and close the account on sanctions, PEP, fraud or recall grounds. Deposits are not covered by the Swiss deposit protection scheme.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "Fiat24 Terms of Use section 23 (When we can end these Terms of Use).",
              "checked_at": "2026-10-09",
              "quote": "close your Fiat24 Account, or any Service associated with it by giving you two months prior notice",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/user/account-types/individual-account",
              "detail": "Fiat24 user manual, Individual Account, Forced Exit.",
              "checked_at": "2026-10-09",
              "quote": "reserve the right to enforce a mandatory payout",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
              "detail": "Fiat24 Terms of Use section 7.",
              "checked_at": "2026-10-09",
              "quote": "the Swiss Deposit Protection Scheme DOES NOT apply to client deposits with Fiat24",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "deposit and crypto top-up 0% (standard)",
            "basis": "SafePal fee article (updated 25 July 2026); SafePal's card page still says top-up fees from 0.4% and fiat transfer and deposit fees from 0.6%.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "1% on Mastercard transactions settled in non-USD currencies",
            "basis": "SafePal fee article; the Fiat24 manual says a matching currency balance is charged first.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "refund processing 1 USD / 1 EUR / 1 CHF / 7 CNH per card refund; no account opening or management fee",
            "basis": "SafePal fee article and Fiat24 MasterCard Debit manual.",
            "evidence_index": 0
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "payout to own bank free (min 100 EUR or CHF); 10 EUR or 10 CHF if the payout is returned",
            "basis": "Fiat24 Cash Payout manual; SafePal says IBAN transfers to external banks are free.",
            "evidence_index": 1
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "card 1,600 EUR a day contactless, 5,000 EUR a day other; new individual accounts 30,000 USD a month",
            "basis": "SafePal card page FAQ and Fiat24 Individual Account manual (from 5 June 2026).",
            "evidence_index": 2
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Arbitrum gas on every transaction",
            "basis": "SafePal fee article (all transactions are onchain).",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://safepalsupport.zendesk.com/hc/en-us/articles/22647224575643-Fee-Rates-for-the-SafePal-Fiat-Gateway-and-Mastercard",
            "archive": "data/archive/safepal-card-ops-fees.txt",
            "detail": "SafePal help centre, Fee Rates for the SafePal Fiat Gateway and Mastercard (linked from the card page as the Pricing and Fee disclosures).",
            "checked_at": "2026-10-09",
            "quote": "Mastercard transactions settled in non-USD currencies will incur a 1% currency exchange fee",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/payments/cash-payout",
            "detail": "Fiat24 user manual, Cash Payout, Fee section.",
            "checked_at": "2026-10-09",
            "quote": "Successful Payouts are free",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.safepal.com/en/bank",
            "detail": "SafePal card page FAQ on limits and fees.",
            "checked_at": "2026-10-09",
            "quote": "with fiat transfer and deposit fees being as low as 0.6%",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Contradiction: SafePal's card page advertises top-up fees from 0.4% and fiat fees from 0.6%, while the fee article it links (updated 25 July 2026) sets the standard deposit and top-up fee at 0%. Recorded as the fee article states; the more recent and more specific source. Fiat24's Terms (section 11) also say crypto top-ups carry a percentage fee per its Pricing page.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "The card spends Fiat24 cash tokens, which are claims on client deposits at SR Saphirstein AG; they sit in the user's address but Fiat24 operators can move any balance (sendToSundry) and card pulls go to Fiat24-held accounts (S1 = 0).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "SR Saphirstein AG (Fiat24)",
            "holder": "partner",
            "country": "CH",
            "regulator": "Swiss Financial Market Supervisory Authority (FINMA)",
            "type": "FinTech licence under Article 1b of the Swiss Banking Act",
            "activities": "Accepts client deposits (not covered by Swiss deposit protection, no interest); issues the Mastercard debit card and Swiss IBAN account",
            "register_url": "https://www.finma.ch/en/finma-public/authorised-institutions-individuals-and-products/",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.finma.ch/en/finma-public/authorised-institutions-individuals-and-products/",
            "archive": "data/archive/safepal-card-ops-finma-register.txt",
            "detail": "FINMA authorised-institutions search for \"Saphirstein\" (client-rendered; result read in a browser and archived) lists SR Saphirstein AG, Zurich, under licensed persons pursuant to Article 1b BA (FinTech licence).",
            "checked_at": "2026-10-09",
            "quote": "Licensed persons pursuant to Article 1b BA (FinTech licence)",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/legal/terms-and-conditions-fiat24-users-and-clients",
            "detail": "Fiat24 Terms of Use section 1.",
            "checked_at": "2026-10-09",
            "quote": "has a license as a fintech company according to Article 1b of the Swiss Banking Act",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "SafePal holds no licence for this product; its page says Fiat24 solely handles compliance and licensing. The FINMA entry gives no licence number or date. Card processing by Marqeta and the Mastercard principal membership behind the BIN were not checked.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_withdrawal",
            "partner": "Fiat24 (issuer), Mastercard",
            "fee": "1% FX on non-USD settlement",
            "limits": "Virtual card only, spend at merchants and via Apple Pay or Google Pay (the schema has no card-spend value); 1,600 EUR a day contactless, 5,000 EUR a day other.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Fiat24 (Swiss IBAN account)",
            "fee": "free; 10 EUR or 10 CHF if returned",
            "limits": "EUR or CHF payout to up to 10 registered accounts per currency in the client's name; minimum 100 EUR or CHF.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/payments/mastercard-debit",
            "detail": "Fiat24 user manual, MasterCard Debit (virtual only, no PIN; Apple Pay and Google Pay).",
            "checked_at": "2026-10-09",
            "quote": "The Fiat24 Debit Card is a virtual card only without PIN",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.fiat24.com/user/payments/cash-payout",
            "detail": "Fiat24 user manual, Cash Payout.",
            "checked_at": "2026-10-09",
            "quote": "Minimal payout amount is 100 EUR or 100 CHF",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ALL means every country in the availability list (42 Mastercard regions per SafePal). No ATM route is documented; the card is virtual without a PIN. The wider IBAN-only region list has a 1,000 USD monthly limit and no card.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2024-11-12",
            "block": 273715521,
            "what": "Fiat24CardAuthorization proxy 0xe2e3B88B...5b14 on Arbitrum One (card debits); the Fiat24Account NFT dates from 16 January 2022"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/42161/0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14?fields=deployment",
              "address": "0xe2e3B88B9893e18D0867c08f9cA93f8aB5935b14",
              "block_number": 273715521,
              "detail": "The receipt of tx 0x53392365...57a7 (status 1, from Fiat24 admin EOA 0x1272c99b...9D59) has contractAddress 0xe2e3B88B...5b14 at block 273715521 (2024-11-12 14:08:51 UTC); Sourcify's deployment record agrees. Fiat24Account NFT 0x133CAEec... was created at block 4699178 (2022-01-16 14:39:24 UTC, tx 0x758b303c...ca48).",
              "checked_at": "2026-10-09",
              "recheck": "cast receipt 0x53392365e29a675af7378d8122c832ba12357427e12314c3f0cf83b2e91057a7 contractAddress --rpc-url https://arb1.arbitrum.io/rpc; cast block 273715521 --field timestamp --rpc-url https://arb1.arbitrum.io/rpc"
            }
          ],
          "note": "Read from the creation receipt rather than code size at the prior block, because arb1.arbitrum.io does not serve historical state. The card authoriser may have replaced an earlier one; earlier card contracts were not traced. SafePal's card offering date was not found in a primary source.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "SR Saphirstein AG",
            "jurisdiction": "CH-ZH",
            "register_url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE256014995",
            "registration_number": "CHE-256.014.995"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.uid.admin.ch/Detail.aspx?uid_id=CHE256014995",
              "detail": "Swiss UID register, SR Saphirstein AG (SR Saphirstein Ltd), Aktiengesellschaft, Bellerivestrasse 245, 8008 Zurich; UID and commercial register status active, register reference CH-020.3.046.001-4.",
              "checked_at": "2026-10-09",
              "quote": "SR Saphirstein AG",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The contracting party for the account and card is Fiat24 (SR Saphirstein AG), not SafePal. SafePal's own legal entity was not identified in a primary source.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident notice or post-mortem was found in SafePal's help centre (Fiat Gateway section) or Fiat24's user manual and legal pages; neither publishes a status page that was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-06-05",
              "summary": "Fiat24 caps new individual accounts at 30,000 USD of transactions a month after an internal policy change and stops accepting limit upgrades.",
              "url": "https://docs.fiat24.com/user/account-types/individual-account"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.fiat24.com/user/account-types/individual-account",
              "detail": "Fiat24 user manual, Individual Account, Monthly Limit.",
              "checked_at": "2026-10-09",
              "quote": "Starting from June 5, 2026, due to an internal policy change, all new individual clients will be subject to a monthly transaction limit of USD 30,000",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Upgrades of the card authoriser proxy were not listed because Arbiscan and arbitrum.blockscout.com refuse scripted requests.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "Card debits are Authorized events on the shared Fiat24CardAuthorization contract, which serves every Fiat24 wallet provider (Bitget, SafePal and others). SafePal's share needs a walletProvider lookup per account (walletProviderMap 8026), which the spec format cannot express.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "solayer-card": {
      "slug": "solayer-card",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found for Solayer Labs, Inc. in docs.solayer.org (Solayer Pay pages, security and audits pages, legal pages) or solayer.org/terms. Third National not checked.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "Solayer lists five audits (OtterSec April and July 2024; Halborn August and October 2024) covering token-metadata, restaking, endoAVS and sUSD programs, and commits to two audits a year on existing contracts. None covers Solayer Pay, its hot/cold wallet backend or the card programme.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/security/audits",
              "detail": "Audits page listing the five reports with links to GitHub PDFs.",
              "checked_at": "2026-10-09",
              "quote": "Solayer will conduct two audits per year on all existing contracts",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or statement found. The audits page invites bug reports to report@solayer.org; no bounty terms found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No customer incident-notification commitment found in the card terms, website terms or docs.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "The Security page says cold storage \"provides a fallback in extreme cases\" and describes regular cold-wallet rotation and review; no recovery plan is published.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Public status page at status.solayer.org (Better Stack) covering solayer.org, the app page, a deposit/withdraw monitor and RPC endpoints; no card or Solayer Pay component. No post-mortems found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.solayer.org",
              "detail": "Better Stack status page, monitors listed on 2026-10-09.",
              "checked_at": "2026-10-09",
              "quote": "Deposit withdraw monitor",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "unknown",
          "note": "Users connect a wallet to the Solayer app; no account-level MFA statement found for the card dashboard.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "note": "The Security page says cold wallets are protected by multi-signature access controls; no statement on privileged staff access.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Only the issuer's GLBA privacy notice speaks to data security (\"security measures that comply with federal law\", computer safeguards, secured files and buildings). No Solayer data classification, encryption-at-rest or TLS statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/opening-account",
              "detail": "Opening Account Disclosures, Third National (\"Issuer\") privacy notice, What We Do.",
              "checked_at": "2026-10-09",
              "quote": "These measures include computer safeguards and secured files and buildings",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "absent",
          "value": "The card terms refer to a \"Solayer Privacy Policy\" that is not published; the FAQ defers to the card provider's privacy policy. No retention or deletion statement exists for Solayer.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
              "detail": "International Card Terms, Background, refer to a Solayer Privacy Policy.",
              "checked_at": "2026-10-09",
              "quote": "are described in Solayer Privacy Policy",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://docs.solayer.org/llms.txt",
              "detail": "The docs index (llms.txt) lists no privacy policy; solayer.org/privacy and docs.solayer.org/resources/legal/privacy.md both returned HTTP 404 on 2026-10-09; the FAQ (Q17) says information is handled per the card provider's policy.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s -o /dev/null -w '%{http_code}' https://solayer.org/privacy; curl -s -o /dev/null -w '%{http_code}' https://docs.solayer.org/resources/legal/privacy.md"
            }
          ],
          "note": "Third National's GLBA notice (opening-account) covers sharing, not retention.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "unknown",
          "note": "No Solayer privacy policy, so no controller statement; the only notice is Third National's GLBA notice. KYC is collected by Sumsub (CROPS P2).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "note": "The Security page lists real-time transaction monitoring and circuit breakers that freeze suspicious activity; no SIEM or endpoint-detection statement.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "The Security page describes a hybrid hot-wallet (card swipes, small operational balance) and offline multisig cold-storage design; no logical, infrastructure or integration architecture and no deposit or wallet addresses are published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/solayer-pay/security",
              "detail": "Solayer Pay Security page.",
              "checked_at": "2026-10-09",
              "quote": "Hot wallets are what make your Solayer Pay feel instant.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Solayer Labs, Inc. under the website Terms (New York law); the card terms are between the user, Solayer and the issuer Third National (Puerto Rico law). Incorporation state and address are not given: the Terms' notice address is a placeholder (123 Main Street, Anytown, USA). Rain is not named in any Solayer document read, though the card terms follow Rain's template.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://solayer.org/terms",
              "detail": "Solayer Terms of Use, opening paragraph.",
              "checked_at": "2026-10-09",
              "quote": "operated by or on behalf of Solayer Labs, Inc.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://solayer.org/terms",
              "detail": "Terms of Use, copyright notice address.",
              "checked_at": "2026-10-09",
              "quote": "123 Main Street, Anytown, USA",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
              "detail": "International Card Terms, defined terms.",
              "checked_at": "2026-10-09",
              "quote": "The issuer for this card program is Third National.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Card revenue from a 20 USD annual membership, top-up fees and per-transaction fees (see fees); Solayer also runs a LAYER token and points programme. No financial statements found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/solayer-pay/fee",
              "detail": "Solayer Pay fee structure page.",
              "checked_at": "2026-10-09",
              "quote": "Annual $20 / year",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Solayer or the issuer may suspend, revoke or cancel the account or card at any time, with or without cause or notice (card terms s9); the website Terms allow suspension or termination with or without notice. Cards are deactivated after 6 months of inactivity. Under the US terms, withdrawing collateral needs 3 business days' notice to Solayer. No statement on what happens to balances or data on termination.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
              "detail": "International Card Terms s9 Termination.",
              "checked_at": "2026-10-09",
              "quote": "with or without cause and with or without giving you notice",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/us-card-terms",
              "detail": "US Cardholder Agreement, collateral withdrawal.",
              "checked_at": "2026-10-09",
              "quote": "To withdraw your Collateral, you must provide Solayer at least (3) business days prior notice.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "unknown",
          "note": "Circuit breakers that freeze suspicious activity and real-time monitoring are described; whether these are automated or AI-driven is not stated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "20 USD per year membership (virtual card); physical card free plus shipping 24.99 USD (US) or 59.99 USD (international)",
            "basis": "Fee structure page and physical card page; the card is deactivated after 6 months of inactivity.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Top-up 1% per top-up (fee page); the FAQ says 0.5% and the top-up guide 0.10 USD",
            "basis": "Three Solayer docs pages disagree; the dedicated fee page is listed first.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "0.15 USD per USD transaction",
            "basis": "Fee structure page and FAQ.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Intl card: 0.10 USD + 1.5% per non-USD transaction, plus cross-border up to 3%; US card: 1%",
            "basis": "International Card Terms disclosures (effective 11 April 2025) and fee page; the FAQ says 0.10 USD + 1.75%; US Card Terms disclosures.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM withdrawals with the physical card; standard ATM and network fees may apply; no Solayer figure",
            "basis": "Physical card page.",
            "evidence_index": 2
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "ATM 250 USD per withdrawal (including surcharges), three attempts per rolling 24 hours",
            "basis": "Physical card page; spending limits are otherwise set dynamically by Solayer and the issuer (card terms).",
            "evidence_index": 2
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Penalties (international card): late payment up to 40 USD, returned payment up to 29 USD, liquidation up to 35 USD",
            "basis": "International Card Terms disclosures; fees may change on 30 days' notice.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/solayer-pay/fee",
            "detail": "Solayer Pay fee structure page (membership, top-up and transaction fees).",
            "checked_at": "2026-10-09",
            "quote": "Top-Up Fee 1% per top-up transaction",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
            "detail": "International Card Terms, Important Disclosures (effective 11 April 2025).",
            "checked_at": "2026-10-09",
            "quote": "Cross Border Fee: up to 3%",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/solayer-pay/card",
            "detail": "Physical Card page, ATM withdrawals and shipping.",
            "checked_at": "2026-10-09",
            "quote": "Maximum withdrawal amount per transaction: $250",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/solayer-pay/faq",
            "detail": "FAQ Q11, conflicting top-up and international fees.",
            "checked_at": "2026-10-09",
            "quote": "Top-Up Fee – 0.5% per top-up",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/resources/legal/us-card-terms",
            "detail": "US Card Account Opening Disclosures.",
            "checked_at": "2026-10-09",
            "quote": "International Transaction: 1% of each transaction in U.S. dollars",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Solayer's own pages disagree on the top-up fee (1%, 0.5%, 0.10 USD) and the international fee (1.5% or 1.75%); the US Card Terms list no annual fee while the docs charge 20 USD a year. Network fees for deposits are not stated.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "Agrees with S1 (score 1, judgment call), because the Security page puts card funds in Solayer-run hot wallets and multisig cold storage, against the US Card Terms' unbacked statement that collateral stays in the user's custody in smart contracts and the overview's \"non-custodial\" claim.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "unknown",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
            "detail": "The card terms name Third National as issuer under licence from Visa, without regulator, licence type or number; governing law Puerto Rico.",
            "checked_at": "2026-10-09",
            "quote": "The issuer for this card program is Third National.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://api.fdic.gov/banks/institutions?filters=NAME:%22Third%20National%22&fields=NAME,CERT,CITY,STNAME,ACTIVE&limit=20",
            "archive": "data/archive/solayer-card-ops-fdic-third-national-search.txt",
            "detail": "FDIC BankFind exact-name search for \"Third National\" returns no institution.",
            "checked_at": "2026-10-09",
            "quote": "\"totals\":{\"count\":0}",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No licence found for any party. No Solayer document names a licence, regulator or registration for Solayer Labs, Inc. Third National is not an FDIC-insured US bank by that name; the Puerto Rico OCIF register was not checked (earlier attempts from this environment failed the TLS handshake). Rain (Signify Holdings) is not named in Solayer's documents.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Third National (issuer), Visa",
            "fee": "0.15 USD per USD transaction; 0.10 USD + 1.5% non-USD (plus up to 3% cross-border)",
            "limits": "Virtual and physical cards; spending limits set dynamically by Solayer and the issuer; 17 US states excluded.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Third National (issuer), Visa ATMs",
            "fee": "Standard ATM and network fees may apply",
            "limits": "Physical card only; 250 USD per withdrawal including surcharges; three attempts per 24 hours.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/solayer-pay/fee",
            "detail": "Fee structure page.",
            "checked_at": "2026-10-09",
            "quote": "International Fee $0.10 + 1.5% per international transaction",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.solayer.org/solayer-pay/card",
            "detail": "Physical Card page, ATM withdrawals.",
            "checked_at": "2026-10-09",
            "quote": "Standard ATM and network fees may apply",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ALL means every country not on the blocklist in the provider file. No bank-transfer off-ramp is documented; balances leave the card only as spend, ATM cash or a collateral withdrawal requested from Solayer (US terms, 3 business days' notice).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2025-04-11",
            "what": "Card Terms (international and US) take effect; earliest dated primary source for the card programme. No launch announcement found."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/intl-card-terms",
              "detail": "International Card Terms header; the US Cardholder Agreement carries the same date.",
              "checked_at": "2026-10-09",
              "quote": "Effective as of April 11, 2025",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "solayer.org/resources/blog lists posts back to May 2025 (a July 2025 post on card updates via Telegram) but no launch post. The docs overview says the card is live for 40,000+ users.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "unknown",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://solayer.org/terms",
              "detail": "Solayer Terms of Use name Solayer Labs, Inc. as operator and choose New York law; the notice address is a placeholder.",
              "checked_at": "2026-10-09",
              "quote": "These Terms are governed by the laws of the State of New York",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The contracting entity is named (Solayer Labs, Inc.), but no document states its jurisdiction of incorporation, registration number or a real address (the Terms give \"123 Main Street, Anytown, USA\"). Governing law (New York) is not taken as the jurisdiction. No company register checked.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident report for the card found. Searched status.solayer.org (no card component, no incident listed), solayer.org/resources/blog and docs.solayer.org.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-04-11",
              "summary": "International and US Card Terms take effect (issuer Third National).",
              "url": "https://docs.solayer.org/resources/legal/intl-card-terms"
            },
            {
              "date": "2026-03-12",
              "summary": "Docs rebrand the Emerald Card to Solayer Pay and switch to a 20 USD per year membership model.",
              "url": "https://github.com/solayer-labs/solayer_docs/commit/7c7c549399343dcbc581dfaef0430f72c20c6913"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.solayer.org/resources/legal/us-card-terms",
              "detail": "US Cardholder Agreement header.",
              "checked_at": "2026-10-09",
              "quote": "Last Updated: April 11, 2025",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/solayer-labs/solayer_docs/commit/7c7c549399343dcbc581dfaef0430f72c20c6913",
              "commit": "7c7c549399343dcbc581dfaef0430f72c20c6913",
              "path": "solayer-pay",
              "detail": "Commit of 2026-03-12 \"docs - update Solayer Pay to $20/year membership model\", following f0bac808 (rebrand Emerald Card to Solayer Pay) the same day.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/solayer-labs/solayer_docs/commits/7c7c549399343dcbc581dfaef0430f72c20c6913 --jq '.commit.author.date + \" \" + .commit.message'"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "No listed contracts. Card funds sit in Solayer-run hot and cold wallets whose addresses are not published, and the card settles over Visa on the issuer's closed ledger.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "tongo": {
      "slug": "tongo",
      "fees": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": [
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Starknet v3 fee in STRK; sample 1.456 STRK for a Tongo transfer (42.4M L2 gas, 1,696 L1 data gas)",
            "basis": "Starknet fee formula over L2 gas, L1 gas and L1 data gas at the block's prices plus an optional tip, paid by the submitting Starknet account; all fees go to the sequencer (StarkWare). Set by Starknet, not by Tongo.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Optional relayer fee (fee_to_sender), set per operation by the user; 0 when the user submits directly",
            "basis": "Only on the gasless Relayer path. Tongo.cairo pays fee_to_sender from the sender's encrypted balance to the caller in ERC-20 at the Vault rate; the Relayer executes only when fees cover its gas plus a configurable margin.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://starknet-rpc.publicnode.com",
            "block_number": 12474497,
            "detail": "starknet_getTransactionReceipt for 0x1c865f68…3949 (a TransferEvent on the v2 USDC ledger 0x00b3…d4d3, Starknet block 12,474,497, 2026-07-29 21:13:42 UTC) returns actual_fee 0x1433e87959c49180 FRI (1.456 STRK). Other transfers on that ledger paid 1.33 to 1.46 STRK, withdrawals 0.70 to 1.04 STRK. Read through a public Starknet JSON-RPC endpoint; any node returns the same receipt.",
            "checked_at": "2026-10-09",
            "recheck": "curl -s -X POST -H 'content-type:application/json' https://starknet-rpc.publicnode.com -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"starknet_getTransactionReceipt\",\"params\":[\"0x1c865f68ecae417c817c0009a25a1f386266d21a7b0fce999630bfe64e13949\"]}' | jq -c '.result | {actual_fee, execution_resources}'"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "7dac05e823f83620fe231605ba81642a178657ad",
            "checked_at": "2026-10-09",
            "url": "https://github.com/fatlabsxyz/tongo/blob/7dac05e823f83620fe231605ba81642a178657ad/packages/contracts/src/tongo/Tongo.cairo#L236-L255",
            "path": "packages/contracts/src/tongo/Tongo.cairo",
            "detail": "With relayData set, withdraw moves fee_to_sender from the Vault to get_caller_address() and subtracts it from the sender's encrypted balance; transfer and ragequit do the same (L309-L314, L372-L377). There is no other fee in Tongo.cairo or Vault.cairo.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.starknet.io/learn/protocol/fees",
            "detail": "Starknet fee units (L2 gas, L1 gas, L1 data gas), v3 STRK-denominated limits and tip, and the recipient of fees.",
            "quote": "Starknet does not currently implement burning of fees, and all fees charged are received by the sequencer",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tongo.cash/protocol/relayer.html",
            "detail": "Relayer architecture page; the Relayer uses the AVNU paymaster, pays gas and is reimbursed from the operation's fee.",
            "quote": "carry a fee_to_sender amount that is paid to the Relayer",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No protocol fee and no fee to Fat Solutions on the direct path. Funding a Tongo account is an ordinary ERC-20 approve and call, paying the same Starknet fee. Fees are high relative to the amounts moved so far (the v2 USDC Vault held 7.78 USDC at the seed read).",
        "checked_at": "2026-10-09"
      },
      "custody_model": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "Agrees with the S1 finding (anchor 3 in substance, capped at 2 for want of schema-compatible onchain evidence). The ERC-20 reserve sits in an ownerless, non-upgradeable Vault released only against the key holder's proof; the ledger owner cannot move funds. Native USDC keeps Circle's freeze power over the Vault address.",
        "checked_at": "2026-10-09"
      },
      "licences": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://fatsolutions.xyz/",
            "detail": "The developer presents itself as a research and development team; the site names no legal entity, licence or regulator.",
            "quote": "Zero-Knowledge Privacy Research and Development Team",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.tongo.cash/",
            "detail": "The product site links to the demo, docs, GitHub and npm and has no terms, privacy or legal page.",
            "quote": "live on starknet mainnet",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Judgment call: absent rather than not_applicable, because Fat Solutions holds the ledger owner key (external-transfer approvals) and the Relayer owner role and runs the demo frontend, although it never holds users' funds. Searched: tongo.cash, fatsolutions.xyz, docs.tongo.cash (introduction, vault, relayer, auditor, contracts) and the repository README. No legal name or jurisdiction is disclosed, so no regulator register could be searched.",
        "checked_at": "2026-10-09"
      },
      "cashout": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "No fiat leg. The payee withdraws the wrapped ERC-20 (USDC, USDT, STRK, ETH, WBTC) to a Starknet address; converting it to local currency is outside the protocol.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "maturity": {
        "first_deployment": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "date": "2026-07-13",
            "block": 11811046,
            "what": "v2 USDC Tongo ledger 0x00b3…d4d3 (its Vault 0x4cf9…b27f at block 11,810,608 the same day). The first v1 instance (0x6d82…0e27) dates from block 3,587,879 on 2025-11-14."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://starknet-rpc.publicnode.com",
              "block_number": 11811046,
              "detail": "Binary search with starknet_getClassHashAt finds the v2 USDC ledger first present at Starknet block 11,811,046 (class 0x072c…471e) and its Vault at 11,810,608 (class 0x044d…121f); starknet_getBlockWithTxHashes gives timestamps 1783970097 (2026-07-13T19:14:57Z) and 1783969165. The Relayer appears at 11,811,680. The earliest v1 instance appears at 3,587,879 (1763155393, 2025-11-14T21:23:13Z), class 0x0058…672a.",
              "checked_at": "2026-10-09",
              "recheck": "for b in 11811045 11811046; do curl -s -X POST -H 'content-type:application/json' https://starknet-rpc.publicnode.com -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"starknet_getClassHashAt\",\"params\":{\"block_id\":{\"block_number\":'$b'},\"contract_address\":\"0x00b32618c475b2fb50b0facd2c49136be6e77281834dc86bdae652680faad4d3\"}}' | jq -c '.result // .error.message'; done"
            }
          ],
          "note": "Judgment call. The assessed unit is the v2 ledgers, so the v2 USDC ledger is recorded; v1 instances (separate contracts, still holding funds) are about eight months older. Voyager returned 403 and Starkscan renders client-side, so the timestamps come from a public Starknet JSON-RPC node rather than an explorer API.",
          "checked_at": "2026-10-09"
        },
        "entity": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://fatsolutions.xyz/",
              "detail": "The developer's site carries only a trade name and a contact address; no legal form, jurisdiction or register number.",
              "quote": "© 2026 FAT SOLUTIONS",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://reports.zksecurity.xyz/reports/tongo/",
              "detail": "The audit report names the client by trade name only.",
              "quote": "On October 13th, 2025, FatSolutions engaged zkSecurity to perform a security audit of its Tongo",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Maintainer is Fat Solutions (GitHub organisation fatlabsxyz, npm scope @fatsolutions); no legal entity is disclosed on tongo.cash, fatsolutions.xyz, the docs, the GitHub organisation profile (empty) or the npm package. Recorded as absent (undisclosed), not as proof that no company exists.",
          "checked_at": "2026-10-09"
        },
        "incidents": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/security-advisories",
              "detail": "No published security advisories in fatlabsxyz/tongo (empty list on 2026-10-09); fatlabsxyz/she has none either. Release notes mention fixes for the October 2025 zkSecurity audit (sdk-v1.3.0, PR 122) but no incident.",
              "checked_at": "2026-10-09",
              "recheck": "gh api repos/fatlabsxyz/tongo/security-advisories --jq length; gh api repos/fatlabsxyz/tongo/releases --jq '.[].tag_name'"
            }
          ],
          "note": "Empty list with the search recorded. Audit findings fixed before release are not incidents. No post-mortem or disclosure page exists to search.",
          "checked_at": "2026-10-09"
        },
        "changes": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2025-11-14",
              "summary": "v1 Tongo instances deployed on Starknet mainnet (class 0x0058…672a), each ledger holding its own ERC-20.",
              "url": "https://docs.tongo.cash/protocol/contracts.html"
            },
            {
              "date": "2026-07-13",
              "summary": "v2.0.0 released and deployed - Vaults hold reserves and deploy ledgers, external transfers between ledgers, optional Relayer with the AVNU paymaster. v1 instances remain live and are listed as legacy.",
              "url": "https://github.com/fatlabsxyz/tongo/releases/tag/v2.0.0"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tongo.cash/protocol/vault.html",
              "detail": "Vault Architecture (v2) page describing the split into Vaults and ledgers.",
              "quote": "In v2 the protocol is split into two kinds of contracts. Vaults and Tongo Ledgers.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/releases",
              "detail": "Release v2.0.0 published 2026-07-13 (52 pull requests since v0.0.2, including vault, relayer and external transfers); deployment dates are from Starknet state (see first_deployment).",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "Contracts are not upgradeable, so every change is a new deployment; users move funds themselves.",
          "checked_at": "2026-10-09"
        }
      },
      "volume": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_observable",
        "reason": "Transfer amounts are ElGamal-encrypted. Fund, Withdraw and Ragequit events do carry plaintext amounts, so entry and exit are public, but they are Starknet events, the volume script reads EVM logs only, and this row lists no contracts because Starknet addresses do not fit the schema."
      },
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/contents/?ref=master",
              "detail": "fatlabsxyz/tongo: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/contents/?ref=master",
              "detail": "fatlabsxyz/she: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/contents/?ref=master",
              "detail": "fatlabsxyz/tongo: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/contents/?ref=master",
              "detail": "fatlabsxyz/she: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/contents/?ref=master",
              "detail": "fatlabsxyz/tongo: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/contents/?ref=master",
              "detail": "fatlabsxyz/she: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, creation, required_linear_history, required_signatures, pull_request"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/rules/branches/master",
              "detail": "fatlabsxyz/tongo: rules: deletion, non_fast_forward, creation, required_linear_history, required_signatures, pull_request",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/rules/branches/master",
              "detail": "fatlabsxyz/she: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": true,
                "detail": "3 workflow file(s)"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": false,
                "detail": "1 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/contents/?ref=master",
              "detail": "fatlabsxyz/tongo: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/contents/?ref=master",
              "detail": "fatlabsxyz/she: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/contents/?ref=master",
              "detail": "fatlabsxyz/tongo: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/contents/?ref=master",
              "detail": "fatlabsxyz/she: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/contents/?ref=master",
              "detail": "fatlabsxyz/tongo: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/contents/?ref=master",
              "detail": "fatlabsxyz/she: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": true,
                "detail": "latest tags: v2.0.0, v0.0.2, v0.0.1"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": false,
                "detail": "latest tags: ts-v0.4.0, ts-v0.1.1, ts-v0.1.0"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/tags",
              "detail": "fatlabsxyz/tongo: latest tags: v2.0.0, v0.0.2, v0.0.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/tags",
              "detail": "fatlabsxyz/she: latest tags: ts-v0.4.0, ts-v0.1.1, ts-v0.1.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/commits?per_page=10",
              "detail": "fatlabsxyz/tongo: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/commits?per_page=10",
              "detail": "fatlabsxyz/she: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": true,
                "detail": "5 release(s) with notes"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": true,
                "detail": "1 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/contents/?ref=master",
              "detail": "fatlabsxyz/tongo: 5 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/contents/?ref=master",
              "detail": "fatlabsxyz/she: 1 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "fatlabsxyz/tongo",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "fatlabsxyz/she",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/tongo/contents/?ref=master",
              "detail": "fatlabsxyz/tongo: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/fatlabsxyz/she/contents/?ref=master",
              "detail": "fatlabsxyz/she: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Logical and integration views. The docs cover the encryption system, storage, the v2 Vault and ledger split, the Relayer (with the AVNU paymaster), auditing, the contract ABI and the SDK; the SHE section documents each proof protocol. No infrastructure view, as no operator-run infrastructure is required.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tongo.cash/protocol/vault.html",
              "detail": "Section 4 of the protocol documentation; sections 1-8 cover the protocol, 9-13 the SDK and 14-15 the SHE cryptography.",
              "quote": "In v2 the protocol is split into two kinds of contracts. Vaults and Tongo Ledgers.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B12.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            }
          ],
          "note": "Settlement checks only proofs, nonces and balances; the seed grep of the SDK for country, geolocation, sanction and chainalysis found nothing. The optional auditor key is a human-held decryption key, not an automated screen, and no canonical instance has one.",
          "checked_at": "2026-10-09"
        }
      }
    },
    "tornado-cash": {
      "slug": "tornado-cash",
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "none in the pool contracts",
            "basis": "withdraw sends the denomination minus the proof-bound fee to the recipient and the fee to the relayer; the pools take nothing and have no admin to add a fee.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "optional relayer fee, set by the chosen relayer",
            "basis": "Deducted from the withdrawn denomination when a relayer submits the withdrawal; fee and relayer are bound into the proof. Zero when the withdrawer submits it.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "deposit sample 2026-10-09, 0.00287 ETH (919,444 gas at 3.12 gwei)",
            "basis": "Router deposit into the ETH 1 pool, tx 0xb25e…d1cc, block 26153431; varies with Ethereum gas price.",
            "evidence_index": 1
          },
          {
            "kind": "network",
            "paid_by": "payee",
            "amount": "withdrawal sample 2026-10-09, 0.00109 ETH (349,079 gas at 3.12 gwei)",
            "basis": "Self-submitted withdrawal from the ETH 1 pool via the router with fee 0, tx 0x7678…48e3, block 26153424.",
            "evidence_index": 2
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "fixed denominations per pool (ETH 0.1/1/10/100, DAI 100 to 100k, USDC and USDT 100/1k)",
            "basis": "Each pool's denomination is set at construction and cannot change; one deposit equals one denomination (pools enumerated per token in the InstanceRegistry, see refs)."
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/contracts/ETHTornado.sol#L29-L40",
            "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
            "path": "contracts/ETHTornado.sol",
            "detail": "_processWithdraw sends denomination - fee to the recipient and fee to the relayer if fee > 0; there is no protocol fee.",
            "checked_at": "2026-10-09"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://etherscan.io/tx/0xb25ecc750f4854305239ccef3fa4af9b8ecb81d59e833e1ae2a85c5d12d7d1cc",
            "chain_id": 1,
            "block_number": 26153431,
            "detail": "Deposit receipt read 2026-10-09: gasUsed 919444, effectiveGasPrice 3.119 gwei, cost 0.002868 ETH; Deposit log from the ETH 1 pool 0x47CE…2936.",
            "checked_at": "2026-10-09",
            "recheck": "cast receipt 0xb25ecc750f4854305239ccef3fa4af9b8ecb81d59e833e1ae2a85c5d12d7d1cc --rpc-url https://ethereum-rpc.publicnode.com"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://etherscan.io/tx/0x7678bb5e5132c430f767d15d076096119b9f23d651630964dd1bab96616248e3",
            "chain_id": 1,
            "block_number": 26153424,
            "detail": "Withdrawal receipt read 2026-10-09: gasUsed 349079, effectiveGasPrice 3.125 gwei, cost 0.001091 ETH; Withdrawal log from the ETH 1 pool with relayer 0x0 and fee 0.",
            "checked_at": "2026-10-09",
            "recheck": "cast receipt 0x7678bb5e5132c430f767d15d076096119b9f23d651630964dd1bab96616248e3 --rpc-url https://ethereum-rpc.publicnode.com"
          }
        ],
        "refs": [
          {
            "criterion": "C5",
            "index": 0
          }
        ],
        "note": "On the optional router path, relayers registered in the RelayerRegistry have TORN burned from their stake per withdrawal (FeeManager sets the rate); that cost falls on relayers and reaches users only through their fee. No FX.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with S1 (score 3). Funds sit in immutable pools between deposit and withdrawal and leave only to whoever holds the note; no operator, governance or relayer can move them. Holding the note is holding the funds, so a payer who keeps a copy can withdraw first.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "not_applicable",
        "reason": "No legal entity operates the pools and no party takes custody or provides a service on the required path; there is nobody to hold a licence. Relayers and frontends are optional and independent.",
        "burden": "institution",
        "evidence": [
          {
            "tier": "verified",
            "kind": "api",
            "url": "https://api.github.com/orgs/tornadocash",
            "detail": "The GitHub organisation profile names no company (company null; name \"Tornado Cash\"; blog tornado.cash).",
            "checked_at": "2026-10-09",
            "recheck": "gh api orgs/tornadocash --jq '{name,company,blog}'"
          }
        ],
        "note": "An institution using the pools carries its own licensing and sanctions analysis; see the provider file's `context` for the 2022 OFAC designation and its 2025 removal.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "The note holder withdraws the token to an address it chooses; converting it to local currency is outside the protocol.",
        "burden": "institution",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2019-12-16",
            "block": 9116966,
            "what": "ETH 0.1 pool 0x12D6…B8Fc, the first Ethereum mainnet pool (also the UI config's deployedBlock); the ETH 1 pool followed at block 9117609."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc?fields=deployment",
              "address": "0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc",
              "chain_id": 1,
              "block_number": 9116966,
              "detail": "Sourcify creation data gives tx 0xeed4367a9b4c066b9fbf0a44869f36b93d2f06e5a63a9464ddfd0597a8a45935, block 9116966, deployer 0x8589…DA16; the receipt's contractAddress is this pool and the block time is 2019-12-16 19:08 UTC.",
              "checked_at": "2026-10-09",
              "recheck": "cast receipt 0xeed4367a9b4c066b9fbf0a44869f36b93d2f06e5a63a9464ddfd0597a8a45935 contractAddress --rpc-url https://eth.drpc.org && cast block 9116966 --field timestamp --rpc-url https://eth.drpc.org"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "absent",
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/orgs/tornadocash",
              "detail": "The organisation profile names no company or legal entity.",
              "checked_at": "2026-10-09",
              "recheck": "gh api orgs/tornadocash --jq '{name,company,blog,email}'"
            }
          ],
          "note": "Searched: the GitHub org profile, tornado-core and classic-UI READMEs and the classic UI source (no terms or legal entity), and https://tornado.cash (no response to curl). No contracting entity is disclosed. OFAC's 2022 designation treated \"Tornado Cash\" as an entity without naming a legal form, and the US and Dutch prosecutions named individuals; neither is a company record.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2023-05-20",
              "summary": "TORN governance proposal 20 was executed although its target contract was created after the vote closed and carries an owner-only selfdestruct, so the code executed was not the code voters saw. It reached governance, the registries and the router path, not the pools. Wider effects were not reconstructed here.",
              "funds_lost": "unknown",
              "url": "https://sourcify.dev/server/v2/contract/1/0xC503893b3e3c0C6b909222b45f2a3a259a52752D"
            }
          ],
          "refs": [
            {
              "criterion": "S2",
              "index": 3
            }
          ],
          "note": "Primary sources only. A 2024 report of a backdoor in the IPFS-served frontend was not evidenced from a primary source and is not listed. No pool contract incident was found: the pools are immutable and their operator is zero (CROPS C1, S2).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2022-08-08",
              "summary": "US Treasury (OFAC) designated Tornado Cash and its smart contract addresses.",
              "url": "https://home.treasury.gov/news/press-releases/jy0916"
            },
            {
              "date": "2022-08-22",
              "summary": "Last push to the github.com/tornadocash repositories; all 47 are now archived.",
              "url": "https://github.com/tornadocash"
            },
            {
              "date": "2025-03-21",
              "summary": "US Treasury announced removal of the Tornado Cash sanctions.",
              "url": "https://home.treasury.gov/news/press-releases/sb0057"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://home.treasury.gov/news/press-releases/jy0916",
              "detail": "Treasury press release announcing the designation.",
              "checked_at": "2026-10-09",
              "quote": "Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://home.treasury.gov/news/press-releases/sb0057",
              "detail": "Treasury press release dated March 21, 2025 announcing the delisting.",
              "checked_at": "2026-10-09",
              "quote": "we have exercised our discretion to remove the economic sanctions against Tornado Cash",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "O2",
              "index": 0
            }
          ],
          "note": "The pool contracts themselves have not changed since deployment. Governance changes to the optional registries and router are not itemised (72 proposals at the seed read).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 1,
          "addresses": [
            "0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc",
            "0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
            "0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF",
            "0xA160cdAB225685dA1d56aa342Ad8841c3b53f291",
            "0xD4B88Df4D29F5CedD6857912842cff3b20C8Cfa3",
            "0xFD8610d20aA15b7B2E3Be39B396a1bC3516c7144",
            "0x07687e702b410Fa43f4cB4Af7FA097918ffD2730",
            "0x23773E65ed146A459791799d01336DB287f25334",
            "0xd96f2B1c14Db8458374d9Aca76E26c3D18364307",
            "0x4736dCf1b7A3d580672CcE6E7c65cd5cc9cFBa9D",
            "0x169AD27A470D064DEDE56a2D3ff727986b15D52B",
            "0x0836222F2B2B24A3F36f98668Ed8F0B38D1a872f"
          ],
          "topic0": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
          "event": "Withdrawal(address to, bytes32 nullifierHash, address indexed relayer, uint256 fee)",
          "window_days": 30,
          "exclusions": "Count only. The Withdrawal event carries no amount or token (each pool has a fixed denomination), so no amount_word is set and the script returns one withdrawal count across all 12 pools. Value needs per-pool counts multiplied by each pool's denomination. Deposits are not counted. cDAI and WBTC pools and other chains are excluded."
        },
        "note": "Settlement is observable but the event shape does not fit a single amount spec. 347 events (deposits and withdrawals) appeared on the four ETH pools in the 5000 blocks to 26153707, so the pools are in use. Not computed; the maintainer runs scripts/volumes.mjs.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: eth_getLogs: Request blocked"
      },
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/contents/?ref=master",
              "detail": "tornadocash/tornado-core (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/contents/?ref=master",
              "detail": "tornadocash/tornado-classic-ui (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/contents/?ref=master",
              "detail": "tornadocash/tornado-cli (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/contents/?ref=master",
              "detail": "tornadocash/tornado-relayer (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/contents/?ref=master",
              "detail": "tornadocash/tornado-governance (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/contents/?ref=master",
              "detail": "tornadocash/tornado-subgraph (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/contents/?ref=master",
              "detail": "tornadocash/websnark (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/contents/?ref=master",
              "detail": "tornadocash/snarkjs (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/contents/?ref=master",
              "detail": "tornadocash/circomlib (archived): no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/contents/?ref=master",
              "detail": "tornadocash/tornado-core (archived): no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/contents/?ref=master",
              "detail": "tornadocash/tornado-classic-ui (archived): no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/contents/?ref=master",
              "detail": "tornadocash/tornado-cli (archived): no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/contents/?ref=master",
              "detail": "tornadocash/tornado-relayer (archived): no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/contents/?ref=master",
              "detail": "tornadocash/tornado-governance (archived): no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/contents/?ref=master",
              "detail": "tornadocash/tornado-subgraph (archived): no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/contents/?ref=master",
              "detail": "tornadocash/websnark (archived): no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/contents/?ref=master",
              "detail": "tornadocash/snarkjs (archived): no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/contents/?ref=master",
              "detail": "tornadocash/circomlib (archived): no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/contents/?ref=master",
              "detail": "tornadocash/tornado-core (archived): no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/contents/?ref=master",
              "detail": "tornadocash/tornado-classic-ui (archived): deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/contents/?ref=master",
              "detail": "tornadocash/tornado-cli (archived): no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/contents/?ref=master",
              "detail": "tornadocash/tornado-relayer (archived): deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/contents/?ref=master",
              "detail": "tornadocash/tornado-governance (archived): no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/contents/?ref=master",
              "detail": "tornadocash/tornado-subgraph (archived): no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/contents/?ref=master",
              "detail": "tornadocash/websnark (archived): no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/contents/?ref=master",
              "detail": "tornadocash/snarkjs (archived): no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/contents/?ref=master",
              "detail": "tornadocash/circomlib (archived): no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/rules/branches/master",
              "detail": "tornadocash/tornado-core (archived): no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/rules/branches/master",
              "detail": "tornadocash/tornado-classic-ui (archived): no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/rules/branches/master",
              "detail": "tornadocash/tornado-cli (archived): no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/rules/branches/master",
              "detail": "tornadocash/tornado-relayer (archived): no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/rules/branches/master",
              "detail": "tornadocash/tornado-governance (archived): no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/rules/branches/master",
              "detail": "tornadocash/tornado-subgraph (archived): no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/rules/branches/master",
              "detail": "tornadocash/websnark (archived): no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/rules/branches/master",
              "detail": "tornadocash/snarkjs (archived): no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/rules/branches/master",
              "detail": "tornadocash/circomlib (archived): no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": true,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": false,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": true,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": true,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": true,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/contents/?ref=master",
              "detail": "tornadocash/tornado-core (archived): 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/contents/?ref=master",
              "detail": "tornadocash/tornado-classic-ui (archived): 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/contents/?ref=master",
              "detail": "tornadocash/tornado-cli (archived): no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/contents/?ref=master",
              "detail": "tornadocash/tornado-relayer (archived): 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/contents/?ref=master",
              "detail": "tornadocash/tornado-governance (archived): 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/contents/?ref=master",
              "detail": "tornadocash/tornado-subgraph (archived): 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/contents/?ref=master",
              "detail": "tornadocash/websnark (archived): no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/contents/?ref=master",
              "detail": "tornadocash/snarkjs (archived): no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/contents/?ref=master",
              "detail": "tornadocash/circomlib (archived): no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/contents/?ref=master",
              "detail": "tornadocash/tornado-core (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/contents/?ref=master",
              "detail": "tornadocash/tornado-classic-ui (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/contents/?ref=master",
              "detail": "tornadocash/tornado-cli (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/contents/?ref=master",
              "detail": "tornadocash/tornado-relayer (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/contents/?ref=master",
              "detail": "tornadocash/tornado-governance (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/contents/?ref=master",
              "detail": "tornadocash/tornado-subgraph (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/contents/?ref=master",
              "detail": "tornadocash/websnark (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/contents/?ref=master",
              "detail": "tornadocash/snarkjs (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/contents/?ref=master",
              "detail": "tornadocash/circomlib (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/contents/?ref=master",
              "detail": "tornadocash/tornado-core (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/contents/?ref=master",
              "detail": "tornadocash/tornado-classic-ui (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/contents/?ref=master",
              "detail": "tornadocash/tornado-cli (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/contents/?ref=master",
              "detail": "tornadocash/tornado-relayer (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/contents/?ref=master",
              "detail": "tornadocash/tornado-governance (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/contents/?ref=master",
              "detail": "tornadocash/tornado-subgraph (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/contents/?ref=master",
              "detail": "tornadocash/websnark (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/contents/?ref=master",
              "detail": "tornadocash/snarkjs (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/contents/?ref=master",
              "detail": "tornadocash/circomlib (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": false,
                "detail": "latest tags: v2.1, v2.0, 1.0"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": true,
                "detail": "latest tags: v5.0.0-beta.12, v5.0.0-beta.11, v5.0.0-beta.10"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": true,
                "detail": "latest tags: v3.0.0, v2.0.0, v1.0.3"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": true,
                "detail": "latest tags: v0.0.10, v0.0.9, v0.0.8"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": true,
                "detail": "latest tags: v0.1.20, v0.1.19, v0.1.18"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": true,
                "detail": "latest tags: v0.2.4, v0.2.3, v0.2.2"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/tags",
              "detail": "tornadocash/tornado-core (archived): latest tags: v2.1, v2.0, 1.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/tags",
              "detail": "tornadocash/tornado-classic-ui (archived): no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/tags",
              "detail": "tornadocash/tornado-cli (archived): no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/tags",
              "detail": "tornadocash/tornado-relayer (archived): latest tags: v5.0.0-beta.12, v5.0.0-beta.11, v5.0.0-beta.10",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/tags",
              "detail": "tornadocash/tornado-governance (archived): latest tags: v3.0.0, v2.0.0, v1.0.3",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/tags",
              "detail": "tornadocash/tornado-subgraph (archived): no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/tags",
              "detail": "tornadocash/websnark (archived): latest tags: v0.0.10, v0.0.9, v0.0.8",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/tags",
              "detail": "tornadocash/snarkjs (archived): latest tags: v0.1.20, v0.1.19, v0.1.18",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/tags",
              "detail": "tornadocash/circomlib (archived): latest tags: v0.2.4, v0.2.3, v0.2.2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": true,
                "detail": "7 of 10 recent commits signed"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "3 of 10 recent commits signed"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": false,
                "detail": "1 of 10 recent commits signed"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "3 of 10 recent commits signed"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": true,
                "detail": "8 of 10 recent commits signed"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": true,
                "detail": "8 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/commits?per_page=10",
              "detail": "tornadocash/tornado-core (archived): 7 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/commits?per_page=10",
              "detail": "tornadocash/tornado-classic-ui (archived): 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/commits?per_page=10",
              "detail": "tornadocash/tornado-cli (archived): 3 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/commits?per_page=10",
              "detail": "tornadocash/tornado-relayer (archived): 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/commits?per_page=10",
              "detail": "tornadocash/tornado-governance (archived): 1 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/commits?per_page=10",
              "detail": "tornadocash/tornado-subgraph (archived): 3 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/commits?per_page=10",
              "detail": "tornadocash/websnark (archived): 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/commits?per_page=10",
              "detail": "tornadocash/snarkjs (archived): 8 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/commits?per_page=10",
              "detail": "tornadocash/circomlib (archived): 8 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": true,
                "detail": "3 release(s) with notes"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": true,
                "detail": "9 release(s) with notes"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/contents/?ref=master",
              "detail": "tornadocash/tornado-core (archived): 3 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/contents/?ref=master",
              "detail": "tornadocash/tornado-classic-ui (archived): no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/contents/?ref=master",
              "detail": "tornadocash/tornado-cli (archived): no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/contents/?ref=master",
              "detail": "tornadocash/tornado-relayer (archived): 9 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/contents/?ref=master",
              "detail": "tornadocash/tornado-governance (archived): no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/contents/?ref=master",
              "detail": "tornadocash/tornado-subgraph (archived): no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/contents/?ref=master",
              "detail": "tornadocash/websnark (archived): no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/contents/?ref=master",
              "detail": "tornadocash/snarkjs (archived): no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/contents/?ref=master",
              "detail": "tornadocash/circomlib (archived): no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "tornadocash/tornado-core (archived)",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "tornadocash/tornado-classic-ui (archived)",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "tornadocash/tornado-cli (archived)",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "tornadocash/tornado-relayer (archived)",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "tornadocash/tornado-governance (archived)",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "tornadocash/tornado-subgraph (archived)",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "tornadocash/websnark (archived)",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "tornadocash/snarkjs (archived)",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "tornadocash/circomlib (archived)",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-core/contents/?ref=master",
              "detail": "tornadocash/tornado-core (archived): none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-classic-ui/contents/?ref=master",
              "detail": "tornadocash/tornado-classic-ui (archived): CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-cli/contents/?ref=master",
              "detail": "tornadocash/tornado-cli (archived): none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-relayer/contents/?ref=master",
              "detail": "tornadocash/tornado-relayer (archived): none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-governance/contents/?ref=master",
              "detail": "tornadocash/tornado-governance (archived): none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/tornado-subgraph/contents/?ref=master",
              "detail": "tornadocash/tornado-subgraph (archived): none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/websnark/contents/?ref=master",
              "detail": "tornadocash/websnark (archived): none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/snarkjs/contents/?ref=master",
              "detail": "tornadocash/snarkjs (archived): none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/tornadocash/circomlib/contents/?ref=master",
              "detail": "tornadocash/circomlib (archived): none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical view only. The tornado-core README describes the deposit, commitment, proof and withdrawal design with a diagram and gas and circuit specs; there is no infrastructure or integration architecture document (the linked whitepaper URL on tornado.cash does not resolve).",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/tornadocash/tornado-core/blob/7033f34434208cde40503a8daf71c1c0f8dab578/README.md#L3-L21",
              "commit": "7033f34434208cde40503a8daf71c1c0f8dab578",
              "path": "README.md",
              "detail": "Design description, specs and diagram; links the whitepaper at tornado.cash.",
              "checked_at": "2026-10-09"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "No operator to fund. The pools need no maintenance; relayers fund themselves from withdrawal fees; TORN governance can fund changes to the optional registries, router and frontend by proposal. Public development stopped in 2022.",
          "refs": [
            {
              "criterion": "S2",
              "index": 1
            },
            {
              "criterion": "S2",
              "index": 2
            },
            {
              "criterion": "C3",
              "index": 2
            },
            {
              "criterion": "O2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "absent",
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            },
            {
              "criterion": "C4",
              "index": 1
            }
          ],
          "note": "Searched: the pool contracts and the core client (no screening of any kind) and the archived classic UI, whose only check is a lookup of the connecting address in the Chainalysis sanctions oracle, a list lookup rather than an AI decision. The build served at tornadocash.eth was not inspected.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "not_applicable",
          "reason": "No AI component was found in the payment path (B12.1 absent).",
          "burden": "none",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      }
    },
    "tria-card": {
      "slug": "tria-card",
      "facts": {
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found in Tria's legal pages (docs.tria.so terms, privacy policy, card terms, prohibited use policy), the 25 articles at help.tria.so or www.tria.so. The \"Security and TSS\" docs page is now password-protected and was not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No independent code review report found; CROPS S6 is unknown for this provider.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or bug bounty found; www.tria.so/.well-known/security.txt returns 404.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "The help centre describes the wallet as non-custodial; no recovery plan for the card service or for collateral held under the card programme was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page found (status.tria.so does not resolve) and no post-mortems found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Login with a Google or Apple account, with an optional secondary email for recovery; card number and CVV are revealed only after a device biometric check. No separate second factor for login is described.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.tria.so/en/articles/14886061-managing-login-methods",
              "detail": "Help article on login methods (4 May 2026).",
              "checked_at": "2026-10-09",
              "quote": "You can log in to your account using either your primary Google email or your Apple account",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.tria.so/en/articles/14854386-card-security-and-troubleshooting",
              "detail": "Help article on card security.",
              "checked_at": "2026-10-09",
              "quote": "Complete the biometric security check",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "unknown",
          "note": "The public SDK docs (CoreSDK, React and React Native references) cover wallet onboarding with SSO and passkeys; no card API is documented, and the TX Flow and protocol pages are password-protected.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "The privacy policy states encryption at rest and in transit with reasonable procedural, physical and electronic safeguards; no data classification is stated. Observed: www.tria.so refuses TLS 1.1 and accepts TLS 1.2.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/privacy-policy",
              "detail": "Privacy Policy s11, How We Protect Your Information.",
              "checked_at": "2026-10-09",
              "quote": "including encryption at rest and during transit",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://www.tria.so",
              "detail": "openssl s_client -tls1_1 to www.tria.so:443 failed with alert protocol version; -tls1_2 negotiated ECDHE-ECDSA-CHACHA20-POLY1305. Run 2026-10-09 with LibreSSL 3.3.6.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect www.tria.so:443 -servername www.tria.so -tls1_1; echo | openssl s_client -connect www.tria.so:443 -servername www.tria.so -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Retention \"as long as necessary\", set case by case by type of data, purpose and legal reason; no periods are given. On termination Tria may delete or deactivate the account and related information. See CROPS P2 for what is collected.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/privacy-policy",
              "detail": "Privacy Policy s12, Information Storage.",
              "checked_at": "2026-10-09",
              "quote": "We retain your information for as long as necessary to provide the Services",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The privacy policy is issued by Threely Dimensions, Inc. without using controller or processor terms; Sumsub is named for biometric identity checks, and the card terms point to the issuer's privacy notice hosted by Rain (legal.raincards.xyz). No DPIA statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/privacy-policy",
              "detail": "Privacy Policy opening paragraph and s5 Biometric Data.",
              "checked_at": "2026-10-09",
              "quote": "This Privacy Policy describes how Threely Dimensions, Inc.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "note": "The protected docs pages say access to them is logged; nothing is stated about logging of customer accounts or activity.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "attested",
          "value": "Tria's architecture pages (Protocol Construct, Security and TSS, TX Flow, BestPath) exist on docs.tria.so but are now password-protected for authorised readers, with a password from a Tria representative. They were public when the CROPS seed was researched on 2026-10-07; the card stack (issuer, collateral contracts) was not described in them.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/security-tss",
              "detail": "The Security and TSS page now shows a password gate; docs.tria.so/tx-flow and /network-construct show the same gate.",
              "checked_at": "2026-10-09",
              "quote": "This section is password-protected and intended for authorized use only",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Threely Dimensions Inc. (Tria), Delaware law and courts. Card issuers differ by programme: Third National for the US card, Nimbus, LLC (a Delaware company) for the international card, with BANEX Microfinance Bank marketing the card in Nigeria. No company register entry found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/platform-agreement",
              "detail": "Terms of Service, governing law.",
              "checked_at": "2026-10-09",
              "quote": "laws of the State of Delaware",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-international",
              "detail": "International Card Terms (last updated 9 January 2026), opening paragraph naming the issuer.",
              "checked_at": "2026-10-09",
              "quote": "Nimbus, LLC a Delaware U.S. corporation",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-us",
              "detail": "US Cardholder Agreement (last updated 9 January 2026), opening paragraph naming the issuer.",
              "checked_at": "2026-10-09",
              "quote": "and Third National, including its affiliates, successors, and assigns",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Annual card memberships (Lite/virtual 25 USD, Pro/plastic 109 USD, Max/metal 250 USD) and card transaction, FX and ATM fees. No financial statements found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-international",
              "detail": "International Card Terms, Important Disclosures (fee disclosure date 31 October 2025).",
              "checked_at": "2026-10-09",
              "quote": "Virtual Card: $25 Plastic Card: $109 Metal Card: $250",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Tria and/or the issuer may suspend, revoke or cancel card privileges at any time with or without cause or notice, and termination does not end the obligation to repay; collateral can be liquidated if a payment is more than one day late or its value falls below charges. Tria may modify or discontinue the Services at any time and on termination may block the wallet address and delete or deactivate the account and its information.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-international",
              "detail": "International Card Terms s10 Termination.",
              "checked_at": "2026-10-09",
              "quote": "Tria and/or Issuer may suspend, revoke or cancel your Account privileges",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/platform-agreement",
              "detail": "Terms of Service s11.2 Effect of Termination.",
              "checked_at": "2026-10-09",
              "quote": "delete or deactivate your Tria Account and all related information",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "unknown",
          "note": "No statement on AI or automated decision-making in payments or compliance found in the privacy policy, terms or help centre. The help centre describes automatic routing of top-up swaps (BestPath), which is not described as AI.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Card issue and annual fee: virtual 25 USD, plastic 109 USD, metal 250 USD",
            "basis": "International Card Terms and US Cardholder Agreement disclosures (fee disclosure date 31 October 2025); sold as Lite, Pro and Max memberships.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "FX up to 3% plus international transactions up to 1% (international terms); US card up to 3%",
            "basis": "Card terms. The help centre says Lite and higher memberships pay no Tria FX fee, Visa FX still applies; the terms are the binding ceiling.",
            "evidence_index": 0
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM: up to 2 USD + 3% per withdrawal (terms); help centre states 1 USD + 1%; inquiry or decline up to 2 USD",
            "basis": "Card terms disclosures and help article 14780504 disagree; both recorded.",
            "evidence_index": 1
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Card top-up - no Tria service fee; provider fee for swaps and bridging shown in app",
            "basis": "Help article 14854432; the international card terms also allow a USDC settlement or deposit fee of up to 1%.",
            "evidence_index": 2
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "ATM 750 USD per transaction, 3 per 24 hours; top-up minimum 10 USD (50 USD for BTC)",
            "basis": "Help articles 14780504 and 14056654; spending limit equals posted collateral.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tria.so/card-terms-international",
            "detail": "International Card Terms, Important Disclosures.",
            "checked_at": "2026-10-09",
            "quote": "ATM Fee (Withdraw): Up to $2 + 3%",
            "confirmed_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tria.so/en/articles/14780504-atm-withdrawals",
            "detail": "Help article on ATM withdrawals (15 May 2026).",
            "checked_at": "2026-10-09",
            "quote": "Per Transaction: Maximum of $750",
            "confirmed_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tria.so/en/articles/14854432-what-are-provider-fees",
            "detail": "Help article on provider fees (1 May 2026).",
            "checked_at": "2026-10-09",
            "quote": "we do not charge any direct service fees for card deposits at this time",
            "confirmed_at": "2026-10-12"
          }
        ],
        "note": "Fees in the card terms are maxima (\"up to\"); interest is 0% and late, returned and over-limit fees are not charged. Gas for top-ups is sponsored on most chains (not Solana or Tron).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "The Tria wallet is self-custodial (TSS keys; Tria disclaims custody), but card spending is backed by collateral posted from a linked wallet that the issuer can liquidate, and top-ups move funds into a card balance under the issuer's programme. Agrees with the S1 finding.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "attested",
        "value": [
          {
            "entity": "Third National",
            "holder": "partner",
            "country": "US",
            "regulator": "not stated",
            "type": "Card issuer and creditor for the US Tria Credit Card (as stated in the Cardholder Agreement)",
            "evidence_index": 0
          },
          {
            "entity": "Nimbus, LLC",
            "holder": "partner",
            "country": "US",
            "regulator": "not stated",
            "type": "Card issuer for the international Tria Spend Card, under licence from Visa (as stated in the card terms)",
            "evidence_index": 1
          },
          {
            "entity": "BANEX MICROFINANCE BANK LIMITED",
            "holder": "partner",
            "country": "NG",
            "regulator": "Central Bank of Nigeria",
            "type": "Licensed microfinance bank marketing the card in Nigeria (as stated in the card terms)",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tria.so/card-terms-us",
            "detail": "US Cardholder Agreement naming the issuer.",
            "checked_at": "2026-10-09",
            "quote": "and Third National, including its affiliates, successors, and assigns",
            "confirmed_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tria.so/card-terms-international",
            "detail": "International Card Terms naming the issuer.",
            "checked_at": "2026-10-09",
            "quote": "Nimbus, LLC a Delaware U.S. corporation",
            "confirmed_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tria.so/card-terms-international",
            "detail": "International Card Terms, Nigeria users.",
            "checked_at": "2026-10-09",
            "quote": "BANEX MICROFINANCE BANK LIMITED (BANEX), a financial institution licensed by the Central Bank of Nigeria (CBN)",
            "confirmed_at": "2026-10-12"
          }
        ],
        "note": "Tria (Threely Dimensions Inc.) says it is not a bank, money services business or card issuer and claims no licence. None of the partner licences was confirmed in a register: FDIC BankFind lists no active institution named Third National (2026-10-09); Nimbus, LLC is not a bank and no licence is stated for it; the Central Bank of Nigeria register was not checked.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Nimbus, LLC (international) or Third National (US) as issuer; Visa",
            "fee": "FX up to 3% plus international up to 1% (terms)",
            "limits": "Spending limit equals posted collateral value; virtual (Lite) or physical cards.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Card issuer, Visa",
            "fee": "Up to 2 USD + 3% (terms); 1 USD + 1% (help centre)",
            "limits": "750 USD per transaction, 3 per 24 hours; select \"Credit\" at the ATM; local ATM caps apply.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.tria.so/card-terms-international",
            "detail": "International Card Terms, Important Disclosures.",
            "checked_at": "2026-10-09",
            "quote": "Foreign Exchange (\"FX\"): Up to 3%",
            "confirmed_at": "2026-10-12"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tria.so/en/articles/14780504-atm-withdrawals",
            "detail": "Help article on ATM withdrawals.",
            "checked_at": "2026-10-09",
            "quote": "Percentage Fee: 1% of the withdrawal amount",
            "confirmed_at": "2026-10-12"
          }
        ],
        "note": "ALL means every country not on the provider file's blocklist. Card eligibility is narrower in practice: the card application checks the country of residence against an unpublished supported list (help article 14056678). No bank off-ramp to fiat accounts was found in the help centre or terms.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2025-10-31",
            "what": "Fee Disclosure Date of the Tria card terms, the earliest dated card document found (terms effective date, not a confirmed launch date)."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-international",
              "detail": "International Card Terms, Important Disclosures effective date.",
              "checked_at": "2026-10-09",
              "quote": "effective as of 31 Oct, 2025",
              "confirmed_at": "2026-10-12"
            }
          ],
          "note": "No dated launch announcement of the Tria card was found (www.tria.so is client-rendered with no newsroom; help articles carry 2026 update dates). The card may have launched earlier.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Threely Dimensions Inc.",
            "jurisdiction": "US-DE"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/platform-agreement",
              "detail": "Terms of Service naming the contracting entity; governed by Delaware law.",
              "checked_at": "2026-10-09",
              "quote": "Tria does not hold, store, or take custody of your funds, digital assets, collateral, or private keys",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/privacy-policy",
              "detail": "Privacy Policy naming Threely Dimensions, Inc.",
              "checked_at": "2026-10-09",
              "quote": "This Privacy Policy describes how Threely Dimensions, Inc.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Jurisdiction inferred from the Delaware governing-law and venue clause; incorporation state not stated and not checked in the Delaware Division of Corporations search (interactive). SEC EDGAR full-text search returned no filings for the name.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident report or status page found on www.tria.so, docs.tria.so or help.tria.so. Searched 2026-10-09.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-10-31",
              "summary": "Card fee disclosures take effect (memberships 25, 109 and 250 USD; FX and ATM fee ceilings).",
              "url": "https://docs.tria.so/card-terms-international"
            },
            {
              "date": "2026-01-09",
              "summary": "International Card Terms updated, naming Nimbus, LLC as issuer (the platform agreement still names Third National, LLC and partners as Card Program Providers); US Cardholder Agreement with Third National updated the same day.",
              "url": "https://docs.tria.so/card-terms-international"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-international",
              "detail": "International Card Terms header.",
              "checked_at": "2026-10-09",
              "quote": "Last Updated: January 9, 2026",
              "confirmed_at": "2026-10-12"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.tria.so/card-terms-us",
              "detail": "US Cardholder Agreement header.",
              "checked_at": "2026-10-09",
              "quote": "Last Updated: January 9, 2026",
              "confirmed_at": "2026-10-12"
            }
          ],
          "note": "Not listed because undated - the Security and TSS, TX Flow and protocol docs pages, public when the CROPS seed was researched on 2026-10-07, were password-protected by 2026-10-09 (see B10.1).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "No listed contracts; the collateral chain and addresses are not published (provider file notes), and card settlement runs through the issuers' closed systems.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "tuyo-card": {
      "slug": "tuyo-card",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/contents/?ref=dev",
              "detail": "zerodevapp/kernel: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/contents/?ref=dev",
              "detail": "zerodevapp/kernel: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/contents/?ref=dev",
              "detail": "zerodevapp/kernel: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/rules/branches/dev",
              "detail": "zerodevapp/kernel: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": true,
                "detail": "1 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/contents/?ref=dev",
              "detail": "zerodevapp/kernel: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/contents/?ref=dev",
              "detail": "zerodevapp/kernel: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/contents/?ref=dev",
              "detail": "zerodevapp/kernel: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": true,
                "detail": "latest tags: v4.0.0-beta.15, v4.0.0-beta.13, v4.0.0-beta.12"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/tags",
              "detail": "zerodevapp/kernel: latest tags: v4.0.0-beta.15, v4.0.0-beta.13, v4.0.0-beta.12",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": true,
                "detail": "6 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/commits?per_page=10",
              "detail": "zerodevapp/kernel: 6 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": true,
                "detail": "9 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/contents/?ref=dev",
              "detail": "zerodevapp/kernel: 9 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "zerodevapp/kernel",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerodevapp/kernel/contents/?ref=dev",
              "detail": "zerodevapp/kernel: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "attested",
          "value": "The Tuyo legal hub lists a \"Security audits\" section with a file \"Tuyo card.pdf\" (374.1 KB). The file was not downloaded, so auditor, scope and date are not recorded.",
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://about.tuyo.com/",
              "archive": "data/archive/tuyo-card-ops-about-index.txt",
              "detail": "Tuyo legal hub (Notion, client-rendered) index, Security audits section.",
              "checked_at": "2026-10-09",
              "quote": "Security audits"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Deleting the account in the app cancels the Tuyo Card and the virtual bank account numbers at Tuyo's providers; KYC data may be kept by Tuyo and its providers for up to 5 years. The privacy policy (2024) says technical logs are kept \"for a limited period\" without a figure.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Delete-your-Tuyo-account-272bde147092806ea058e39f02b4aae4",
              "archive": "data/archive/tuyo-card-ops-delete-account.txt",
              "detail": "Tuyo account deletion page.",
              "checked_at": "2026-10-09",
              "quote": "all your provided KYC information might be kept by Tuyo and/or our providers for up to 5 years for regulatory reasons"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Privacy-Policy-ab80528d2dfa4860854dee593fbad459",
              "archive": "data/archive/tuyo-card-privacy.txt",
              "detail": "Privacy Policy (17 July 2024), technical information.",
              "checked_at": "2026-10-09",
              "quote": "These logs are retained for a limited period for diagnostic and security purposes."
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The Tuyo privacy policy (17 July 2024) names Tuyo and shares ramp data with Bridge under Bridge's own policy; it predates the card and uses no controller/processor terms. The issuer's notice (Third National) covers card data; BANEX handles Nigerian users' data under the Nigeria Data Protection Act. No DPIA statement found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Privacy-Policy-ab80528d2dfa4860854dee593fbad459",
              "archive": "data/archive/tuyo-card-privacy.txt",
              "detail": "Privacy Policy, section 4 Sharing Your Information.",
              "checked_at": "2026-10-09",
              "quote": "We share your personal information with our partner Bridge which provides you with on and offramp services."
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Account-Opening-Disclosure-1a2bde147092806b8713e3fe2ce0bd76",
              "archive": "data/archive/tuyo-card-ops-account-opening.txt",
              "detail": "Issuer privacy notice published as the Account Opening Disclosure.",
              "checked_at": "2026-10-09",
              "quote": "WHAT DOES THIRD NATIONAL (\"Issuer\") DO WITH YOUR PERSONAL INFORMATION?"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical view only: Tuyo's help guides describe the signer (BIP-39 key on the device), the ZeroDev Kernel 3.2 smart account on Base, and the separate collateral account with its two release routes (counterparty-signed release, or depositor ejection after a cooldown). No infrastructure or integration architecture is published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.tuyo.com/guides/understand-your-smart-account.html",
              "detail": "Guide \"Your recovery phrase and smart-account address\", verified by Tuyo on 15 September 2026.",
              "checked_at": "2026-10-09",
              "quote": "Normal release: requires the depositor and a valid counterparty signature.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Tuyo, Inc. under the Terms of Service (Delaware law); the card agreements are three-way between the user, Tuyo Inc. and the issuer, Third National; for Nigerian users the card is marketed by BANEX Microfinance Bank Limited. No company-register entry was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Tuyo-Cardholder-Agreement-International-1a2bde1470928005b618dc59f919cac2",
              "archive": "data/archive/tuyo-card-ops-cardholder-international.txt",
              "detail": "Tuyo Cardholder Agreement (International), defined terms.",
              "checked_at": "2026-10-09",
              "quote": "The issuer for this card program is Third National."
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Terms-of-Service-1f5bde14709281b2a8fff4a20910b4ed",
              "archive": "data/archive/tuyo-card-terms.txt",
              "detail": "Terms of Service governing-law clause.",
              "checked_at": "2026-10-09",
              "quote": "These Terms of Service will be governed by the laws of the State of Delaware"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Tuyo may suspend or terminate an account at its sole discretion without prior notice and may delete account data; the issuer may cancel the card with or without notice. Because the wallet is self-custodial, the Terms say a suspended user can still export the wallet or withdraw via a block explorer; funds already in the card collateral account follow its release rules (counterparty signature or ejection cooldown).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Terms-of-Service-1f5bde14709281b2a8fff4a20910b4ed",
              "archive": "data/archive/tuyo-card-terms.txt",
              "detail": "Terms of Service s3.3 Self-Custodial Wallet.",
              "checked_at": "2026-10-09",
              "quote": "you can utilize tokens by exporting your wallet or withdrawing funds via the block explorer on the applicable blockchain"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Tuyo-Cardholder-Agreement-International-1a2bde1470928005b618dc59f919cac2",
              "archive": "data/archive/tuyo-card-ops-cardholder-international.txt",
              "detail": "Cardholder Agreement (International) s4.",
              "checked_at": "2026-10-09",
              "quote": "We may terminate or suspend your use of the Card or the Account, with or without notice to you"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "card",
            "paid_by": "none",
            "amount": "No issuance, monthly or yearly fee",
            "basis": "help.tuyo.com Tuyo Card guide; US cardholder agreement lists 0 USD annual fee.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "1% FX fee on non-USD spend plus 1% abroad fee (card provider) outside the US; up to 2% per purchase",
            "basis": "Card guide and FAQ. The international cardholder agreement allows up to 3% FX plus up to 3% cross-border; the US agreement states 1% on international transactions. Fees may change on 30 days' notice.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "Ceiling in the international agreement: FX up to 3% and cross-border up to 3%",
            "basis": "Tuyo Cardholder Agreement (International), Important Disclosures effective 7 March 2025.",
            "evidence_index": 1
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "0.25% volume fee on trades; bridging and stablecoin-to-stablecoin trades exempt",
            "basis": "Tuyo FAQ.",
            "evidence_index": 2
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "ATM: no Tuyo fee stated; ATM operator fees and FX apply and count toward the 250 USD cap",
            "basis": "ATM withdrawals guide.",
            "evidence_index": 3
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Daily card limit up to 50,000 USD for new cards, rising to 100,000 and 200,000 USD with cumulative spend",
            "basis": "Card guide and card limits guide.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/card.html",
            "detail": "Tuyo Card guide, card details table and FAQ.",
            "checked_at": "2026-10-09",
            "quote": "1% on any purchase made outside the US (charged by our card provider)",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://about.tuyo.com/Tuyo-Cardholder-Agreement-International-1a2bde1470928005b618dc59f919cac2",
            "archive": "data/archive/tuyo-card-ops-cardholder-international.txt",
            "detail": "International cardholder agreement, Important Disclosures.",
            "checked_at": "2026-10-09",
            "quote": "Foreign Exchange Fee (non-USD): up to 3%"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/faq.html",
            "detail": "Tuyo FAQ, fees.",
            "checked_at": "2026-10-09",
            "quote": "Tuyo charges a volume fee of 25 basis points (0.25%)",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/atm-withdrawals.html",
            "detail": "ATM withdrawals guide, fees and FX.",
            "checked_at": "2026-10-09",
            "quote": "ATM withdrawal fees and FX markups depend entirely on the ATM operator",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Bank-transfer (off-ramp) fees and Bridge's conversion charges are not stated in the guides; the app shows them before confirming. The US agreement lists a 2% late-payment fee; the international agreement lists none.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "unknown",
        "note": "Not recorded because CROPS S1 is unknown in the provider file and this value must agree with it. Tuyo's own guide now describes the structure: funds rest in the user's Kernel smart account; card funds move to a per-user collateral account (implementation 0x221677d8... on Base, Sourcify exact match) released only with a counterparty signature or by depositor ejection after a cooldown. That reads as hybrid; the provider file's S1 should be re-assessed with this collateral contract before this fact is set.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "attested",
        "value": [
          {
            "entity": "BANEX Microfinance Bank Limited",
            "holder": "partner",
            "country": "NG",
            "regulator": "Central Bank of Nigeria",
            "type": "Microfinance bank licence (as stated by Tuyo)",
            "activities": "Markets the Tuyo Card to Nigerian users and is responsible for CBN requirements and Nigerian data protection for them.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://about.tuyo.com/Tuyo-Cardholder-Agreement-International-1a2bde1470928005b618dc59f919cac2",
            "archive": "data/archive/tuyo-card-ops-cardholder-international.txt",
            "detail": "International cardholder agreement s7.4 Nigerian Users.",
            "checked_at": "2026-10-09",
            "quote": "a financial institution licensed by the Central Bank of Nigeria (CBN)"
          }
        ],
        "note": "Attested from Tuyo's agreement only; the CBN register was not reached (its microfinance list page returned no list to curl). The issuer for both programmes is Third National; no Tuyo document states its regulator or licence number, FDIC BankFind lists no active institution of that name, and Puerto Rico's OCIF register was not reachable for sibling providers. Bank accounts are provided by Bridge, whose licences were not checked.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Third National (issuer), Visa",
            "fee": "1% FX and 1% abroad fee, up to 2%",
            "limits": "Virtual card with Apple Pay and Google Pay; daily limit up to 50,000 USD for new cards. Spending blocked in CU, IR, KP, RU, SY, UA, VE.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Third National (issuer), Visa ATMs",
            "fee": "ATM operator fee and FX only",
            "limits": "250 USD per withdrawal including surcharge; 3 attempts per rolling 24 h; select Credit and enter the PIN.",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Bridge",
            "fee": "not stated (shown in app)",
            "limits": "USD (ACH, domestic wire), EUR (SEPA), MXN (SPEI where available); Bridge does not serve 20 listed countries or New York residents.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/card.html",
            "detail": "Tuyo Card guide.",
            "checked_at": "2026-10-09",
            "quote": "Keep custody. Your funds stay in your control until the moment you spend them.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/atm-withdrawals.html",
            "detail": "ATM withdrawals guide.",
            "checked_at": "2026-10-09",
            "quote": "Maximum per withdrawal: $250 USD",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://help.tuyo.com/guides/wire-transfer-availability.html",
            "detail": "Bank accounts availability guide with Bridge's country table.",
            "checked_at": "2026-10-09",
            "quote": "Not available means Bridge will not facilitate bank-account services",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://about.tuyo.com/Tuyo-Cardholder-Agreement-International-1a2bde1470928005b618dc59f919cac2",
            "archive": "data/archive/tuyo-card-ops-cardholder-international.txt",
            "detail": "International cardholder agreement s4 says cash advances are not available.",
            "checked_at": "2026-10-09",
            "quote": "Cash advances and balance transfers are not available under these Card Terms."
          }
        ],
        "note": "Contradiction: the international cardholder agreement says cash advances are not available, while the help guide documents ATM withdrawals for the virtual card; the US agreement treats ATM use as a cash advance where enabled. Recorded as the help guide states.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2025-02-25",
            "block": 26827639,
            "what": "CollateralAccount implementation 0x221677d88E507D21b4f7eC4D8D17e0f2FEd526af on Base, named by Tuyo as its card collateral implementation"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/8453/0x221677d88E507D21b4f7eC4D8D17e0f2FEd526af",
              "address": "0x221677d88E507D21b4f7eC4D8D17e0f2FEd526af",
              "chain_id": 8453,
              "block_number": 26827639,
              "detail": "Code size is 0 at Base block 26827638 and 9963 bytes at 26827639 (2025-02-25 00:50:25 UTC); Sourcify reports an exact runtime match for src/collateral/CollateralAccount.sol:CollateralAccount. Tuyo's smart-account guide links this address as the verified collateral implementation.",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0x221677d88E507D21b4f7eC4D8D17e0f2FEd526af --block 26827638 --rpc-url https://mainnet.base.org; cast codesize 0x221677d88E507D21b4f7eC4D8D17e0f2FEd526af --block 26827639 --rpc-url https://mainnet.base.org"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://help.tuyo.com/guides/understand-your-smart-account.html",
              "detail": "The guide links basescan.org/address/0x221677d8...#code as the collateral implementation it reviewed.",
              "checked_at": "2026-10-09",
              "quote": "Verified collateral implementation and release rules",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The collateral implementation is not in the provider file's contracts list (it was not known at seed time); per-user collateral proxies were not enumerated. The card agreements' disclosures are effective from 7 March 2025, consistent with this date.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Tuyo, Inc.",
            "jurisdiction": "US"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Terms-of-Service-1f5bde14709281b2a8fff4a20910b4ed",
              "archive": "data/archive/tuyo-card-terms.txt",
              "detail": "Terms of Service name Tuyo, Inc. and choose Delaware law.",
              "checked_at": "2026-10-09",
              "quote": "These Terms of Service will be governed by the laws of the State of Delaware"
            }
          ],
          "note": "Judgment call: the Terms name Tuyo, Inc. but not its state of incorporation; US is inferred from the Delaware governing-law clause and the Delaware support number (302). No register entry: the Delaware ICIS search is CAPTCHA-gated (not bypassed) and SEC EDGAR full-text search has no filer named Tuyo.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "No incident report or post-mortem found in help.tuyo.com guides (all 40 linked from the index), the about.tuyo.com legal hub, or the Terms. Tuyo has no public GitHub organisation to search.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-03-07",
              "summary": "Card disclosures effective (US cardholder agreement last updated; international Important Disclosures effective); issuer Third National.",
              "url": "https://about.tuyo.com/Tuyo-Cardholder-Agreement-United-States-1a2bde147092805694e6db6d96273668"
            },
            {
              "date": "2025-11-25",
              "summary": "International cardholder agreement last updated; the current text names Third National as issuer and BANEX Microfinance Bank for Nigerian users.",
              "url": "https://about.tuyo.com/Tuyo-Cardholder-Agreement-International-1a2bde1470928005b618dc59f919cac2"
            },
            {
              "date": "2026-07-28",
              "summary": "Terms of Service updated.",
              "url": "https://about.tuyo.com/Terms-of-Service-1f5bde14709281b2a8fff4a20910b4ed"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Tuyo-Cardholder-Agreement-United-States-1a2bde147092805694e6db6d96273668",
              "archive": "data/archive/tuyo-card-ops-cardholder-us.txt",
              "detail": "US cardholder agreement header.",
              "checked_at": "2026-10-09",
              "quote": "Last Updated: March 7th, 2025"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://about.tuyo.com/Tuyo-Cardholder-Agreement-International-1a2bde1470928005b618dc59f919cac2",
              "archive": "data/archive/tuyo-card-ops-cardholder-international.txt",
              "detail": "International cardholder agreement header.",
              "checked_at": "2026-10-09",
              "quote": "Last updated: November 25th, 2025"
            }
          ],
          "note": "What changed on 2025-11-25 is not stated by Tuyo; the summary names the clause present now. Also announced without a date: card spending from vaults is being phased out in favour of Cash (help guide vault-to-Cash update).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "Card funds are collected from per-user collateral proxies whose addresses Tuyo does not publish; the listed contracts (Kernel implementation and ECDSA validator) are shared by all ZeroDev accounts and emit no card-specific events, so card settlement cannot be separated from ordinary USDC transfers over listed contracts.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "umbra": {
      "slug": "umbra",
      "fees": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Toll 0 ETH per send on Ethereum (toll() = 0)",
            "basis": "Contract parameter; setToll is onlyOwner (an EOA), unbounded and emits no event. The sender commits to the current toll in sendEth, which blocks owner front-running of a single send.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "Relayer fee for token withdrawals, quoted per token by the Umbra API and deducted from the withdrawn tokens",
            "basis": "Optional; set by ScopeLift's closed API (mainnet.api.umbra.cash/tokens/<token>/estimate). ETH withdrawals and self-withdrawals pay no relayer fee.",
            "evidence_index": 1
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "Ethereum gas for the send; gas for withdrawal paid by the stealth address or by the relayer",
            "basis": "Network fee, not set by the protocol.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://sourcify.dev/server/v2/contract/1/0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
            "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
            "block_number": 26153752,
            "detail": "toll() returns 0 on Ethereum mainnet. Umbra.sol L64-L69 lets the owner set any toll; sendEth (L95-L120) requires the sender's toll commitment to equal it and forwards msg.value minus toll.",
            "checked_at": "2026-10-09",
            "recheck": "cast call 0xFb2dc580Eed955B528407b4d36FfaFe3da685401 \"toll()(uint256)\" --rpc-url https://ethereum-rpc.publicnode.com",
            "check": {
              "call": "0x285aaa20",
              "expect": "0x0000000000000000000000000000000000000000000000000000000000000000"
            },
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "07a64aeef305399a86afe72e502156d72babcc17",
            "checked_at": "2026-10-09",
            "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/utils/umbra-api.ts#L34-L93",
            "path": "frontend/src/utils/umbra-api.ts",
            "detail": "The app's relayer client uses https://mainnet.api.umbra.cash and fetches a fee estimate per token (getFeeEstimate, L89-L93); withdrawal-fees.ts L27-L30 returns a zero fee for the native token.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "07a64aeef305399a86afe72e502156d72babcc17",
            "checked_at": "2026-10-09",
            "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/i18n/locales/en-US.json#L167-L173",
            "path": "frontend/src/i18n/locales/en-US.json",
            "detail": "The FAQ explains that ETH goes straight to the stealth address, tokens are withdrawn directly or through a relayer (\"By default, the Umbra app uses a relayer from the Umbra team\"), and that a toll is charged only on cheap networks to deter spam.",
            "confirmed_at": "2026-10-12"
          }
        ],
        "note": "The toll is per chain; only Ethereum was read. The relayer's fee amounts are not published.",
        "checked_at": "2026-10-09"
      },
      "custody_model": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with S1 (3). ETH goes directly to the stealth address; tokens wait in the non-upgradeable contract until the stealth key releases them.",
        "checked_at": "2026-10-09"
      },
      "licences": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "absent",
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "07a64aeef305399a86afe72e502156d72babcc17",
            "checked_at": "2026-10-09",
            "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/pages/TermsOfService.vue#L1-L60",
            "path": "frontend/src/pages/TermsOfService.vue",
            "detail": "The Terms of Service name ScopeLift, a Pennsylvania LLC, as owner of the app and cite no licence, registration or regulator (searched for licen, regulat, money transmit); the privacy policy and FAQ say nothing either.",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ScopeLift runs the optional relayer and the app, not a custodial service. No regulator register was searched by name.",
        "checked_at": "2026-10-09"
      },
      "cashout": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "Token-to-address rail. The payee withdraws ETH or tokens to an address it controls; converting them to local currency is outside the protocol.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "maturity": {
        "first_deployment": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "date": "2021-04-30",
            "block": 12343914,
            "what": "Umbra contract 0xFb2d…5401 created (tx 0x1dbb9dfe…134a) by the owner EOA 0x5777…7232; StealthKeyRegistry followed at block 13098125 (2021-08-26)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFb2dc580Eed955B528407b4d36FfaFe3da685401?fields=deployment",
              "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "block_number": 12343914,
              "detail": "Sourcify creation data gives tx 0x1dbb9dfe4f83466be6ce1cdd19ac690636f02aeb2804785509ead7084fd7134a at block 12343914; the receipt has contractAddress 0xfb2d…5401 and status 1; block 12343914 is dated 2021-04-30 UTC, matching deploy-history/mainnet-2021-04-30T20:19:57.768Z.json and umbra-js's mainnet start block.",
              "checked_at": "2026-10-09",
              "recheck": "cast receipt 0x1dbb9dfe4f83466be6ce1cdd19ac690636f02aeb2804785509ead7084fd7134a contractAddress --rpc-url https://rpc.mevblocker.io"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "entity": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "legal_name": "ScopeLift (Pennsylvania limited liability company)",
            "jurisdiction": "US-PA"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/pages/TermsOfService.vue#L8-L33",
              "path": "frontend/src/pages/TermsOfService.vue",
              "detail": "The terms define ScopeLift as \"the Commonwealth of Pennsylvania Limited Liability Corporation that owns the Umbra App and Site\".",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The exact registered name and entity number were not read from the Pennsylvania Department of State register (its search is an interactive web app), so no register_url. The GitHub org lists Philadelphia, PA.",
          "checked_at": "2026-10-09"
        },
        "incidents": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/security-advisories",
              "detail": "No published security advisories for ScopeLift/umbra-protocol.",
              "checked_at": "2026-10-09"
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "address": "0xFb2dc580Eed955B528407b4d36FfaFe3da685401",
              "block_number": 26153752,
              "detail": "The contract is not upgradeable and its only OwnershipTransferred event is the constructor's (block 12343914, to 0x5777…7232); no admin path moves user funds (S1).",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "No post-mortem found in the repo, FAQ or app pages. GitHub issue search in umbra-protocol for exploit, incident, vulnerability, hack and security returned no incident report.",
          "checked_at": "2026-10-09"
        },
        "changes": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2021-04-30",
              "summary": "Umbra contract deployed on Ethereum mainnet.",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/deploy-history/mainnet-2021-04-30T20:19:57.768Z.json"
            },
            {
              "date": "2021-08-26",
              "summary": "StealthKeyRegistry deployed on mainnet.",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/deploy-history/registry-mainnet-2021-08-26T01:43:35.143Z.json"
            },
            {
              "date": "2021-10-29",
              "summary": "Same contracts deployed on Polygon.",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/deploy-history/polygon-2021-10-29T18:50:56.054Z.json"
            },
            {
              "date": "2022-03-02",
              "summary": "Deployed on Optimism and Arbitrum.",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/deploy-history/optimism-latest.json"
            },
            {
              "date": "2023-06-01",
              "summary": "Deployed on Gnosis Chain.",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/deploy-history/gnosis_chain-latest.json"
            },
            {
              "date": "2024-02-19",
              "summary": "Deployed on Base.",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/deploy-history/base-latest.json"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ScopeLift/umbra-protocol/tree/07a64aeef305399a86afe72e502156d72babcc17/contracts-core/deploy-history",
              "path": "contracts-core/deploy-history",
              "detail": "Timestamped deploy records per network (mainnet 2021-04-30, registry-mainnet 2021-08-26, polygon 2021-10-29, optimism and arbitrum 2022-03-02, gnosis_chain 2023-06-01, base 2024-02-19)."
            }
          ],
          "note": "The mainnet contract has never been replaced. Toll changes emit no event, so any past toll changes on mainnet cannot be listed from logs; toll() reads 0 today.",
          "checked_at": "2026-10-09"
        }
      },
      "volume": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "unknown",
        "spec": {
          "chain_id": 1,
          "addresses": [
            "0xFb2dc580Eed955B528407b4d36FfaFe3da685401"
          ],
          "topic0": "0x29877766fa2bfe3b90008d6d92f965eca91cbc5757ed775740e460799fb92219",
          "event": "Announcement(address indexed receiver, uint256 amount, address indexed token, bytes32 pkx, bytes32 ciphertext)",
          "window_days": 30,
          "exclusions": "Event count only. The token is an indexed topic (topic 2), which scripts/volumes.mjs cannot read, so amounts (data word 0) of ETH and different tokens would be summed together; amount_word is deliberately omitted. L2 deployments excluded."
        },
        "note": "Judgment call. Every send emits one Announcement with the amount in clear, so settlement is observable, but a per-token sum needs the script to read the token from topic 2. Until then the spec yields a payment count, not a value. Not computed; the maintainer runs scripts/volumes.mjs.",
        "reason": "not computed on 2026-10-19: eth_getLogs: Archive requests require a personal token. Get one at: https://www.allnodes.com/publicnode"
      },
      "facts": {
        "B1.4": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "ConsenSys Diligence audited the contracts (2021-03) and Least Authority audited umbra-js; audited commits not tied to the deployed code. See CROPS S6.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/contents/?ref=master",
              "detail": "ScopeLift/umbra-protocol: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/contents/?ref=main",
              "detail": "ScopeLift/umbra-subgraph: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/contents/?ref=master",
              "detail": "ScopeLift/umbra-protocol: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/contents/?ref=main",
              "detail": "ScopeLift/umbra-subgraph: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Hosted services: server logs with IP addresses kept no more than 90 days; IP addresses of registered users and posts no more than 5 years. Stated aim to drop IP logging later.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/pages/PrivacyPolicy.vue#L5-L30",
              "path": "frontend/src/pages/PrivacyPolicy.vue",
              "detail": "Privacy policy, data retention section (L23-L30).",
              "confirmed_at": "2026-10-12"
            }
          ],
          "note": "Cross-reference CROPS P2. Applies to the optional hosted app, relayer and indexer, which ScopeLift runs.",
          "checked_at": "2026-10-09"
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/contents/?ref=master",
              "detail": "ScopeLift/umbra-protocol: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/contents/?ref=main",
              "detail": "ScopeLift/umbra-subgraph: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/rules/branches/master",
              "detail": "ScopeLift/umbra-protocol: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/rules/branches/main",
              "detail": "ScopeLift/umbra-subgraph: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": true,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/contents/?ref=master",
              "detail": "ScopeLift/umbra-protocol: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/contents/?ref=main",
              "detail": "ScopeLift/umbra-subgraph: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/contents/?ref=master",
              "detail": "ScopeLift/umbra-protocol: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/contents/?ref=main",
              "detail": "ScopeLift/umbra-subgraph: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/contents/?ref=master",
              "detail": "ScopeLift/umbra-protocol: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/contents/?ref=main",
              "detail": "ScopeLift/umbra-subgraph: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": false,
                "detail": "latest tags: @umbra/umbra-js@0.0.1-alpha.0, @umbra/frontend@0.0.2, @umbra/contracts@0.0.2"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/tags",
              "detail": "ScopeLift/umbra-protocol: latest tags: @umbra/umbra-js@0.0.1-alpha.0, @umbra/frontend@0.0.2, @umbra/contracts@0.0.2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/tags",
              "detail": "ScopeLift/umbra-subgraph: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": false,
                "detail": "0 of 10 recent commits signed"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/commits?per_page=10",
              "detail": "ScopeLift/umbra-protocol: 0 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/commits?per_page=10",
              "detail": "ScopeLift/umbra-subgraph: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/contents/?ref=master",
              "detail": "ScopeLift/umbra-protocol: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/contents/?ref=main",
              "detail": "ScopeLift/umbra-subgraph: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ScopeLift/umbra-protocol",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "ScopeLift/umbra-subgraph",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-protocol/contents/?ref=master",
              "detail": "ScopeLift/umbra-protocol: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ScopeLift/umbra-subgraph/contents/?ref=main",
              "detail": "ScopeLift/umbra-subgraph: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Logical architecture only, in the app FAQ (keys, stealth addresses, Announcement scanning, relayed withdrawals, hooks) and a code-reading guide; the FAQ says developer documentation is not yet written. No infrastructure view of the hosted API or indexer.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/i18n/locales/en-US.json#L153-L239",
              "path": "frontend/src/i18n/locales/en-US.json",
              "detail": "FAQ answers how-does-it-work (L153), build-on-umbra (L234) and hooks (L239).",
              "confirmed_at": "2026-10-12"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "ScopeLift, a Pennsylvania limited liability company, owns the app and site and makes them available under the Terms of Service.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/pages/TermsOfService.vue#L8-L33",
              "path": "frontend/src/pages/TermsOfService.vue",
              "detail": "Terms preamble and definitions.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "unknown",
          "note": "The onchain toll is 0 on Ethereum (see fees), so the protocol earns nothing there; how ScopeLift funds maintenance of the app, relayer and indexer is not stated in any source found. The toll on cheaper chains was not read.",
          "checked_at": "2026-10-09"
        },
        "B11.3": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Either side may terminate; ScopeLift may suspend or end access to the app at its discretion without notice. Funds are unaffected because they sit at stealth addresses or in the non-upgradeable contract (CROPS S4).",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/frontend/src/pages/TermsOfService.vue#L140-L150",
              "path": "frontend/src/pages/TermsOfService.vue",
              "detail": "Section 5, Termination.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B12.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "07a64aeef305399a86afe72e502156d72babcc17",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ScopeLift/umbra-protocol/blob/07a64aeef305399a86afe72e502156d72babcc17/umbra-js/src/utils/utils.ts#L1171-L1190",
              "path": "umbra-js/src/utils/utils.ts",
              "detail": "The SDK's recipient screening is a hardcoded address list plus a call to the Chainalysis sanctions oracle (isSanctioned); no model or AI component. The contracts have no screening; the hosted API code is closed and its behaviour unknown.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        }
      }
    },
    "wirex-one": {
      "slug": "wirex-one",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/contents/?ref=main",
              "detail": "wirexapp/wirex-baas-agent-skills: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/contents/?ref=main",
              "detail": "wirexapp/wirex-baas-agent-skills: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/contents/?ref=main",
              "detail": "wirexapp/wirex-baas-agent-skills: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/rules/branches/main",
              "detail": "wirexapp/wirex-baas-agent-skills: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/contents/?ref=main",
              "detail": "wirexapp/wirex-baas-agent-skills: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/contents/?ref=main",
              "detail": "wirexapp/wirex-baas-agent-skills: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/contents/?ref=main",
              "detail": "wirexapp/wirex-baas-agent-skills: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/tags",
              "detail": "wirexapp/wirex-baas-agent-skills: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "0 of 1 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/commits?per_page=10",
              "detail": "wirexapp/wirex-baas-agent-skills: 0 of 1 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/contents/?ref=main",
              "detail": "wirexapp/wirex-baas-agent-skills: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "wirexapp/wirex-baas-agent-skills",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/wirexapp/wirex-baas-agent-skills/contents/?ref=main",
              "detail": "wirexapp/wirex-baas-agent-skills: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No audit or independent review of the Wirex BaaS contracts, API or app was found (CROPS S6 unknown); several implementations are only partial Sourcify matches and the TokensRegistry implementation is unverified.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Public status page at status.wirexapp.com (Atlassian Statuspage) with incident histories, including WirexOne-labelled incidents. No post-mortem was found among the 50 most recent incidents (2024-04-17 to 2026-10-08) returned by its API.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.wirexapp.com/",
              "detail": "Wirex status page, linked from wirexapp.com and the help centre.",
              "checked_at": "2026-10-09",
              "quote": "Wirex Status",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://status.wirexapp.com/api/v2/incidents.json",
              "detail": "The 50 incidents returned on 2026-10-09 contain no update or postmortem body mentioning a post-mortem.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://status.wirexapp.com/api/v2/incidents.json | grep -ci postmortem"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "Retail users authenticate through Privy (access and identity tokens exchanged for a Wirex user token); partner backends use OAuth2 client credentials. All tokens are HMAC-SHA256 signed JWTs.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-auth/SKILL.md#L14-L21",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "skills/wirex-baas-auth/SKILL.md",
              "detail": "Three authentication methods (S2S OAuth2, user token issuance, Privy) and the JWT format.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Server-to-server calls use OAuth2 client credentials (client_id and client_secret issued by Wirex) with a single scope, partner:full; rotation is not documented. The Wirex One web bundle ships a literal SSO client secret (CROPS S5).",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-auth/SKILL.md#L69-L76",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "skills/wirex-baas-auth/SKILL.md",
              "detail": "S2S token details: HS256, 48-hour validity, scope partner:full.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S5",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "Access tokens (S2S and user) are valid for 48 hours, far above the partner's 120-minute cap.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-auth/SKILL.md#L69-L76",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "skills/wirex-baas-auth/SKILL.md",
              "detail": "Token Details table, Validity 48 hours from issuance.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Customer account records are normally kept up to six years after the relationship ends; legacy Wirex App records may be kept separately; public blockchain records cannot be deleted (see CROPS P2 for what is collected).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/privacy",
              "detail": "Wirex One Privacy, Data Use and Retention Policy, section 13.",
              "checked_at": "2026-10-09",
              "quote": "normally keep customer account records for up to six years after your relationship with Wirex ends",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The controller is the Wirex group company that provides the service under the Terms; requests from EEA Wirex One users are routed to Wirex Europe sp. z o.o. as controller during the transition, and partners providing regulated services may be independent controllers. DPIA availability not found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/privacy",
              "detail": "Wirex One Privacy Policy, controller section and data-subject requests.",
              "checked_at": "2026-10-09",
              "quote": "is the Wirex company directly responsible for handling your personal data",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/privacy",
              "detail": "Wirex One Privacy Policy, rights section on EEA routing during launch.",
              "checked_at": "2026-10-09",
              "quote": "Wirex Europe sp. z o.o. as controller",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Integration architecture is published for Wirex BaaS (REST API with OAuth2, contract registry, Account Abstraction wallets, card, KYC and banking modules); logical contract architecture is partly covered by ABI fragments; infrastructure architecture is not published.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/wirexapp/wirex-baas-agent-skills/blob/7dff6eaaba9e06a30056f787ec54324d64a3e671/skills/wirex-baas-overview/SKILL.md#L13-L72",
              "commit": "7dff6eaaba9e06a30056f787ec54324d64a3e671",
              "path": "skills/wirex-baas-overview/SKILL.md",
              "detail": "Platform overview and the five-step integration flow (partner credentials, OAuth2, contract registry, user wallet deployment).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Card-based services in the EEA, UK and rest of world are provided by Wirex Limited (England and Wales, 09334596); UAB Wirex (Lithuania, 305118023) runs EEA card programme management; Crossmint Europe, S.L. provides EEA and UK crypto-asset services; Novatti Group Limited provides the card in Australia and New Zealand.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/terms",
              "detail": "Wirex One Terms of Service clauses 1.8 to 1.11.",
              "checked_at": "2026-10-09",
              "quote": "Card-based Regulated Services is provided by Wirex Limited",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/09334596",
              "detail": "Companies House, WIREX LIMITED, active private limited company, registered office 9th Floor 107 Cheapside, London EC2V 6DN.",
              "checked_at": "2026-10-09",
              "quote": "Incorporated on 1 December 2014",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "UAB Wirex, Crossmint Europe and Novatti were not checked in their company registers; UAB Wirex returns no entry in the Bank of Lithuania's register of financial market participants.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "The user may close the Wirex Profile at any time (closure can be delayed by investigations); Wirex may terminate with at least two months' notice, or suspend or terminate earlier for breach, suspected fraud or legal reasons. Closure ends regulated services only; the self-custodial wallet stays with the user.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/terms",
              "detail": "Wirex One Terms clause 10 (Profile Closure, Suspension and Termination).",
              "checked_at": "2026-10-09",
              "quote": "Wirex may also terminate your Wirex Profile or access to Regulated Services at any time by providing you with at least two (2) months' notice",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/terms",
              "detail": "Wirex One Terms clause 10.6.",
              "checked_at": "2026-10-09",
              "quote": "does not affect your Self-Custodial Wallet, which remains under your sole control",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "CROPS S1 and S4 found that Wirex's oracle can move wallet balances through the installed executor module, so the Terms' description of sole control does not match the deployed contracts.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Yes: application decisions may be made solely by automated checks, and accounts are profiled for a risk rating used in fraud and transaction monitoring; wallet-address screening and blockchain monitoring apply to Wirex One. Whether AI or machine learning is used is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/privacy",
              "detail": "Wirex One Privacy Policy section 12 (Fraud prevention).",
              "checked_at": "2026-10-09",
              "quote": "Application decisions may be taken based solely on automated checks of information",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "note": "No first-party statement found in the documents listed in the research log (Operational 2026-10-09).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "card scheme or provider rate plus mark-up; amount not published",
            "basis": "Wirex One Terms 9.10; the Fees and Limits Schedule they cite is not published.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "network gas on onchain transactions, set by the network",
            "basis": "Wirex One Terms 4.6.",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.wirexapp.com/legal/one/terms",
            "detail": "Wirex One Terms 9.10 (card transactions in another currency).",
            "checked_at": "2026-10-09",
            "quote": "any associated mark-ups or fees will apply",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.wirexapp.com/legal/one/terms",
            "detail": "Wirex One Terms 4.6 (network fees).",
            "checked_at": "2026-10-09",
            "quote": "You are solely responsible for any network fees, gas fees",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.wirexapp.com/legal/one/terms",
            "detail": "Wirex One Terms 1.14 point to a fee schedule whose link is a placeholder.",
            "checked_at": "2026-10-09",
            "quote": "Applicable fees, limits and charges are published in the Fees and Limits Schedule available at XXX",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No Wirex One fee schedule is published: Terms 1.14 link it as \"XXX\". The help centre's general Wirex Fees article (help.wirexapp.com/article/wirex-fees-1379, client-rendered) lists card issuance free, ATM free up to 200 GBP/EUR a month then 2%, and card delivery from 5 GBP/EUR, but it does not name Wirex One and describes the classic Wirex account. Judgment call: those figures are not recorded as Wirex One fees, consistent with the availability judgment in the research log.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Hybrid, not self-custody: funds sit in the user's Kernel smart account (key via Privy), but Wirex's FundsManagement executor is installed on it and Wirex's oracle EOA can move balances to FundsBuffer or an admin-set destination (S1 = 0, provider can redirect). The Terms call the wallet self-custodial.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "Wirex Limited",
            "holder": "provider",
            "country": "GB",
            "regulator": "Financial Conduct Authority",
            "type": "Authorised Electronic Money Institution",
            "number": "902025",
            "activities": "Issue e-money and provide payment services; authorised since 17/08/2018. Provides Wirex One card services in the EEA, UK and rest of world.",
            "register_url": "https://register.fca.org.uk/s/firm?id=0010X000047SC0tQAG",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://register.fca.org.uk/s/firm?id=0010X000047SC0tQAG",
            "archive": "data/archive/wirex-one-ops-fca-wirex-limited.txt",
            "detail": "FCA Register firm page for reference 902025 (client-rendered; text read in a browser and archived), Companies House number 09334596.",
            "checked_at": "2026-10-09",
            "quote": "Authorised Electronic Money Institution"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.wirexapp.com/legal/one/terms",
            "detail": "Wirex One Terms 1.8 to 1.11 name the regulated providers per region.",
            "checked_at": "2026-10-09",
            "quote": "Card-based Regulated Services is provided by Wirex Limited",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Only Wirex Limited was checked in a register. Per the Terms, EEA and UK crypto-asset services are provided by Crossmint Europe, S.L. (Spain, CNMV crypto-asset service provider and Bank of Spain payment institution, partner) and the card in Australia and New Zealand by Novatti Group Limited (partner); neither was checked in its regulator's register. UAB Wirex does EEA card programme management and has no entry in the Bank of Lithuania register.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_withdrawal",
            "partner": "Wirex Limited (Novatti in AU and NZ), Visa or Mastercard",
            "fee": "FX mark-up not published",
            "limits": "Card spend at merchants from the smart-account balance (the schema has no card-spend value); limits not published.",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Wirex Card",
            "fee": "not published for Wirex One",
            "limits": "ATM withdrawals need the card PIN; limits not published.",
            "evidence_index": 1
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Wirex and regulated third-party providers (account identifiers)",
            "fee": "not published for Wirex One",
            "limits": "Virtual IBANs, sort codes or other local details; SEPA, Faster Payments or ACH depending on the account identifier.",
            "evidence_index": 2
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.wirexapp.com/legal/one/terms",
            "detail": "Wirex One Terms 1.8 to 1.11 (card providers per region) and clause 9 (Wirex Card).",
            "checked_at": "2026-10-09",
            "quote": "Card-based Regulated Service is provided by Novatti Group Limited",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.wirexapp.com/legal/one/terms",
            "detail": "Wirex One Terms 9.3 (PIN for ATM withdrawals).",
            "checked_at": "2026-10-09",
            "quote": "Your PIN is required to complete certain transactions, including ATM withdrawals",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.wirexapp.com/legal/one/terms",
            "detail": "Wirex One Terms 8.1 to 8.2 (account identifiers and payment rails).",
            "checked_at": "2026-10-09",
            "quote": "receive funds to, and send payments using, such account identifiers using supported payment rails and currencies",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "No first-party country list exists for Wirex One (see the research log, Availability 2026-10-09), so ALL is the unbounded set of supported jurisdictions, not a published list. The Terms also offer Pay-to-Card transfers to external Visa or Mastercard cards (9.14). Which rails each region gets is not stated.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2025-04-29",
            "block": 29552868,
            "what": "FundsManagement proxy 0xFB384a73...F06a on Base (card debits), part of the shared Wirex BaaS deployment"
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://basescan.org/tx/0xb85fdeb6e59076f4fe1350ee9d0ccaaab0a0817ee0a4c0d8af962b015d8c471a",
              "address": "0xFB384a73e9B89b01749C1127cDe4FeA20fb9F06a",
              "block_number": 29552868,
              "detail": "FundsManagement proxy has code size 0 at block 29552867 and 1159 at 29552868 (2025-04-29 02:51:23 UTC); creation tx 0xb85fdeb6...471a from 0x685f0df57331bE2Ff7306415Fe4f36F610c80e54 (receipt contractAddress matches; Sourcify deployment record agrees). FundsBuffer 0xbFACe6Ad... was created 69 blocks earlier (29552799).",
              "checked_at": "2026-10-09",
              "recheck": "cast codesize 0xFB384a73e9B89b01749C1127cDe4FeA20fb9F06a --block 29552867 --rpc-url https://mainnet.base.org; cast codesize 0xFB384a73e9B89b01749C1127cDe4FeA20fb9F06a --block 29552868 --rpc-url https://mainnet.base.org"
            }
          ],
          "note": "Dates the BaaS settlement contracts scored in CROPS. Wirex One itself replaced the legacy Wirex app later (the status page logs a legacy-to-Wirex One balance migration in June 2026); the legacy Wirex card and Wirex Pay chain predate this and are excluded.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Wirex Limited",
            "jurisdiction": "GB",
            "register_url": "https://find-and-update.company-information.service.gov.uk/company/09334596",
            "registration_number": "09334596"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/09334596",
              "detail": "Companies House, WIREX LIMITED, active, registered office 9th Floor 107 Cheapside, London EC2V 6DN.",
              "checked_at": "2026-10-09",
              "quote": "Incorporated on 1 December 2014",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/terms",
              "detail": "Wirex One Terms name Wirex Limited as the card-based regulated service provider.",
              "checked_at": "2026-10-09",
              "quote": "Card-based Regulated Services is provided by Wirex Limited",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Recorded entity is the card provider for the EEA, UK and rest of world. Other regulated parts are provided by other entities (see B11.1).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-06-25",
              "summary": "Card operations incident; to contain it, all card transactions were set to be declined in all regions (status page, critical; follow-up outage entry on 26 June).",
              "funds_lost": "unknown",
              "url": "https://status.wirexapp.com/incidents/pdb8txhch0y7"
            },
            {
              "date": "2026-09-03",
              "summary": "Major incident affecting all financial operations on Wirex One; stuck transactions to be processed after the fix (status page, critical).",
              "funds_lost": "unknown",
              "url": "https://status.wirexapp.com/incidents/snf1c6h7mrrk"
            },
            {
              "date": "2026-09-30",
              "summary": "Card operations stopped temporarily in all regions after a problem during planned maintenance at a third-party provider (status page, critical).",
              "funds_lost": "unknown",
              "url": "https://status.wirexapp.com/incidents/506j6w44m2bs"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.wirexapp.com/incidents/pdb8txhch0y7",
              "detail": "Status page incident, Card operations outage, June 2026.",
              "checked_at": "2026-10-09",
              "quote": "all card transactions are currently set to be declined",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.wirexapp.com/incidents/snf1c6h7mrrk",
              "detail": "Status page incident, WirexOne transaction processing, 3 September 2026.",
              "checked_at": "2026-10-09",
              "quote": "We are observing major incident affecting all financial operations on WirexOne",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.wirexapp.com/incidents/506j6w44m2bs",
              "detail": "Status page incident, Card operations outage, 30 September 2026.",
              "checked_at": "2026-10-09",
              "quote": "temporary stop card operations",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Selected from status page incidents marked critical since the Wirex One rollout (May 2026); the API returns the 50 most recent incidents back to 2024-04-17. Major-level Wirex One incidents (bank transfers 2026-08-27, deposits 2026-09-16, exchange 2026-09-26) are not listed. No funds loss was stated in any update.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2018-08-17",
              "summary": "Wirex Limited authorised by the FCA as an Electronic Money Institution (FRN 902025).",
              "url": "https://register.fca.org.uk/s/firm?id=0010X000047SC0tQAG"
            },
            {
              "date": "2026-06-29",
              "summary": "Balances migrating from the legacy Wirex app to Wirex One (status page incident on migration failures from 28 June).",
              "url": "https://status.wirexapp.com/incidents/b0cnzlzwnqwc"
            },
            {
              "date": "2026-09-30",
              "summary": "EEA card transactions before 30 September 2026 fall under TRANSACT Payments Malta Limited's terms; the current Terms name Wirex Limited as the EEA card service provider.",
              "url": "https://www.wirexapp.com/legal/one/terms"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://register.fca.org.uk/s/firm?id=0010X000047SC0tQAG",
              "archive": "data/archive/wirex-one-ops-fca-wirex-limited.txt",
              "detail": "FCA Register firm status (archived).",
              "checked_at": "2026-10-09",
              "quote": "Since 17/08/2018"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.wirexapp.com/incidents/b0cnzlzwnqwc",
              "detail": "Status page incident on the legacy-to-Wirex One balance migration.",
              "checked_at": "2026-10-09",
              "quote": "balances migration failures from Wirexapp to Wirex One",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.wirexapp.com/legal/one/terms",
              "detail": "Wirex One Terms 13.7.",
              "checked_at": "2026-10-09",
              "quote": "should be submitted to Wirex and will be handled under the TRANSACT Payments Malta Limited",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Judgment call: the 30 September 2026 entry reads clause 13.7 together with clause 1.8 as a change of EEA card provider; the Terms do not state the change in so many words.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "Card debits are OutgoingTransactionProcessed events on the shared Wirex BaaS FundsManagement contract, which serves several partner programmes (UserAccountCreated parentEntity values vary) and also processes non-card outgoing operations; the event's operation type is a string the spec cannot filter, and nothing onchain ties a wallet to the Wirex One programme without Wirex's records.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "wise": {
      "slug": "wise",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/contents/?ref=main",
              "detail": "transferwise/digital-signatures-examples: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/contents/?ref=master",
              "detail": "transferwise/digital-signatures: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/contents/?ref=master",
              "detail": "transferwise/public-api-postman-collection: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/contents/?ref=master",
              "detail": "transferwise/banks-reference-android: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/contents/?ref=main",
              "detail": "transferwise/wise-platform-samples: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/contents/?ref=main",
              "detail": "transferwise/digital-signatures-examples: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/contents/?ref=master",
              "detail": "transferwise/digital-signatures: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/contents/?ref=master",
              "detail": "transferwise/public-api-postman-collection: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/contents/?ref=master",
              "detail": "transferwise/banks-reference-android: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/contents/?ref=main",
              "detail": "transferwise/wise-platform-samples: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/contents/?ref=main",
              "detail": "transferwise/digital-signatures-examples: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/contents/?ref=master",
              "detail": "transferwise/digital-signatures: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/contents/?ref=master",
              "detail": "transferwise/public-api-postman-collection: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/contents/?ref=master",
              "detail": "transferwise/banks-reference-android: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/contents/?ref=main",
              "detail": "transferwise/wise-platform-samples: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": true,
                "detail": "rules: pull_request, copilot_code_review, non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": true,
                "detail": "rules: pull_request, copilot_code_review, non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": true,
                "detail": "rules: pull_request, copilot_code_review, non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": true,
                "detail": "rules: pull_request, copilot_code_review, non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": true,
                "detail": "rules: non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/rules/branches/main",
              "detail": "transferwise/digital-signatures-examples: rules: pull_request, copilot_code_review, non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/rules/branches/master",
              "detail": "transferwise/digital-signatures: rules: pull_request, copilot_code_review, non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/rules/branches/master",
              "detail": "transferwise/public-api-postman-collection: rules: pull_request, copilot_code_review, non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/rules/branches/master",
              "detail": "transferwise/banks-reference-android: rules: pull_request, copilot_code_review, non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/rules/branches/main",
              "detail": "transferwise/wise-platform-samples: rules: non_fast_forward, pull_request, required_status_checks, pull_request, pull_request, required_signatures, deletion",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": false,
                "detail": "no .github/workflows"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/contents/?ref=main",
              "detail": "transferwise/digital-signatures-examples: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/contents/?ref=master",
              "detail": "transferwise/digital-signatures: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/contents/?ref=master",
              "detail": "transferwise/public-api-postman-collection: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/contents/?ref=master",
              "detail": "transferwise/banks-reference-android: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/contents/?ref=main",
              "detail": "transferwise/wise-platform-samples: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/contents/?ref=main",
              "detail": "transferwise/digital-signatures-examples: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/contents/?ref=master",
              "detail": "transferwise/digital-signatures: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/contents/?ref=master",
              "detail": "transferwise/public-api-postman-collection: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/contents/?ref=master",
              "detail": "transferwise/banks-reference-android: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/contents/?ref=main",
              "detail": "transferwise/wise-platform-samples: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/contents/?ref=main",
              "detail": "transferwise/digital-signatures-examples: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/contents/?ref=master",
              "detail": "transferwise/digital-signatures: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/contents/?ref=master",
              "detail": "transferwise/public-api-postman-collection: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/contents/?ref=master",
              "detail": "transferwise/banks-reference-android: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/contents/?ref=main",
              "detail": "transferwise/wise-platform-samples: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": false,
                "detail": "latest tags: v1.0"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "latest tags: 1.1, 1.0"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/tags",
              "detail": "transferwise/digital-signatures-examples: latest tags: v1.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/tags",
              "detail": "transferwise/digital-signatures: latest tags: 1.1, 1.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/tags",
              "detail": "transferwise/public-api-postman-collection: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/tags",
              "detail": "transferwise/banks-reference-android: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/tags",
              "detail": "transferwise/wise-platform-samples: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": true,
                "detail": "9 of 9 recent commits signed"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "2 of 5 recent commits signed"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": true,
                "detail": "6 of 10 recent commits signed"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/commits?per_page=10",
              "detail": "transferwise/digital-signatures-examples: 9 of 9 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/commits?per_page=10",
              "detail": "transferwise/digital-signatures: 2 of 5 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/commits?per_page=10",
              "detail": "transferwise/public-api-postman-collection: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/commits?per_page=10",
              "detail": "transferwise/banks-reference-android: 6 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/commits?per_page=10",
              "detail": "transferwise/wise-platform-samples: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/contents/?ref=main",
              "detail": "transferwise/digital-signatures-examples: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/contents/?ref=master",
              "detail": "transferwise/digital-signatures: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/contents/?ref=master",
              "detail": "transferwise/public-api-postman-collection: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/contents/?ref=master",
              "detail": "transferwise/banks-reference-android: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/contents/?ref=main",
              "detail": "transferwise/wise-platform-samples: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "transferwise/digital-signatures-examples",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "transferwise/digital-signatures",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "transferwise/public-api-postman-collection",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "transferwise/banks-reference-android",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "transferwise/wise-platform-samples",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures-examples/contents/?ref=main",
              "detail": "transferwise/digital-signatures-examples: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/digital-signatures/contents/?ref=master",
              "detail": "transferwise/digital-signatures: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/public-api-postman-collection/contents/?ref=master",
              "detail": "transferwise/public-api-postman-collection: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/banks-reference-android/contents/?ref=master",
              "detail": "transferwise/banks-reference-android: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/transferwise/wise-platform-samples/contents/?ref=main",
              "detail": "transferwise/wise-platform-samples: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "evidenced",
          "value": "Wise Payments Ltd, ISO/IEC 27001:2022, Coalfire Certification certificate 2020-080301 (registered 2020-08-03, latest 2026-06-30, expires 2029-08-03). Scope: the ISMS supporting Wise Account, Wise Business and Wise Platform, including Engineering, Product, Security and other teams.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://coalfirecertification.com/data/data.json",
              "quote": "\"registrant\": \"Wise Payments Ltd\", \"cert_number\": \"2020-080301\"",
              "detail": "Coalfire Certification's public client directory (client-directory.html loads this data file) lists Wise Payments Ltd, ISO/IEC 27001:2022, certificate 2020-080301, latest 06/30/2026, expiration 8/3/2029.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://coalfirecertification.com/data/data.json | grep -A8 '\"Wise Payments Ltd\"'",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://coalfirecertification.com/Certificates/Wise%20ISO%2027001%20Certificate%20Award%20-%2006.30.2026.pdf",
              "archive": "data/archive/wise-ops-iso27001-certificate.txt",
              "quote": "The certificate scope comprises the Information Security Management System supporting the operations underlying the",
              "detail": "Certificate PDF linked from the certifier directory, text archived. Names Wise Payments Ltd (London) with satellite offices in Tallinn, Budapest, Singapore and Austin; issued July 3, 2026.",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "The copy linked from wise.com/security (gateway/v1/iso-certificate) is the previous certificate, which expired on 2026-08-03; the certifier directory carries the renewal.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "evidenced",
          "value": "Same certificate (Wise Payments Ltd, 2020-080301): key activities at the listed offices include cloud engineering services and site reliability engineering. The underlying cloud infrastructure provider is not named, and its certification was not checked.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://coalfirecertification.com/Certificates/Wise%20ISO%2027001%20Certificate%20Award%20-%2006.30.2026.pdf",
              "archive": "data/archive/wise-ops-iso27001-certificate.txt",
              "quote": "Cloud engineering services",
              "detail": "Certificate page 2 lists cloud engineering services and site reliability engineering among the key processes in scope.",
              "checked_at": "2026-10-09"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "attested",
          "value": "Wise states it holds SOC 1 Type 2 and SOC 2 Type 2 attestations; business customers can download the reports after signing an NDA.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/security",
              "quote": "Business customers requiring our SOC 1 and SOC 2 attestations can sign an NDA and download the reports here",
              "detail": "Wise security page FAQ lists SOC 1 Type 2, SOC 2 Type 2, PCI-DSS and ISO/IEC 27001; SOC reports are at wise.com/security/reports behind an NDA.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "No independent source-code review report was found on wise.com/security, the privacy notice or docs.wise.com.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "Wise runs a Bugcrowd bug bounty (security.txt Policy field), but no penetration-test report or attestation letter was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "unknown",
          "note": "No stated scanning cadence was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "evidenced",
          "value": "Patching \"in a timely manner\" (UK personal privacy notice 9.1); no per-severity patch timelines are published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "We have procedures to update and patch our servers in a timely manner",
              "detail": "UK personal privacy notice section 9.1.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "No general customer incident-notification time was found. Wise's Hong Kong acquiring terms (wise.com/hk/legal/wise-card-processing-agreement) set a one-business-day mutual notice for shared personal data, which covers that product only. In the 2024 Evolve Bank incident Wise emailed affected customers (see maturity.incidents).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.3": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "evidenced",
          "value": "Public status page at status.wise.com with incident histories. No post-mortem was found among the 50 most recent incidents (2025-05-27 to 2026-09-28) returned by its API.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://status.wise.com",
              "quote": "Past Incidents",
              "detail": "Atlassian Statuspage for Wise with daily incident history.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://status.wise.com/api/v2/incidents.json",
              "detail": "The 50 incidents returned on 2026-10-09 contain no update or text mentioning a postmortem.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://status.wise.com/api/v2/incidents.json | grep -ci postmortem"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Two-step authentication is applied from account creation to payments; biometric login in the app.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/security",
              "quote": "Verifying it's you, from creating an account to making a payment",
              "detail": "Wise security page, \"Two-step authentication\".",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.3": {
          "status": "unknown",
          "note": "Access reviews may be covered by the SOC 2 Type 2 report, which is available only under NDA (see B1.3); not read.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.4": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.5": {
          "status": "evidenced",
          "value": "Users can configure an auto log-out; no default idle period is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/security",
              "quote": "Hide your currencies, location permissions and auto log-out",
              "detail": "Wise security page, \"Customisable controls\".",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "OAuth 2.0 for all Wise Platform partner accounts; mTLS, JOSE and SCA/2FA are optional additions.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.wise.com/guides/developer.md",
              "quote": "Wise also offers the following enhanced security frameworks for partners requiring additional protection: mTLS, JOSE",
              "detail": "Wise developer guide, Security section; the same paragraph says the Platform API implements OAuth 2.0 for all partner accounts.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.2": {
          "status": "evidenced",
          "value": "Client credentials scoped per integration, rotatable and revocable in Developer Hub; optional mTLS endpoint (api-mtls.transferwise.com); webhooks signed (see CROPS S5).",
          "refs": [
            {
              "criterion": "S5",
              "index": 2
            },
            {
              "criterion": "S5",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.3": {
          "status": "evidenced",
          "value": "Client-credentials access tokens expire after 12 hours, above the partner's 120-minute cap; the documented example refresh token is valid for about 20 years.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.wise.com/guides/developer/auth-and-security/client-credentials-token.md",
              "quote": "Client credentials tokens expire after **12 hours**",
              "detail": "Wise client-credentials token guide; the example response shows expires_in 43199 and refresh_token_expires_in 628639555 seconds.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.4": {
          "status": "unknown",
          "note": "Statement export in open formats is documented (CROPS O4); no volume limits or export logging were found.",
          "refs": [
            {
              "criterion": "O4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Encryption at rest for information not in active use and encrypted transport (privacy notice 9.1). Observed: wise.com refuses TLS 1.1 and accepts TLS 1.2. No data classification scheme was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "When information you’ve given us is not in active use, it is encrypted at rest",
              "detail": "UK personal privacy notice section 9.1.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "trace",
              "url": "https://wise.com",
              "detail": "openssl s_client -tls1_1 to wise.com:443 failed with alert protocol version; -tls1_2 negotiated ECDHE-RSA-AES128-GCM-SHA256. Run 2026-10-09.",
              "checked_at": "2026-10-09",
              "recheck": "echo | openssl s_client -connect wise.com:443 -servername wise.com -tls1_1; echo | openssl s_client -connect wise.com:443 -servername wise.com -tls1_2"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.2": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Kept only as long as necessary, but typically 5 to 10 years after account closure under financial-regulation retention duties (see CROPS P2 for what is collected).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "Typically we are required to retain that personal data for between five and ten years following account closure",
              "detail": "UK personal privacy notice section 8, Data Retention.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "The controller is the Wise group company providing the service; third-party partners act as independent controllers unless stated otherwise. DPIA availability not found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "responsible for the handling of your personal data (known as the",
              "detail": "UK personal privacy notice section 1 (Data controller) and 4.2 (partners as independent, separate data controllers).",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "unknown",
          "note": "No published data processing agreement was found for personal, business or Platform customers. The privacy notice offers details of transfer arrangements on request to privacy@wise.com.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B7.2": {
          "status": "unknown",
          "note": "The privacy notice says the security team proactively monitors for abnormal and malicious activity; no SIEM or endpoint-detection statement was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B8.1": {
          "status": "unknown",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Integration architecture only (docs.wise.com developer guides covering environments, auth and webhooks); logical and infrastructure architecture are not published.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.wise.com/guides/developer.md",
              "quote": "Use the sandbox environment for development and testing your integration",
              "detail": "Wise developer guide; sandbox and production base URLs, mTLS endpoints, Developer Hub.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Wise Payments Limited (England and Wales, company 07209813) for UK personal customers; other regions contract with other Wise entities (not recorded).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/07209813",
              "quote": "WISE PAYMENTS LIMITED",
              "detail": "Companies House record, active private limited company, incorporated 31 March 2010.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Customer fees (a fee on each transfer or conversion, card and ATM fees); Wise plc is a listed company.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/pricing/send-money",
              "quote": "a small, upfront fee to cover our costs",
              "detail": "Wise send-money pricing page.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "Customer may close at any time; funds left at closure can be claimed through support for 6 years, subject to checks. Wise may terminate with 90 days' notice, or immediately for misuse or regulatory reasons (UK personal terms 9.2-9.7).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/terms-of-use-personal",
              "quote": "You have the right to do this for a period of 6 years from the date your Wise Account is closed",
              "detail": "UK personal terms clause 9.2.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/terms-of-use-personal",
              "quote": "by giving you ninety (90) days' prior notice",
              "detail": "UK personal terms clause 9.7.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Yes: automated processes, including machine-learning models, take part in fraud and financial-crime prevention and may reject a transaction or close an account.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/legal/privacy-notice-personal-en",
              "quote": "These processes may make an automated decision to reject your application or a proposed transaction",
              "detail": "UK personal privacy notice 6.2; section 3 says Wise may use AI, including machine-learning models and LLMs, in its financial crime and fraud prevention processes.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "unknown",
          "note": "The privacy notice offers the right to request further information about an automated decision; no published AI governance (monitoring, validation, bias evaluation) was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "from 0.24%, varies by currency",
            "basis": "UK personal pricing page (sending and converting money); set by Wise and shown in its calculator per route.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "mid-market rate, no markup",
            "basis": "Wise states it uses the live mid-market rate plus the upfront fee.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payee",
            "amount": "ATM free up to 250 GBP per month, then 2.69% of the excess",
            "basis": "UK card fees page; ATM operators may add their own fees.",
            "evidence_index": 2
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "7 GBP card order",
            "basis": "UK pricing page.",
            "evidence_index": 0
          },
          {
            "kind": "network",
            "paid_by": "payee",
            "amount": "receiving Swift 6.11 USD, 2.16 GBP or 2.39 EUR per payment; domestic receipts free",
            "basis": "UK pricing page.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://wise.com/gb/pricing/",
            "quote": "Fee varies by currency From 0.24%",
            "detail": "Wise UK personal pricing page, fees at a glance (sending, converting, card, receiving).",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://wise.com/gb/pricing/send-money",
            "quote": "We only use the live mid-market rate, and a small, upfront fee to cover our costs",
            "detail": "Wise UK send-money pricing page.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://wise.com/gb/pricing/card-fees",
            "quote": "a fee of 2.69% applies only to the amount in excess of that 250 GBP allowance",
            "detail": "Wise UK card fees page.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "UK personal prices; other regions and Wise Business differ. Transfer limits were not recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "provider_custodial",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "Wise Payments Limited",
            "holder": "provider",
            "country": "GB",
            "regulator": "Financial Conduct Authority",
            "type": "Authorised Electronic Money Institution",
            "number": "900507",
            "activities": "Issue e-money and provide payment services; authorised since 07/06/2018",
            "register_url": "https://register.fca.org.uk/s/firm?id=001b000001EjC6SAAV",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://register.fca.org.uk/s/firm?id=001b000001EjC6SAAV",
            "archive": "data/archive/wise-ops-fca-register.txt",
            "quote": "Authorised Electronic Money Institution",
            "detail": "FCA Register firm page for reference 900507 (client-rendered; text read in a browser and archived).",
            "checked_at": "2026-10-09"
          }
        ],
        "note": "Only the UK entity is recorded. Wise operates other regulated entities (EEA, US, and others) under other regulators; not checked here.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "partner": "Partner banks and local payment schemes",
            "fee": "Transfer fee from 0.24% (varies by currency)",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "atm",
            "partner": "Wise card (Visa / Mastercard)",
            "fee": "UK card, free up to 250 GBP per month, then 2.69%",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://wise.com/gb/pricing/",
            "quote": "Fee varies by currency From 0.24%",
            "detail": "Sending money to bank accounts is the main cash-out route.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://wise.com/gb/pricing/card-fees",
            "quote": "Withdrawing money from an ATM",
            "detail": "ATM withdrawals with the Wise card.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ALL means every country in the availability list. Card eligibility is narrower than account availability, and send corridors vary by currency. No cash agents.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2011-01-01",
            "what": "Service launch (TransferWise). Wise gives the year only; the day and month are a placeholder."
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/gb/about/our-story",
              "quote": "Wise was launched in 2011",
              "detail": "Wise's own company story page.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Secondary sources say January 2011; no primary source for the month was found.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Wise Payments Limited",
            "jurisdiction": "GB",
            "register_url": "https://find-and-update.company-information.service.gov.uk/company/07209813",
            "registration_number": "07209813"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/07209813",
              "quote": "Incorporated on 31 March 2010",
              "detail": "Companies House; formerly TRANSFERWISE LTD and EXCHANGE SOLUTIONS LTD.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [
            {
              "date": "2024-07-01",
              "summary": "Data breach at Evolve Bank & Trust, Wise's US partner bank for USD account details in 2020-2023, exposed data Wise had shared (names, addresses, dates of birth, SSN/EIN or ID numbers). Wise says its own systems were not affected; resolved July 2024. The date is the month given, not a day.",
              "funds_lost": "no",
              "url": "https://wise.com/help/articles/1Tyvn34K9tp08aZ0y0Hqe0/data-breach-at-evolve-bank-trust-in-the-us"
            },
            {
              "date": "2026-01-15",
              "summary": "Issue across iOS, Android and web preventing customers from adding, moving or sending money; also affected Wise Platform partners (status page, major).",
              "funds_lost": "unknown",
              "url": "https://status.wise.com/incidents/hby2019q9hfm"
            },
            {
              "date": "2026-09-16",
              "summary": "Global outage across Wise services (status page, \"Widespread unavailability\").",
              "funds_lost": "unknown",
              "url": "https://status.wise.com/incidents/yt822bm200nl"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://wise.com/help/articles/1Tyvn34K9tp08aZ0y0Hqe0/data-breach-at-evolve-bank-trust-in-the-us",
              "quote": "Evolve Bank & Trust is a regulated bank that we worked with from 2020 until 2023 to provide USD account details",
              "detail": "Wise Help Centre notice, last updated 20 December 2024.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Selected from the status page's major or critical service incidents and Wise's own notices; the status API returns only the 50 most recent incidents (back to 2025-05-27), so older outages are not listed. No funds loss was stated in any source.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2018-06-07",
              "summary": "Authorised by the FCA as an Electronic Money Institution (FRN 900507).",
              "url": "https://register.fca.org.uk/s/firm?id=001b000001EjC6SAAV"
            },
            {
              "date": "2021-06-25",
              "summary": "Company renamed from TRANSFERWISE LTD to WISE PAYMENTS LIMITED (Companies House).",
              "url": "https://find-and-update.company-information.service.gov.uk/company/07209813"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://find-and-update.company-information.service.gov.uk/company/07209813",
              "quote": "TRANSFERWISE LTD 03 Aug 2012 - 25 Jun 2021",
              "detail": "Companies House previous company names.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://register.fca.org.uk/s/firm?id=001b000001EjC6SAAV",
              "archive": "data/archive/wise-ops-fca-register.txt",
              "quote": "Since 07/06/2018",
              "detail": "FCA Register firm status (archived).",
              "checked_at": "2026-10-09"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_verifiable",
        "reason": "Closed ledger with no public chain to read. Wise publishes reported volumes in its company reports; reported figures are not recorded here.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "worm": {
      "slug": "worm",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/contents/?ref=main",
              "detail": "worm-privacy/worm: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/contents/?ref=main",
              "detail": "worm-privacy/proof-of-burn: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/contents/?ref=stable",
              "detail": "worm-privacy/worm-miner: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/contents/?ref=main",
              "detail": "worm-privacy/worm-privacy.github.io: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/contents/?ref=main",
              "detail": "worm-privacy/trusted-setup: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/contents/?ref=main",
              "detail": "worm-privacy/worm: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/contents/?ref=main",
              "detail": "worm-privacy/proof-of-burn: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/contents/?ref=stable",
              "detail": "worm-privacy/worm-miner: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/contents/?ref=main",
              "detail": "worm-privacy/worm-privacy.github.io: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/contents/?ref=main",
              "detail": "worm-privacy/trusted-setup: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/contents/?ref=main",
              "detail": "worm-privacy/worm: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/contents/?ref=main",
              "detail": "worm-privacy/proof-of-burn: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/contents/?ref=stable",
              "detail": "worm-privacy/worm-miner: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/contents/?ref=main",
              "detail": "worm-privacy/worm-privacy.github.io: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/contents/?ref=main",
              "detail": "worm-privacy/trusted-setup: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/rules/branches/main",
              "detail": "worm-privacy/worm: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/rules/branches/main",
              "detail": "worm-privacy/proof-of-burn: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/rules/branches/stable",
              "detail": "worm-privacy/worm-miner: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/rules/branches/main",
              "detail": "worm-privacy/worm-privacy.github.io: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/rules/branches/main",
              "detail": "worm-privacy/trusted-setup: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": true,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": true,
                "detail": "2 workflow file(s)"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": false,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": false,
                "detail": "5 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/contents/?ref=main",
              "detail": "worm-privacy/worm: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/contents/?ref=main",
              "detail": "worm-privacy/proof-of-burn: 2 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/contents/?ref=stable",
              "detail": "worm-privacy/worm-miner: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/contents/?ref=main",
              "detail": "worm-privacy/worm-privacy.github.io: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/contents/?ref=main",
              "detail": "worm-privacy/trusted-setup: 5 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/contents/?ref=main",
              "detail": "worm-privacy/worm: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/contents/?ref=main",
              "detail": "worm-privacy/proof-of-burn: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/contents/?ref=stable",
              "detail": "worm-privacy/worm-miner: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/contents/?ref=main",
              "detail": "worm-privacy/worm-privacy.github.io: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/contents/?ref=main",
              "detail": "worm-privacy/trusted-setup: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/contents/?ref=main",
              "detail": "worm-privacy/worm: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/contents/?ref=main",
              "detail": "worm-privacy/proof-of-burn: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/contents/?ref=stable",
              "detail": "worm-privacy/worm-miner: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/contents/?ref=main",
              "detail": "worm-privacy/worm-privacy.github.io: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/contents/?ref=main",
              "detail": "worm-privacy/trusted-setup: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": false,
                "detail": "no tags"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": false,
                "detail": "latest tags: final, circuit_data, 0082_worm-privacy"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/tags",
              "detail": "worm-privacy/worm: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/tags",
              "detail": "worm-privacy/proof-of-burn: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/tags",
              "detail": "worm-privacy/worm-miner: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/tags",
              "detail": "worm-privacy/worm-privacy.github.io: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/tags",
              "detail": "worm-privacy/trusted-setup: latest tags: final, circuit_data, 0082_worm-privacy",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "1 of 10 recent commits signed"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": true,
                "detail": "5 of 10 recent commits signed"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": true,
                "detail": "5 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/commits?per_page=10",
              "detail": "worm-privacy/worm: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/commits?per_page=10",
              "detail": "worm-privacy/proof-of-burn: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/commits?per_page=10",
              "detail": "worm-privacy/worm-miner: 1 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/commits?per_page=10",
              "detail": "worm-privacy/worm-privacy.github.io: 5 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/commits?per_page=10",
              "detail": "worm-privacy/trusted-setup: 5 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": true,
                "detail": "4 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/contents/?ref=main",
              "detail": "worm-privacy/worm: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/contents/?ref=main",
              "detail": "worm-privacy/proof-of-burn: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/contents/?ref=stable",
              "detail": "worm-privacy/worm-miner: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/contents/?ref=main",
              "detail": "worm-privacy/worm-privacy.github.io: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/contents/?ref=main",
              "detail": "worm-privacy/trusted-setup: 4 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "worm-privacy/worm",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "worm-privacy/proof-of-burn",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "worm-privacy/worm-miner",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "worm-privacy/worm-privacy.github.io",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "worm-privacy/trusted-setup",
                "ok": true,
                "detail": "contribution section in README"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/contents/?ref=main",
              "detail": "worm-privacy/worm: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/proof-of-burn/contents/?ref=main",
              "detail": "worm-privacy/proof-of-burn: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-miner/contents/?ref=stable",
              "detail": "worm-privacy/worm-miner: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm-privacy.github.io/contents/?ref=main",
              "detail": "worm-privacy/worm-privacy.github.io: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/trusted-setup/contents/?ref=main",
              "detail": "worm-privacy/trusted-setup: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "evidenced",
          "value": "The README links audits by Hashlock and yAudit (circuits, 2025-11); neither is tied to the deployed commit eab0f53b. No review of the hosted prover is listed.",
          "refs": [
            {
              "criterion": "S6",
              "index": 0
            },
            {
              "criterion": "S6",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No SECURITY file, disclosure page or patch timeline found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page for the hosted prover and no post-mortems found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "The hosted prover and relay API (prover-2.worm.cx) takes unauthenticated JSON POSTs; the frontend sends the burn key, receiver, fees and account proof with only a Content-Type header.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/worm-privacy.github.io/blob/5c309e254871bdda9a3537f35c7f06c7f25527e4/src/lib/core/miner-api/proof-post.ts#L4-L40",
              "commit": "5c309e254871bdda9a3537f35c7f06c7f25527e4",
              "path": "src/lib/core/miner-api/proof-post.ts",
              "detail": "POST /proof with headers Content-Type only; the payload includes burn_key and receiver_address.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical view in the circuit and contract READMEs (burn address, nullifier, coin and commitment design; deployment addresses); integration view in the worm-miner README (CLI and server). No infrastructure view of the hosted prover.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "url": "https://github.com/worm-privacy/proof-of-burn/blob/92a7ecd1c5317ee383cf7b26b2977731ca6ff4fe/README.md#L9-L40",
              "commit": "92a7ecd1c5317ee383cf7b26b2977731ca6ff4fe",
              "path": "README.md",
              "detail": "Circuit design, public inputs, burn-key, nullifier and coin definitions.",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "O3",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "The protocol's only fee (0.5% of each mint and spend) goes to the Staking contract for WORM stakers, not to a team address; no other funding source for the team or the hosted prover is published.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 26153606,
              "detail": "rewardPool() is the Staking contract 0x03d4…60B7, which has no owner.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x66666aa9",
                "expect": "0x00000000000000000000000003d4702b51a98661b89df5fcbe8c4baef84c60b7"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C1",
              "index": 2
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "absent",
          "value": "No automated screening or AI in the payment path. mintCoin checks only nullifier, mint cap, block hash and proof, and the frontend has no country, sanctions or analytics code. The hosted prover's behaviour cannot be seen.",
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            },
            {
              "criterion": "C4",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "not_applicable",
          "reason": "No AI component in the payment path (B12.1 absent).",
          "burden": "none",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "0.5% pool fee on every mint and spend, minted to the Staking reward pool",
            "basis": "BETH constant POOL_SHARE_INV = 200, immutable (no owner, no proxy); deducted from the revealed amount, so the payee receives less.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "Prover fee and broadcaster fee chosen by the payer at burn time; 0 when the payee proves and submits itself",
            "basis": "Bound into the burn-address commitment and paid from the revealed amount; the CLI defaults the prover fee to 0. Fees charged by the hosted prover-2.worm.cx are not published.",
            "evidence_index": 1
          },
          {
            "kind": "network",
            "paid_by": "both",
            "amount": "Ethereum gas: the burn is a plain ETH transfer; sample mintCoin 393,690 gas at 0.134 gwei (0.0000527 ETH)",
            "basis": "The payer pays the burn transfer; whoever submits mintCoin (payee or broadcaster) pays its gas. Sample tx 0x2d9afb3d…c433 (2026-10-08).",
            "evidence_index": 2
          },
          {
            "kind": "fx",
            "paid_by": "payee",
            "amount": "BETH to ETH conversion at the CypherETH pool price through the optional BETHToETH hook; no fixed rate",
            "basis": "The payee receives BETH; its ETH value depends on AMM liquidity. Pool fee and slippage not recorded.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/worm-privacy/worm/blob/eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6/src/BETH.sol#L163-L240",
            "commit": "eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6",
            "path": "src/BETH.sol",
            "detail": "mintCoin computes poolFee = revealedAmount / POOL_SHARE_INV (L187; constant 200 at L14) when a reward pool is set, requires proverFee + broadcasterFee to fit in the rest (L201), and mints the fees to the prover and msg.sender and the pool fee to the reward pool (L232-L239). spendCoin applies the same 0.5% (L270).",
            "checked_at": "2026-10-09",
            "recheck": "gh api \"repos/worm-privacy/worm/contents/src/BETH.sol?ref=eab0f53b111d016aaaedaeb05b5fbbc53b74c9c6\" --jq .content | base64 -d | sed -n 185,240p"
          },
          {
            "tier": "verified",
            "kind": "repo",
            "url": "https://github.com/worm-privacy/worm-miner/blob/fd23cd8012f550cf4950dad02e79c1ce9d39b809/README.md#L37-L64",
            "commit": "fd23cd8012f550cf4950dad02e79c1ce9d39b809",
            "path": "README.md",
            "detail": "CLI burn takes --broadcaster-fee and --prover-fee; the prover fee defaults to 0 for self-proving.",
            "checked_at": "2026-10-09",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://eth.blockscout.com/tx/0x2d9afb3d106a4a4e6025b2910d42aacd1edd1ecc5dbb711aabc334629b99c433",
            "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
            "block_number": 26146294,
            "detail": "mintCoin (selector 0x64a27e3c) in block 26146294, 2026-10-08 07:50:11 UTC, revealed 0.12 BETH, of which 0.0006 BETH (0.5%) was minted for the reward pool; the transaction used 393,690 gas at 0.134 gwei.",
            "checked_at": "2026-10-09",
            "recheck": "cast receipt 0x2d9afb3d106a4a4e6025b2910d42aacd1edd1ecc5dbb711aabc334629b99c433 --rpc-url https://rpc.mevblocker.io"
          }
        ],
        "note": "Between deployment (2026-02-11) and the reward-pool initialisation (2026-02-23) the pool fee was 0, because the contract skips it while no pool is set.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with S1 (score 3). Between burn and mint no one holds the value; the right to mint is fixed to the payee by the burn-address commitment, and no role can move or redirect BETH. The holder of the burn key decides when to mint.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "verified",
            "kind": "api",
            "url": "https://api.github.com/orgs/worm-privacy",
            "detail": "The worm-privacy GitHub organisation names no company; worm.cx has no terms page (worm.cx/terms returns 404) and the frontend source contains no terms or licence text.",
            "checked_at": "2026-10-09",
            "recheck": "gh api orgs/worm-privacy --jq '{name,company,blog}'"
          }
        ],
        "note": "No operating entity is disclosed, so no register could be searched; no licence is claimed anywhere WORM publishes. The team runs the optional hosted prover and broadcaster at prover-2.worm.cx.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "The payee receives BETH (or ETH through the optional swap hook) at its own Ethereum address; converting to local currency is outside the protocol.",
        "burden": "institution",
        "refs": [
          {
            "criterion": "C2",
            "index": 0
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-02-11",
            "block": 24436025,
            "what": "BETH 0x5624…9Cf8 on Ethereum, tx 0x681f4deb…8516 from 0x8DC7…C0Bb."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8?fields=deployment",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 24436025,
              "detail": "Sourcify creation data (exact match) gives tx 0x681f4debcc8ceb6c905e7f831cbcf48e79a6d09e6df93d1caa57ba68be6a8516 in block 24436025, deployer 0x8DC77b145d7009752D6947B3CF6D983caFA1C0Bb; the block is dated 2026-02-11 20:49:47 UTC.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8?fields=deployment\""
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "absent",
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/orgs/worm-privacy",
              "detail": "The organisation profile has no company field; it links only worm.cx.",
              "checked_at": "2026-10-09",
              "recheck": "gh api orgs/worm-privacy --jq '{name,company,blog}'"
            }
          ],
          "note": "Searched: the GitHub org profile and repositories (READMEs, frontend source), worm.cx (no terms, imprint or company name; /terms is 404). No legal entity is named.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "evidenced",
          "value": [],
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/worm-privacy/worm/security-advisories",
              "detail": "No published security advisories for worm-privacy/worm (worm-privacy/worm-miner also has none).",
              "checked_at": "2026-10-09",
              "recheck": "for r in worm worm-miner; do gh api repos/worm-privacy/$r/security-advisories --jq length; done"
            }
          ],
          "note": "No incident or post-mortem found in the repositories or on worm.cx.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-02-11",
              "summary": "BETH deployed with immutable verifiers and a one-time initializer; no reward pool set, so no pool fee.",
              "url": "https://eth.blockscout.com/tx/0x681f4debcc8ceb6c905e7f831cbcf48e79a6d09e6df93d1caa57ba68be6a8516"
            },
            {
              "date": "2026-02-23",
              "summary": "initRewardPool sets the Staking contract 0x03d4…60B7 as reward pool and clears the initializer (tx 0x3c0d39e1…f7dc); the 0.5% pool fee applies from then on.",
              "url": "https://eth.blockscout.com/tx/0x3c0d39e1d1910bfef250ce798b849473c318b8a9e5e0a8aa90c12a929033f7dc"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/1/0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "address": "0x5624344235607940d4d4EE76Bf8817d403EB9Cf8",
              "block_number": 24518725,
              "detail": "rewardPool() changes from zero to 0x03d4…60B7 at block 24518725 (bisected with historical eth_call), where tx 0x3c0d39e1…f7dc from the deployer calls BETH with selector 0x1891708b; initializer() reads zero afterwards. Staking itself was deployed at block 24500500 (Sourcify).",
              "checked_at": "2026-10-09",
              "recheck": "cast call 0x5624344235607940d4d4EE76Bf8817d403EB9Cf8 \"rewardPool()(address)\" --block 24518724 --rpc-url https://rpc.mevblocker.io"
            }
          ],
          "note": "The contracts are immutable, so these are the only changes possible. The worm repository's main branch has later, undeployed changes (configurable pool share); they would need a new deployment.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "The payer's leg is a plain ETH transfer to an unlinkable burn address (no log). The payee's leg, mintCoin, emits only ERC-20 Transfer logs from the zero address; the sender is an indexed topic, which the volume spec cannot filter, so mints cannot be separated from ordinary BETH transfers and AMM swaps.",
        "note": "A from-topic filter in scripts/volumes.mjs would make mints countable (Transfer from 0x0 on BETH, amount in word 0, including the fee mints to prover, broadcaster and pool). 32 mint transactions in the last 200,000 blocks to 2026-10-09 (read for the gas sample).",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "notes": "Operator-free transfer protocol (no required closed component); operator controls are recorded only for the WORM-run hosted prover and broadcaster, which the official send flow uses by default. Custodial controls are left unset (self-custody). Bot facts (B2.1, B2.3, B8.2, B9.x) untouched."
    },
    "xplace-card": {
      "slug": "xplace-card",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/contents/?ref=master",
              "detail": "Kamino-Finance/klend: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/contents/?ref=master",
              "detail": "Kamino-Finance/klend: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/contents/?ref=master",
              "detail": "Kamino-Finance/klend: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": true,
                "detail": "rules: repository_visibility, repository_delete, repository_transfer, required_signatures, deletion, non_fast_forward, pull_request"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/rules/branches/master",
              "detail": "Kamino-Finance/klend: rules: repository_visibility, repository_delete, repository_transfer, required_signatures, deletion, non_fast_forward, pull_request",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": true,
                "detail": "1 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/contents/?ref=master",
              "detail": "Kamino-Finance/klend: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/contents/?ref=master",
              "detail": "Kamino-Finance/klend: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/contents/?ref=master",
              "detail": "Kamino-Finance/klend: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": false,
                "detail": "latest tags: release/v1.26.0, release/v1.25.0, release/v1.24.0"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/tags",
              "detail": "Kamino-Finance/klend: latest tags: release/v1.26.0, release/v1.25.0, release/v1.24.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/commits?per_page=10",
              "detail": "Kamino-Finance/klend: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": true,
                "detail": "10 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/contents/?ref=master",
              "detail": "Kamino-Finance/klend: 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "Kamino-Finance/klend",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/Kamino-Finance/klend/contents/?ref=master",
              "detail": "Kamino-Finance/klend: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement found for Pontech Group L.L.C-FZ in the XPlace docs, terms, privacy policies or homepage.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.2": {
          "status": "unknown",
          "note": "No hosting or support organisation certification found; the privacy policy names cloud, database and APM providers by category only.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "attested",
          "value": "The homepage says XPlace's smart contracts are audited by FYEO; no report, scope, date or contract address is published (CROPS S6 unknown). Kamino's klend audits are the protocol's own.",
          "evidence": [
            {
              "tier": "claimed",
              "by": "provider",
              "kind": "document",
              "url": "https://x.place",
              "detail": "XPlace homepage security section.",
              "checked_at": "2026-10-09",
              "quote": "audited by FYEO",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration-test report or attestation found; the privacy policy's \"vulnerability testing\" statement is recorded under B1.6.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.6": {
          "status": "evidenced",
          "value": "The privacy policy states \"regular security assessments and vulnerability testing of Platform infrastructure\"; no cadence or tool is given.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "detail": "XPlace privacy policy (effective 20 May 2026), section 13 data security.",
              "checked_at": "2026-10-09",
              "quote": "Regular security assessments and vulnerability testing of Platform infrastructure",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "evidenced",
          "value": "For a personal data breach posing a high risk, affected users are notified \"promptly and without undue delay\" once confirmed and the supervisory authority within 72 hours where the law requires; breaches at the Card Partner or Kamino fall to their own incident response. No 24-hour commitment.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "detail": "Privacy policy section 14, data breach notification.",
              "checked_at": "2026-10-09",
              "quote": "Notify affected users promptly and without undue delay once a breach has been confirmed",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B4.1": {
          "status": "evidenced",
          "value": "Sign-up by email, Google or Apple ID, then a 6-digit app PIN with optional Face ID; the card has a 4-digit PIN. No separate second factor is documented.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/getting-started/sign-up",
              "detail": "Sign-up page, secure your account step.",
              "checked_at": "2026-10-09",
              "quote": "6 digit PIN to protect access to your account",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.1": {
          "status": "evidenced",
          "value": "Personal data encrypted in transit (TLS/SSL, version not stated) and at rest; card data encrypted in transit and at rest and full card numbers not stored by XPlace. No data classification is stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "detail": "Privacy policy section 13.",
              "checked_at": "2026-10-09",
              "quote": "Encryption of Personal Data at rest on our servers",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "detail": "Terms s4.6.",
              "checked_at": "2026-10-09",
              "quote": "Card data associated with your XPlace Card is encrypted in transit and at rest",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "Account and identity data and KYC/biometric data for the account's life plus 5 years; transaction records at least 5 years; usage and analytics data up to 24 months; support data 3 years after ticket closure; then deleted or anonymised. On-chain data cannot be deleted.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "detail": "Privacy policy section 11, retention table.",
              "checked_at": "2026-10-09",
              "quote": "Duration of account + 5 years after closure",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Pontech Group L.L.C-FZ is the controller; where it passes KYC data to the Card Partner, it acts as processor and the partner is controller; Sumsub and infrastructure providers are processors under DPAs. No DPIA is mentioned.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "detail": "Privacy policy section 2, data controller.",
              "checked_at": "2026-10-09",
              "quote": "The data controller responsible for your Personal Data is",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.5": {
          "status": "attested",
          "value": "Standard Contractual Clauses for EEA transfers are available on request by email; no published DPA for customers.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "detail": "Privacy policy, international transfers.",
              "checked_at": "2026-10-09",
              "quote": "You may request a copy of the applicable SCCs",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "absent",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/llms.txt",
              "detail": "Full docs index (product, card and legal pages); no architecture page. The card overview gives one paragraph on collateral going to Kamino on Solana.",
              "checked_at": "2026-10-09",
              "quote": "XPlace - Crypto Credit Card",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Searched: the docs.x.place index and every product and card page, the homepage, GitHub (no XPlace organisation).",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Pontech Group L.L.C-FZ, Meydan Grandstand, Dubai, UAE; terms under UAE law with DIAC arbitration in Dubai. The card is a three-party agreement with the issuer (Third National for international users).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "detail": "Terms preamble and s20.7 notices.",
              "checked_at": "2026-10-09",
              "quote": "THESE TERMS CONSTITUTE A LEGALLY BINDING AGREEMENT BETWEEN YOU AND PONTECH GROUP L.L.C-FZ",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/card-terms-international-user",
              "detail": "International card terms, definitions.",
              "checked_at": "2026-10-09",
              "quote": "The issuer for this card program is Third National.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "No company register entry was found; Meydan Free Zone has no public search that could be read without a browser.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Annual membership fees (0 to 999 USDC) and per-use fees (FX, bank transfer, trading, Credit Mode); cashback is paid out of those fees. No annual report was found.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "detail": "Terms s6, fees and payments.",
              "checked_at": "2026-10-09",
              "quote": "Annual Membership fees are charged in USDC",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "XPlace may suspend or terminate without notice on listed grounds, and suspend Kamino or Credit Mode access on a protocol incident; the user terminates by emailing legal@x.place after repaying Credit Mode balances; XP, cashback and membership are forfeited with no refund. Collateral stays in Kamino under the user's obligation (S1).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "detail": "Terms s18 suspension and termination.",
              "checked_at": "2026-10-09",
              "quote": "You may terminate your account at any time by contacting",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "S1",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "The privacy policy says KYC and sanctions screening may involve automated decision-making including profiling with significant effects; Sumsub runs biometric verification and the Card Partner does transaction monitoring. Whether a learned model is used is not stated.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "detail": "Privacy policy s15.3, automated decision-making.",
              "checked_at": "2026-10-09",
              "quote": "Certain KYC and sanctions screening processes may involve automated decision-making",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "evidenced",
          "value": "Users may request human review, give their view and contest an automated decision (override); monitoring, validation, decommissioning and bias evaluation are not documented.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-privacy-policy",
              "detail": "Privacy policy s15.3.",
              "checked_at": "2026-10-09",
              "quote": "request human review of the automated decision",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Annual membership Basic free, Silver 99, Gold 249, Platinum 999 USDC",
            "basis": "Terms s6.1 (effective 20 May 2026); XPlace may change fees with 30 days' notice.",
            "evidence_index": 0
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Card transaction fee 0% (all tiers)",
            "basis": "Terms s6.3.",
            "evidence_index": 0
          },
          {
            "kind": "fx",
            "paid_by": "payer",
            "amount": "XPlace FX fee 1% / 0.5% / 0.25% / 0% by tier, plus Visa's 1% FX fee",
            "basis": "Terms s6.3 and the card overview page; the October 2025 card terms list FX and cross-border fees as 0%, which conflicts.",
            "evidence_index": 1
          },
          {
            "kind": "cashout",
            "paid_by": "payer",
            "amount": "Bank transfer fee 2% / 1.5% / 1% / 0.5% by tier",
            "basis": "Terms s6.3; applies to transfers to or from a linked bank account.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payer",
            "amount": "Trading fee 1% / 0.9% / 0.7% / 0.5% by tier; Credit Mode borrow APR variable from Kamino",
            "basis": "Terms s6.3 and the Credit page; a Credit Mode fee is named in the terms without a rate.",
            "evidence_index": 2
          },
          {
            "kind": "card",
            "paid_by": "payer",
            "amount": "Late payment up to 40 USD (international) or 2% of balance (US); returned payment up to 29 USD",
            "basis": "Card terms important disclosures; purchases carry 0% APR.",
            "evidence_index": 3
          },
          {
            "kind": "limit",
            "paid_by": "none",
            "amount": "Monthly spend 2,000 / 10,000 / 50,000 / 750,000 USD; per transaction 1,000 / 3,000 / 10,000 / 25,000",
            "basis": "Terms s6.1 by tier (Basic, Silver, Gold, Platinum); may vary with KYC level.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
            "detail": "Terms s6.1 membership table and s6.3 transaction and platform fee table.",
            "checked_at": "2026-10-09",
            "quote": "Bank Transfer Fee: applied to transfers to or from a linked bank account.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/card/about-xplace-sard",
            "detail": "Card overview, foreign currency spending.",
            "checked_at": "2026-10-09",
            "quote": "Visa applies a standard 1% FX conversion fee",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/xplace/credit",
            "detail": "Credit page, borrow APR.",
            "checked_at": "2026-10-09",
            "quote": "Borrow rates are variable and sourced directly from Kamino Finance",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/legal/legal/card-terms-international-user",
            "detail": "International card terms (25 October 2025), fees table.",
            "checked_at": "2026-10-09",
            "quote": "Foreign Exchange Fee (non-USD)",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Solana network fees and the bridge deposit fee named in s6.3 have no stated amount, so they are unknown, not zero. The card terms (October 2025) and the platform terms (May 2026) disagree on FX; both are listed.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "hybrid",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with S1 (score 1): collateral sits in Kamino's upgradeable lending program under the user's obligation, from an embedded wallet in XPlace's closed app. Card spending is funded and settled by Rain offchain; Cash Mode USDC is deposited onto the card balance, which the issuer controls. Judgment call: hybrid, because the card side is custodial with Rain while collateral is not held by XPlace.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "evidenced",
        "value": [
          {
            "entity": "Odoakpu Microfinance Bank Nigeria Limited",
            "holder": "partner",
            "country": "NG",
            "regulator": "Central Bank of Nigeria",
            "type": "Microfinance bank",
            "activities": "Markets the card to Nigerian users and is responsible for CBN compliance and Nigerian data protection for it (card terms s7.4).",
            "register_url": "https://www.cbn.gov.ng/supervision/Inst-MF.html",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.cbn.gov.ng/supervision/Inst-MF.html",
            "archive": "data/archive/xplace-card-ops-cbn-mfb-register.txt",
            "detail": "CBN microfinance bank list (client-rendered from /api/GetMFBs) includes ODOAKPU MFB, id 3799; no licence category or date is given.",
            "checked_at": "2026-10-09",
            "quote": "\"name\":\"ODOAKPU MFB\"",
            "recheck": "curl -s https://www.cbn.gov.ng/api/GetMFBs | jq '.[] | select(.name | test(\"ODOAKPU\"))'"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/legal/legal/card-terms-international-user",
            "detail": "International card terms s7.4, for Nigerian users.",
            "checked_at": "2026-10-09",
            "quote": "a financial institution licensed by the Central Bank of",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Only the Nigerian partner is evidenced from a register. Pontech Group L.L.C-FZ (the provider) does not appear in the VARA public register (vara.ae, server-rendered, read 2026-10-09), and the terms say XPlace is not a money transmitter or financial intermediary; no other UAE register was searched. Rain (Signify Holdings, Inc.) is described as 'a licensed card program manager and issuing sponsor' without a licence named; the international issuer is named only as 'Third National' and was not identified in a register; the US issuer is not named. Rain MENA FZE holds a VARA licence (VL/26/10/001) but XPlace does not name it.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "evidenced",
        "value": [
          {
            "countries": [
              "ALL"
            ],
            "method": "card_spend",
            "partner": "Signify Holdings, Inc. (Rain), issuer Third National, Visa",
            "fee": "0% card fee; FX 1% Visa plus 0 to 1% XPlace by tier",
            "limits": "2,000 to 750,000 USD per month and 1,000 to 25,000 per transaction by tier",
            "evidence_index": 0
          },
          {
            "countries": [
              "ALL"
            ],
            "method": "bank_transfer",
            "fee": "2% to 0.5% by membership tier",
            "limits": "Partner, currencies and countries not stated",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
            "detail": "Terms s5.1 (card settlement by the Card Partner) and s6.",
            "checked_at": "2026-10-09",
            "quote": "a licensed card program manager and issuing sponsor",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://docs.x.place/xplace/portfolio",
            "detail": "Portfolio page lists sending to an external wallet or bank account; the fee is in Terms s6.3.",
            "checked_at": "2026-10-09",
            "quote": "Send crypto to an external wallet or bank account",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "ALL means every country not on the 17-country blocklist (and not in the 16 restricted US states). The US card terms mention PIN cash withdrawals at ATMs \"if enabled\" with no cash advance fee, but no XPlace page says ATM withdrawal is offered, so no ATM row is recorded.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "unknown",
          "note": "XPlace publishes no address for its own (FYEO-audited) contracts or for Rain's Solana collateral program, and card settlement is offchain. The listed klend program is Kamino's, deployed long before XPlace existed, so its date would not describe XPlace. The earliest dated XPlace documents are the EULA and cookie policy (effective 15 October 2025).",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Pontech Group L.L.C-FZ",
            "jurisdiction": "AE-DU"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "detail": "Terms name Pontech Group L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, as the contracting party.",
              "checked_at": "2026-10-09",
              "quote": "Meydan Grandstand, 6th Floor",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The L.L.C-FZ suffix and Meydan address indicate a Meydan Free Zone company; no company register entry could be read (no public search without a browser), so no register URL or number is given.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "Searched: XPlace docs, terms, privacy policies and homepage; no incident disclosure or log found. XPlace has no public repository with advisories. Kamino incidents were not searched, since XPlace's market is not identified.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2025-10-15",
              "summary": "EULA and cookie policy take effect (earliest dated XPlace documents).",
              "url": "https://docs.x.place/legal/legal/end-user-license-agreement-eula"
            },
            {
              "date": "2025-10-25",
              "summary": "Card terms (US and international) and card privacy policy published; international issuer Third National, 0% FX and cross-border fees.",
              "url": "https://docs.x.place/legal/legal/card-terms-international-user"
            },
            {
              "date": "2026-05-20",
              "summary": "New terms and privacy policy take effect, with the tiered fee table (FX 0 to 1%, bank transfer 0.5 to 2%) and Kamino named as the protocol.",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions"
            }
          ],
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/end-user-license-agreement-eula",
              "detail": "EULA effective date.",
              "checked_at": "2026-10-09",
              "quote": "Effective Date: October 15, 2025",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/card-terms-international-user",
              "detail": "International card terms effective date.",
              "checked_at": "2026-10-09",
              "quote": "Effective as of: 25 October 2025",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://docs.x.place/legal/legal/xplace-terms-and-conditions",
              "detail": "Terms effective date.",
              "checked_at": "2026-10-09",
              "quote": "Effective Date: May 20, 2026",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "not_observable",
        "reason": "Card payments are authorised, cleared and settled offchain by Rain over Visa; XPlace publishes no address for its own contracts or for the Rain collateral program, and the Kamino market used for XPlace collateral is not identified. The chain is Solana, which the EVM log spec cannot express.",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      }
    },
    "zcash": {
      "slug": "zcash",
      "fees": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": [
          {
            "kind": "network",
            "paid_by": "payer",
            "amount": "ZIP 317 conventional fee, 5000 zatoshis per logical action, minimum 2 actions (10000 zats = 0.0001 ZEC)",
            "basis": "Wallet and mempool convention (ZIP 317, Active), not a consensus fee; logical actions count transparent inputs/outputs, Sapling spends/outputs, Orchard and (since NU6.3) Ironwood actions. Paid to the miner. Changes need a ZIP and node releases.",
            "evidence_index": 0
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "repo",
            "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
            "checked_at": "2026-10-09",
            "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0317.rst#L126-L196",
            "path": "zips/zip-0317.rst",
            "detail": "conventional_fee = marginal_fee x max(grace_actions, logical_actions) with marginal_fee = 5000 zatoshis and grace_actions = 2 (L130-L146); Revision 1 adds nActionsIronwood to logical_actions from NU6.3 (L178-L196).",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "There is no protocol or provider fee. Relayers do not exist; light-wallet servers are free public services. Swap and merchant integrations in third-party wallets are out of scope.",
        "checked_at": "2026-10-09"
      },
      "custody_model": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          }
        ],
        "note": "Agrees with the S1 finding (anchor 3 in substance, capped at 2 only for want of contract evidence). Value moves from notes the payer controls to notes the payee controls; nobody holds funds in flight.",
        "checked_at": "2026-10-09"
      },
      "licences": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "No operating entity runs the rail. Zcash is a proof-of-work chain run by independent miners and node operators; the Zcash Foundation and ZODL maintain software but do not transmit or hold users' funds.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "cashout": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_applicable",
        "reason": "Native-asset rail. The payee receives ZEC at its own shielded address; converting ZEC to local currency is outside the protocol.",
        "burden": "institution",
        "checked_at": "2026-10-09"
      },
      "maturity": {
        "first_deployment": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "date": "2016-10-28",
            "block": 0,
            "what": "Zcash mainnet genesis (Sprout shielded pool). The assessed Ironwood pool activated with NU6.3 at height 3,428,143 on 2026-07-28 (see changes)."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/zebra-chain/src/parameters/constants.rs#L75-L99",
              "path": "zebra-chain/src/parameters/constants.rs",
              "detail": "Mainnet activation heights compiled into Zebra v6.4.2, from Overwinter 347,500 to NU6.3 3,428,143; network_upgrade.rs L104-L120 maps Height(0) to Genesis."
            },
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://api.blockchair.com/zcash/raw/block/0",
              "block_number": 0,
              "detail": "The raw genesis header's nTime field (bytes 100-103, little-endian) decodes to 2016-10-28T07:56:00Z. The NU6.3 activation block 3428143 decodes to 2026-07-28T14:07:23Z the same way. Read through a public explorer API; any Zcash node returns the same header.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s https://api.blockchair.com/zcash/raw/block/0 | jq -r '.data[0].raw_block[200:208]'  (reverse the 4 bytes, then date -u -r)"
            }
          ],
          "note": "Judgment call. Genesis is recorded as the first deployment of the rail; the Ironwood pool, which carries new shielded transfers today, is under three months old.",
          "checked_at": "2026-10-09"
        },
        "entity": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": {
            "legal_name": "Zcash Foundation",
            "jurisdiction": "US"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zfnd.org/",
              "detail": "The Zcash Foundation maintains Zebra, the only maintained consensus node since zcashd reached end of life, and holds the Zcash trademark.",
              "quote": "The Zcash Foundation is a 501(c)(3) public charity",
              "checked_at": "2026-10-09",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/SECURITY.md#L115-L125",
              "path": "SECURITY.md",
              "detail": "Zebra's security policy names Zcash Open Development Lab (ZODL) as maintainer of zcash/zcash, librustzcash and zallet.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Judgment call. Maintenance is split between the Zcash Foundation (Zebra node) and ZODL (librustzcash, orchard, Zallet, Zodl wallet; Znewco, Inc. per the Zodl SDK CLA). The Foundation is recorded because the assessed unit is defined by Zebra. The IRS exempt-organisation entry was not looked up (no EIN on the site), so no register_url. Electric Coin Company still runs electriccoin.co but no longer appears as maintainer in the sources read.",
          "checked_at": "2026-10-09"
        },
        "incidents": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2019-03-27",
              "summary": "CVE-2019-7167 published. A flaw in the original Sprout zk-SNARK parameters allowed counterfeiting before the Sapling upgrade (2018-10-28), which removed it. Whether it was exploited cannot be seen in the shielded pool.",
              "funds_lost": "unknown",
              "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7167"
            },
            {
              "date": "2026-06-02",
              "summary": "Orchard circuit soundness flaw (reported 2026-05-29) allowed counterfeiting and spending others' notes within Orchard. Orchard disabled by emergency soft fork at height 3363426, fixed in NU6.2 (2026-06-03), sealed withdraw-only by NU6.3. Exploitation cannot be ruled out; the ZIP 209 turnstile protects the supply cap.",
              "funds_lost": "unknown",
              "url": "https://github.com/zcash/zcash/security/advisories/GHSA-ghc3-g8w4-whf9"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "checked_at": "2026-10-09",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0257.md#L33-L67",
              "path": "zips/zip-0257.md",
              "detail": "ZIP 257 records the 2026-05-29 report, the emergency disabling of Orchard from height 3363426 and the failed attempt at 3363366.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/security-advisories",
              "detail": "zcash/zcash publishes GHSA-ghc3-g8w4-whf9 (critical, 2026-07-19) plus node DoS and consensus-robustness advisories; ZcashFoundation/zebra publishes GHSA-ww9q-8r59-xv46 for the same flaw and further peer-handling advisories in 2026.",
              "checked_at": "2026-10-09"
            }
          ],
          "note": "Only fund-safety incidents are listed. 2026 node advisories in zcashd and Zebra (denial of service, block poisoning, peer bans) are not repeated here. ECC's 2019 post-mortem on electriccoin.co returned HTTP 403 and was not read; the CVE record is cited instead.",
          "checked_at": "2026-10-09"
        },
        "changes": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": [
            {
              "date": "2018-10-29",
              "summary": "Sapling network upgrade (height 419200), new shielded pool and proving system.",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0205.rst"
            },
            {
              "date": "2022-05-31",
              "summary": "NU5 (height 1687104) introduces the Orchard pool and Halo 2 proofs without trusted setup.",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0252.rst"
            },
            {
              "date": "2024-11-23",
              "summary": "NU6 (height 2726400) replaces the dev fund with the deferred lockbox (12%) and Zcash Community Grants (8%) streams.",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0253.md"
            },
            {
              "date": "2025-11-24",
              "summary": "NU6.1 (height 3146400) extends the funding streams and disburses the lockbox (ZIP 271).",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0255.md"
            },
            {
              "date": "2026-06-02",
              "summary": "Emergency soft fork disables Orchard actions (height 3363426).",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0257.md"
            },
            {
              "date": "2026-06-03",
              "summary": "NU6.2 (height 3364600) re-enables Orchard with the corrected circuit and limits proof length.",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0257.md"
            },
            {
              "date": "2026-07-18",
              "summary": "zcashd reaches its end-of-support halt at height 3417100; Zebra and Zallet become the only maintained node and full-node wallet.",
              "url": "https://github.com/zcash/zcash/security/advisories/GHSA-ghc3-g8w4-whf9"
            },
            {
              "date": "2026-07-28",
              "summary": "NU6.3 (height 3428143) activates the Ironwood pool and seals Orchard as withdraw-only behind a turnstile.",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0258.md"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/zebra-chain/src/parameters/constants.rs#L75-L99",
              "path": "zebra-chain/src/parameters/constants.rs",
              "detail": "Mainnet activation heights for every upgrade listed; dates are the timestamps of the activation blocks (read from block headers via api.blockchair.com/zcash/raw/block/<height>)."
            },
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "checked_at": "2026-10-09",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0258.md#L60-L72",
              "path": "zips/zip-0258.md",
              "detail": "ZIP 258 fixes the NU6.3 Mainnet activation height at 3428143 (status Draft at this commit although the upgrade has activated).",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Overwinter, Blossom, Heartwood and Canopy are omitted for brevity; their heights are in the same Zebra constants.",
          "checked_at": "2026-10-09"
        }
      },
      "volume": {
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "status": "not_observable",
        "reason": "Shielded transfers hide amounts and parties by design; only pool-level flows (value entering or leaving each shielded pool through the turnstile) are visible on the chain. Zcash also has no contract address the volume script could query."
      },
      "facts": {
        "B2.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": true,
                "detail": "security policy file: SECURITY.md"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zcash/orchard",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zcash/zips",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zcash/zallet",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": true,
                "detail": "security policy file: SECURITY.md"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/contents/?ref=main",
              "detail": "ZcashFoundation/zebra: security policy file: SECURITY.md",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/contents/?ref=main",
              "detail": "zcash/librustzcash: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/contents/?ref=main",
              "detail": "zcash/orchard: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/contents/?ref=main",
              "detail": "zcash/zips: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/contents/?ref=master",
              "detail": "zcash/lightwalletd: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/contents/?ref=dev",
              "detail": "zingolabs/zaino: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/contents/?ref=main",
              "detail": "zcash/zallet: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/contents/?ref=main",
              "detail": "zodl-inc/zodl-android: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/contents/?ref=main",
              "detail": "zodl-inc/zodl-ios: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/contents/?ref=main",
              "detail": "zodl-inc/zodl-android-wallet-sdk: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/contents/?ref=master",
              "detail": "zcash/zcash (archived): security policy file: SECURITY.md",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "zcash/orchard",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "zcash/zips",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "zcash/zallet",
                "ok": true,
                "detail": "scanning step in a workflow"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": true,
                "detail": "dependabot config present"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/contents/?ref=main",
              "detail": "ZcashFoundation/zebra: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/contents/?ref=main",
              "detail": "zcash/librustzcash: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/contents/?ref=main",
              "detail": "zcash/orchard: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/contents/?ref=main",
              "detail": "zcash/zips: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/contents/?ref=master",
              "detail": "zcash/lightwalletd: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/contents/?ref=dev",
              "detail": "zingolabs/zaino: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/contents/?ref=main",
              "detail": "zcash/zallet: scanning step in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/contents/?ref=main",
              "detail": "zodl-inc/zodl-android: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/contents/?ref=main",
              "detail": "zodl-inc/zodl-ios: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/contents/?ref=main",
              "detail": "zodl-inc/zodl-android-wallet-sdk: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/contents/?ref=master",
              "detail": "zcash/zcash (archived): dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "zcash/orchard",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "zcash/zips",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "zcash/zallet",
                "ok": true,
                "detail": "deployment configuration: Dockerfile"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": false,
                "detail": "no deployment configuration"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/contents/?ref=main",
              "detail": "ZcashFoundation/zebra: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/contents/?ref=main",
              "detail": "zcash/librustzcash: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/contents/?ref=main",
              "detail": "zcash/orchard: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/contents/?ref=main",
              "detail": "zcash/zips: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/contents/?ref=master",
              "detail": "zcash/lightwalletd: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/contents/?ref=dev",
              "detail": "zingolabs/zaino: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/contents/?ref=main",
              "detail": "zcash/zallet: deployment configuration: Dockerfile",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/contents/?ref=main",
              "detail": "zodl-inc/zodl-android: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/contents/?ref=main",
              "detail": "zodl-inc/zodl-ios: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/contents/?ref=main",
              "detail": "zodl-inc/zodl-android-wallet-sdk: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/contents/?ref=master",
              "detail": "zcash/zcash (archived): no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": true,
                "detail": "rules: pull_request, required_status_checks, merge_queue, deletion, non_fast_forward"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks"
              },
              {
                "repo": "zcash/orchard",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks"
              },
              {
                "repo": "zcash/zips",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, deletion, pull_request, required_status_checks"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, non_fast_forward"
              },
              {
                "repo": "zcash/zallet",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, pull_request"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": true,
                "detail": "rules: pull_request, required_status_checks, deletion, pull_request, non_fast_forward"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/rules/branches/main",
              "detail": "ZcashFoundation/zebra: rules: pull_request, required_status_checks, merge_queue, deletion, non_fast_forward",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/rules/branches/main",
              "detail": "zcash/librustzcash: rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/rules/branches/main",
              "detail": "zcash/orchard: rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/rules/branches/main",
              "detail": "zcash/zips: rules: deletion, non_fast_forward, pull_request, deletion, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/rules/branches/master",
              "detail": "zcash/lightwalletd: rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/rules/branches/dev",
              "detail": "zingolabs/zaino: rules: deletion, non_fast_forward, pull_request, non_fast_forward",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/rules/branches/main",
              "detail": "zcash/zallet: rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/rules/branches/main",
              "detail": "zodl-inc/zodl-android: rules: deletion, non_fast_forward, pull_request, pull_request",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/rules/branches/main",
              "detail": "zodl-inc/zodl-ios: rules: pull_request, required_status_checks, deletion, pull_request, non_fast_forward",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/rules/branches/main",
              "detail": "zodl-inc/zodl-android-wallet-sdk: rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/rules/branches/master",
              "detail": "zcash/zcash (archived): rules: deletion, non_fast_forward, pull_request, pull_request, required_status_checks",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": true,
                "detail": "29 workflow file(s)"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": true,
                "detail": "6 workflow file(s)"
              },
              {
                "repo": "zcash/orchard",
                "ok": true,
                "detail": "6 workflow file(s)"
              },
              {
                "repo": "zcash/zips",
                "ok": true,
                "detail": "4 workflow file(s)"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": true,
                "detail": "1 workflow file(s)"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": true,
                "detail": "13 workflow file(s)"
              },
              {
                "repo": "zcash/zallet",
                "ok": true,
                "detail": "12 workflow file(s)"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": true,
                "detail": "9 workflow file(s)"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": true,
                "detail": "4 workflow file(s)"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": true,
                "detail": "6 workflow file(s)"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": true,
                "detail": "8 workflow file(s)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/contents/?ref=main",
              "detail": "ZcashFoundation/zebra: 29 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/contents/?ref=main",
              "detail": "zcash/librustzcash: 6 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/contents/?ref=main",
              "detail": "zcash/orchard: 6 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/contents/?ref=main",
              "detail": "zcash/zips: 4 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/contents/?ref=master",
              "detail": "zcash/lightwalletd: 1 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/contents/?ref=dev",
              "detail": "zingolabs/zaino: 13 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/contents/?ref=main",
              "detail": "zcash/zallet: 12 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/contents/?ref=main",
              "detail": "zodl-inc/zodl-android: 9 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/contents/?ref=main",
              "detail": "zodl-inc/zodl-ios: 4 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/contents/?ref=main",
              "detail": "zodl-inc/zodl-android-wallet-sdk: 6 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/contents/?ref=master",
              "detail": "zcash/zcash (archived): 8 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zcash/orchard",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zcash/zips",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zcash/zallet",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": false,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": true,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/contents/?ref=main",
              "detail": "ZcashFoundation/zebra: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/contents/?ref=main",
              "detail": "zcash/librustzcash: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/contents/?ref=main",
              "detail": "zcash/orchard: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/contents/?ref=main",
              "detail": "zcash/zips: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/contents/?ref=master",
              "detail": "zcash/lightwalletd: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/contents/?ref=dev",
              "detail": "zingolabs/zaino: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/contents/?ref=main",
              "detail": "zcash/zallet: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/contents/?ref=main",
              "detail": "zodl-inc/zodl-android: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/contents/?ref=main",
              "detail": "zodl-inc/zodl-ios: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/contents/?ref=main",
              "detail": "zodl-inc/zodl-android-wallet-sdk: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/contents/?ref=master",
              "detail": "zcash/zcash (archived): test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zcash/orchard",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zcash/zips",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zcash/zallet",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": true,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/contents/?ref=main",
              "detail": "ZcashFoundation/zebra: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/contents/?ref=main",
              "detail": "zcash/librustzcash: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/contents/?ref=main",
              "detail": "zcash/orchard: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/contents/?ref=main",
              "detail": "zcash/zips: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/contents/?ref=master",
              "detail": "zcash/lightwalletd: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/contents/?ref=dev",
              "detail": "zingolabs/zaino: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/contents/?ref=main",
              "detail": "zcash/zallet: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/contents/?ref=main",
              "detail": "zodl-inc/zodl-android: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/contents/?ref=main",
              "detail": "zodl-inc/zodl-ios: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/contents/?ref=main",
              "detail": "zodl-inc/zodl-android-wallet-sdk: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/contents/?ref=master",
              "detail": "zcash/zcash (archived): coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": false,
                "detail": "latest tags: zebra-utils-v10.0.3, zebra-utils-v10.0.2, zebra-utils-v10.0.1"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": false,
                "detail": "latest tags: zip321-0.10.0-pre.2, zip321-0.10.0-pre.1, zip321-0.10.0-pre.0"
              },
              {
                "repo": "zcash/orchard",
                "ok": true,
                "detail": "latest tags: v0.11.0, v0.1.0-beta.3, v0.1.0-beta.2"
              },
              {
                "repo": "zcash/zips",
                "ok": true,
                "detail": "latest tags: vtest, v2026.7.0, v2026.6.4"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": true,
                "detail": "latest tags: v0.5.5, v0.5.4, v0.5.3"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": true,
                "detail": "latest tags: zainod-0.10.2, zainod-0.10.1, v0.4.0_nu_6_2_alpha"
              },
              {
                "repo": "zcash/zallet",
                "ok": true,
                "detail": "latest tags: v0.1.0-beta.3, v0.1.0-beta.2, v0.1.0-beta.1"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": true,
                "detail": "latest tags: shielded-vote-2.4.10-testflight.5, shielded-vote-2.4.10-testflight.4, shielded-vote-2.4.10-testflight.3"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": true,
                "detail": "latest tags: test-0.0.1-42, release-baseline-2026-08-08, beta4-rc2"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": true,
                "detail": "latest tags: v5.2.1, v5.2.0, v5.1.0"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": true,
                "detail": "latest tags: zc.v0.11.2.z0, v6.20.0, v6.12.5"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/tags",
              "detail": "ZcashFoundation/zebra: latest tags: zebra-utils-v10.0.3, zebra-utils-v10.0.2, zebra-utils-v10.0.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/tags",
              "detail": "zcash/librustzcash: latest tags: zip321-0.10.0-pre.2, zip321-0.10.0-pre.1, zip321-0.10.0-pre.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/tags",
              "detail": "zcash/orchard: latest tags: v0.11.0, v0.1.0-beta.3, v0.1.0-beta.2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/tags",
              "detail": "zcash/zips: latest tags: vtest, v2026.7.0, v2026.6.4",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/tags",
              "detail": "zcash/lightwalletd: latest tags: v0.5.5, v0.5.4, v0.5.3",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/tags",
              "detail": "zingolabs/zaino: latest tags: zainod-0.10.2, zainod-0.10.1, v0.4.0_nu_6_2_alpha",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/tags",
              "detail": "zcash/zallet: latest tags: v0.1.0-beta.3, v0.1.0-beta.2, v0.1.0-beta.1",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/tags",
              "detail": "zodl-inc/zodl-android: latest tags: shielded-vote-2.4.10-testflight.5, shielded-vote-2.4.10-testflight.4, shielded-vote-2.4.10-testflight.3",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/tags",
              "detail": "zodl-inc/zodl-ios: latest tags: test-0.0.1-42, release-baseline-2026-08-08, beta4-rc2",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/tags",
              "detail": "zodl-inc/zodl-android-wallet-sdk: latest tags: v5.2.1, v5.2.0, v5.1.0",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/tags",
              "detail": "zcash/zcash (archived): latest tags: zc.v0.11.2.z0, v6.20.0, v6.12.5",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": false,
                "detail": "3 of 10 recent commits signed"
              },
              {
                "repo": "zcash/orchard",
                "ok": false,
                "detail": "4 of 10 recent commits signed"
              },
              {
                "repo": "zcash/zips",
                "ok": false,
                "detail": "2 of 10 recent commits signed"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": true,
                "detail": "6 of 10 recent commits signed"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": true,
                "detail": "8 of 10 recent commits signed"
              },
              {
                "repo": "zcash/zallet",
                "ok": false,
                "detail": "4 of 10 recent commits signed"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": true,
                "detail": "6 of 10 recent commits signed"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": true,
                "detail": "5 of 10 recent commits signed"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": true,
                "detail": "9 of 10 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/commits?per_page=10",
              "detail": "ZcashFoundation/zebra: 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/commits?per_page=10",
              "detail": "zcash/librustzcash: 3 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/commits?per_page=10",
              "detail": "zcash/orchard: 4 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/commits?per_page=10",
              "detail": "zcash/zips: 2 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/commits?per_page=10",
              "detail": "zcash/lightwalletd: 6 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/commits?per_page=10",
              "detail": "zingolabs/zaino: 8 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/commits?per_page=10",
              "detail": "zcash/zallet: 4 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/commits?per_page=10",
              "detail": "zodl-inc/zodl-android: 6 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/commits?per_page=10",
              "detail": "zodl-inc/zodl-ios: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/commits?per_page=10",
              "detail": "zodl-inc/zodl-android-wallet-sdk: 5 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/commits?per_page=10",
              "detail": "zcash/zcash (archived): 9 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": true,
                "detail": "6 release(s) with notes"
              },
              {
                "repo": "zcash/orchard",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "zcash/zips",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "zcash/zallet",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": true,
                "detail": "CHANGELOG file"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": true,
                "detail": "10 release(s) with notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/contents/?ref=main",
              "detail": "ZcashFoundation/zebra: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/contents/?ref=main",
              "detail": "zcash/librustzcash: 6 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/contents/?ref=main",
              "detail": "zcash/orchard: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/contents/?ref=main",
              "detail": "zcash/zips: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/contents/?ref=master",
              "detail": "zcash/lightwalletd: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/contents/?ref=dev",
              "detail": "zingolabs/zaino: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/contents/?ref=main",
              "detail": "zcash/zallet: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/contents/?ref=main",
              "detail": "zodl-inc/zodl-android: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/contents/?ref=main",
              "detail": "zodl-inc/zodl-ios: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/contents/?ref=main",
              "detail": "zodl-inc/zodl-android-wallet-sdk: CHANGELOG file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/contents/?ref=master",
              "detail": "zcash/zcash (archived): 10 release(s) with notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "ZcashFoundation/zebra",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "zcash/librustzcash",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "zcash/orchard",
                "ok": true,
                "detail": "contribution section in README"
              },
              {
                "repo": "zcash/zips",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "zcash/lightwalletd",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "zingolabs/zaino",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "zcash/zallet",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "zodl-inc/zodl-android",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "zodl-inc/zodl-ios",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "zodl-inc/zodl-android-wallet-sdk",
                "ok": true,
                "detail": "CONTRIBUTING file"
              },
              {
                "repo": "zcash/zcash (archived)",
                "ok": true,
                "detail": "CONTRIBUTING file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/ZcashFoundation/zebra/contents/?ref=main",
              "detail": "ZcashFoundation/zebra: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/librustzcash/contents/?ref=main",
              "detail": "zcash/librustzcash: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/orchard/contents/?ref=main",
              "detail": "zcash/orchard: contribution section in README",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zips/contents/?ref=main",
              "detail": "zcash/zips: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/lightwalletd/contents/?ref=master",
              "detail": "zcash/lightwalletd: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zingolabs/zaino/contents/?ref=dev",
              "detail": "zingolabs/zaino: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zallet/contents/?ref=main",
              "detail": "zcash/zallet: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android/contents/?ref=main",
              "detail": "zodl-inc/zodl-android: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-ios/contents/?ref=main",
              "detail": "zodl-inc/zodl-ios: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zodl-inc/zodl-android-wallet-sdk/contents/?ref=main",
              "detail": "zodl-inc/zodl-android-wallet-sdk: CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zcash/zcash/contents/?ref=master",
              "detail": "zcash/zcash (archived): CONTRIBUTING file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Logical and integration architecture of the node (crate structure, services, dependencies) in the Zebra book; the protocol is specified in the Zcash Protocol Specification and ZIPs. No infrastructure view, as no operator-run infrastructure is required.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/book/src/dev/overview.md#L43-L147",
              "path": "book/src/dev/overview.md",
              "detail": "Zebra design overview, sections Service Dependencies (L43) and Architecture (L78), then per-crate responsibilities.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B11.2": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "evidenced",
          "value": "Protocol funding streams in consensus. From NU6.1 until height 4,406,400, 12% of each block subsidy goes to the deferred lockbox and 8% to the Major Grants stream administered by the Financial Privacy Fund. The Zcash Foundation also publishes quarterly financial reports.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291",
              "checked_at": "2026-10-09",
              "url": "https://github.com/ZcashFoundation/zebra/blob/e3eef2f37c35127ad1769f19a1ebc7eaa5d5d291/zebra-chain/src/parameters/network/subsidy/constants/mainnet.rs#L228-L242",
              "path": "zebra-chain/src/parameters/network/subsidy/constants/mainnet.rs",
              "detail": "Mainnet FundingStreams from NU6_1 to Height(4_406_400) with Deferred 12 and MajorGrants 8 (FPF address t3cFfPt1…Cow)."
            }
          ],
          "checked_at": "2026-10-09"
        },
        "B12.1": {
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          },
          "status": "absent",
          "evidence": [
            {
              "tier": "verified",
              "kind": "repo",
              "commit": "3af03aa3ad991874d86b8cf35919bc9b4671e8ba",
              "checked_at": "2026-10-09",
              "url": "https://github.com/zcash/zips/blob/3af03aa3ad991874d86b8cf35919bc9b4671e8ba/zips/zip-0317.rst#L126-L146",
              "path": "zips/zip-0317.rst",
              "detail": "Transaction acceptance depends only on consensus rules and the fee rule; the node, protocol libraries and Zallet contain no screening step (code searched in the seed research for country, geoblock and sanction terms). The AI-assisted audit in ZIP 257 concerns security review, not the payment path.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09"
        }
      }
    },
    "zerc20": {
      "slug": "zerc20",
      "facts": {
        "B2.1": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": false,
                "detail": "no security policy file"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "no security policy file"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/contents/?ref=main",
              "detail": "kbizikav/zERC20: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/contents/?ref=main",
              "detail": "zerc20io/.github: no security policy file",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B2.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": true,
                "detail": "dependabot config present"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "no scanning config or workflow step found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/contents/?ref=main",
              "detail": "kbizikav/zERC20: dependabot config present",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/contents/?ref=main",
              "detail": "zerc20io/.github: no scanning config or workflow step found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B8.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": true,
                "detail": "deployment configuration: docker-compose.yml"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "no deployment configuration"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/contents/?ref=main",
              "detail": "kbizikav/zERC20: deployment configuration: docker-compose.yml",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/contents/?ref=main",
              "detail": "zerc20io/.github: no deployment configuration",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.1": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": true,
                "detail": "rules: deletion, non_fast_forward, pull_request"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "no branch rules visible (classic branch protection is not readable without push access)"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/rules/branches/main",
              "detail": "kbizikav/zERC20: rules: deletion, non_fast_forward, pull_request",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/rules/branches/main",
              "detail": "zerc20io/.github: no branch rules visible (classic branch protection is not readable without push access)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.2": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": true,
                "detail": "3 workflow file(s)"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "no .github/workflows"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/contents/?ref=main",
              "detail": "kbizikav/zERC20: 3 workflow file(s)",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/contents/?ref=main",
              "detail": "zerc20io/.github: no .github/workflows",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.3": {
          "status": "evidenced",
          "value": {
            "summary": "some",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": true,
                "detail": "test command in a workflow"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "test command in a workflow"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/contents/?ref=main",
              "detail": "kbizikav/zERC20: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/contents/?ref=main",
              "detail": "zerc20io/.github: test command in a workflow",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.4": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": false,
                "detail": "coverage tooling referenced"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "coverage tooling referenced"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/contents/?ref=main",
              "detail": "kbizikav/zERC20: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/contents/?ref=main",
              "detail": "zerc20io/.github: coverage tooling referenced",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.5": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": false,
                "detail": "latest tags: zk-audit-target, contract-audit, audit-target"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "no tags"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/tags",
              "detail": "kbizikav/zERC20: latest tags: zk-audit-target, contract-audit, audit-target",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/tags",
              "detail": "zerc20io/.github: no tags",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.6": {
          "status": "evidenced",
          "value": {
            "summary": "all",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": true,
                "detail": "10 of 10 recent commits signed"
              },
              {
                "repo": "zerc20io/.github",
                "ok": true,
                "detail": "1 of 2 recent commits signed"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/commits?per_page=10",
              "detail": "kbizikav/zERC20: 10 of 10 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/commits?per_page=10",
              "detail": "zerc20io/.github: 1 of 2 recent commits signed",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.7": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": false,
                "detail": "no changelog or release notes"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "no changelog or release notes"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/contents/?ref=main",
              "detail": "kbizikav/zERC20: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/contents/?ref=main",
              "detail": "zerc20io/.github: no changelog or release notes",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B9.8": {
          "status": "absent",
          "value": {
            "summary": "none",
            "repos": [
              {
                "repo": "kbizikav/zERC20",
                "ok": false,
                "detail": "none found"
              },
              {
                "repo": "zerc20io/.github",
                "ok": false,
                "detail": "none found"
              }
            ]
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/kbizikav/zERC20/contents/?ref=main",
              "detail": "kbizikav/zERC20: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            },
            {
              "tier": "verified",
              "kind": "api",
              "url": "https://api.github.com/repos/zerc20io/.github/contents/?ref=main",
              "detail": "zerc20io/.github: none found",
              "checked_at": "2026-10-19",
              "recheck": "GITHUB_TOKEN=... node scripts/repo-facts.mjs <slug>"
            }
          ],
          "checked_at": "2026-10-19",
          "assessed_by": "repo-facts bot (scripts/repo-facts.mjs)",
          "review": {
            "status": "pending"
          }
        },
        "B1.1": {
          "status": "unknown",
          "note": "No ISO 27001 statement for Ryodan Systems AG in the terms, privacy policy or docs.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.3": {
          "status": "unknown",
          "note": "No SOC 2 or ISAE report or statement of availability found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.4": {
          "status": "unknown",
          "note": "The docs and website name no audit. A personal-account snapshot of the monorepo contains audit/zksecurity-audit.pdf, which was not read (CROPS S6 is unknown for the same reason).",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B1.5": {
          "status": "unknown",
          "note": "No penetration test of the indexer, prover, relay node or app found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B2.2": {
          "status": "unknown",
          "note": "No security policy, disclosure page or patch timelines found; the official repository is not public.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.1": {
          "status": "unknown",
          "note": "The terms and privacy policy contain no incident-notification commitment.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B3.4": {
          "status": "unknown",
          "note": "No status page or post-mortem found.",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B5.1": {
          "status": "evidenced",
          "value": "The indexer is a public, unauthenticated read API with IP-based rate limits; the ICP storage layer requires EVM signatures for key requests. No OAuth or JWT.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-developers/indexer-api",
              "detail": "Indexer API reference, scope and rate limits.",
              "checked_at": "2026-10-09",
              "quote": "The indexer is the public read API for zERC20 transfer history and Merkle proof data.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.3": {
          "status": "evidenced",
          "value": "No fixed periods; personal data kept as long as needed for its purpose or legal requirements, then deleted or anonymised. Covers the website and app only.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.io/privacy-policy",
              "detail": "Privacy policy section 5, data retention.",
              "checked_at": "2026-10-09",
              "quote": "When personal data is no longer required, we delete or anonymize it.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "P2",
              "index": 0
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B6.4": {
          "status": "evidenced",
          "value": "Ryodan Systems AG is the controller for website and app data under the Swiss FADP and GDPR; service providers are listed by type. No DPIA mentioned.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.io/privacy-policy",
              "detail": "Privacy policy introduction.",
              "checked_at": "2026-10-09",
              "quote": "The Operator is the controller for the data processing described below.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B10.1": {
          "status": "evidenced",
          "value": "Logical and integration views on the docs site (architecture overview of contracts, off-chain services and ICP storage; contract, ZKP and ICP specs; SDK and indexer API). No infrastructure view of the hosted prover, indexer or relay node. Not versioned in a public provider repository.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.gitbook.io/zerc20/for-developers/architecture",
              "detail": "Architecture overview page.",
              "checked_at": "2026-10-09",
              "quote": "This document explains how zERC20 is architected across on-chain contracts, off-chain services, and the Internet Computer (ICP) stealth messaging layer.",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "F3",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.1": {
          "status": "evidenced",
          "value": "Ryodan Systems AG (CHE-291.471.162), Zug, per the privacy policy; the terms name only an \"Operator\", under Swiss law with Swiss Arbitration Centre arbitration seated in Zurich.",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.io/terms-and-conditions",
              "detail": "Terms, governing law and dispute resolution.",
              "checked_at": "2026-10-09",
              "quote": "These Terms are governed by Swiss law.",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.io/privacy-policy",
              "detail": "Privacy policy, operator.",
              "checked_at": "2026-10-09",
              "quote": "Ryodan Systems AG, Gartenstrasse 6, 6300 Zug, Switzerland",
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.2": {
          "status": "evidenced",
          "value": "Onchain redeem fee (35 bps on zBNB) accrues to the Verifier and can be minted to the fee recipient, the 3-of-4 owner Safe; liquidity fees on zUSDC and zETH fund wrap rewards. No other funding source is published.",
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0xb05977Af4aA54117910ed72141F674531894774A",
              "address": "0xb05977Af4aA54117910ed72141F674531894774A",
              "block_number": 126643625,
              "detail": "redeemFeeBps() is 35 and feeRecipient() is the Safe 0xb6d8…DafCa.",
              "checked_at": "2026-10-09",
              "check": {
                "call": "0x09f6442c",
                "expect": "0x0000000000000000000000000000000000000000000000000000000000000023"
              },
              "confirmed_at": "2026-10-19"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B11.3": {
          "status": "evidenced",
          "value": "The Operator may suspend or end access to the app and APIs for violations, suspected illegality or security reasons, with an appeal by email; the terms say onchain access cannot be terminated, but the owner-managed Blocklist can freeze an address in the token (C1).",
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.io/terms-and-conditions",
              "detail": "Terms, termination and suspension.",
              "checked_at": "2026-10-09",
              "quote": "Access to the decentralized Protocol (i.e., on-chain smart contracts) cannot be terminated by the Operator",
              "confirmed_at": "2026-10-19"
            }
          ],
          "refs": [
            {
              "criterion": "C1",
              "index": 1
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.1": {
          "status": "evidenced",
          "value": "Compliance in the payment path is an owner-maintained address Blocklist (said to follow OFAC) checked on every token transfer, and the app pre-checks recipients against it. No automated scoring, vendor screening or AI is described.",
          "refs": [
            {
              "criterion": "C4",
              "index": 0
            },
            {
              "criterion": "C1",
              "index": 4
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "B12.2": {
          "status": "not_applicable",
          "reason": "The only screening is a manually maintained address list; no AI component is described (B12.1).",
          "burden": "none",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "fees": {
        "status": "evidenced",
        "value": [
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "Redeem fee 35 bps of the newly redeemable amount, rounded up (contract maximum 100 bps)",
            "basis": "redeemFeeBps on the zBNB Verifier, set per Verifier by its owner Safe; accrues in redeemFeeBalance and is minted to feeRecipient (the Verifier owner Safe 0xb6d8…DafCa) on withdrawal.",
            "evidence_index": 0
          },
          {
            "kind": "provider",
            "paid_by": "payee",
            "amount": "Relay fee on gasless redeems, quoted by the zERC20 relay node and deducted after the redeem fee",
            "basis": "Optional; a recipient with BNB for gas can redeem directly. Quotes are dynamic and not published.",
            "evidence_index": 1
          },
          {
            "kind": "provider",
            "paid_by": "none",
            "amount": "No wrap or unwrap fee for zBNB (dynamic liquidity fees apply to zUSDC and zETH only)",
            "basis": "Docs fee table; wrap and unwrap of zBNB happen only on BNB Chain, so no cross-chain balancing fee.",
            "evidence_index": 1
          },
          {
            "kind": "network",
            "paid_by": "both",
            "amount": "BNB Chain gas for the transfer to the burn address and for a direct redeem; LayerZero fees cross-chain",
            "basis": "Not set by the protocol. No gas sample recorded (BSC public RPCs refuse historical log queries).",
            "evidence_index": 1
          }
        ],
        "evidence": [
          {
            "tier": "verified",
            "kind": "onchain",
            "url": "https://sourcify.dev/server/v2/contract/56/0xb05977Af4aA54117910ed72141F674531894774A",
            "address": "0xb05977Af4aA54117910ed72141F674531894774A",
            "block_number": 126643625,
            "detail": "redeemFeeBps() returns 35 and feeRecipient() returns 0xb6d8B261948B097069eF926475cbB6dd698DafCa at block 126643625. The implementation source (exact match on Base, same code on BNB Chain) caps the fee at MAX_REDEEM_FEE_BPS = 100 and rounds up.",
            "checked_at": "2026-10-09",
            "recheck": "cast call 0xb05977Af4aA54117910ed72141F674531894774A \"redeemFeeBps()(uint256)\" --rpc-url https://bsc-rpc.publicnode.com",
            "check": {
              "call": "0x09f6442c",
              "expect": "0x0000000000000000000000000000000000000000000000000000000000000023"
            },
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://zerc20.gitbook.io/zerc20/for-users/fees-and-rewards",
            "detail": "Fees and Rewards page, current fee settings and private transfer redeem fee.",
            "checked_at": "2026-10-09",
            "quote": "so the owner cannot set a redeem fee above 1%",
            "confirmed_at": "2026-10-19"
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "custody_model": {
        "status": "evidenced",
        "value": "self_custody",
        "refs": [
          {
            "criterion": "S1",
            "index": 0
          },
          {
            "criterion": "S1",
            "index": 1
          }
        ],
        "note": "Agrees with S1 (score 1). In flight, value sits as zBNB at a keyless burn address until the recipient redeems; no provider wallet holds it, and wrapped BNB sits in the LiquidityManager. The disclosed risk is that 3-of-4 Safes can upgrade the token, Verifier and LiquidityManager with no timelock, swap the Verifier or minter, and block addresses.",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "licences": {
        "status": "absent",
        "evidence": [
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://zerc20.io/terms-and-conditions",
            "detail": "Terms (last updated 5 February 2026) say the Operator is not a financial institution, money services business or VASP and cite no licence.",
            "checked_at": "2026-10-09",
            "quote": "The Operator does not act as a financial institution, money services business, virtual asset service provider, or intermediary of any kind.",
            "confirmed_at": "2026-10-19"
          },
          {
            "tier": "documented",
            "kind": "document",
            "url": "https://www.zefix.ch/ZefixREST/api/v1/firm/1494951.json",
            "detail": "Zefix entry for Ryodan Systems AG (Zug), a software development company; Zefix does not record financial-market authorisations.",
            "checked_at": "2026-10-09",
            "quote": "CHE-291.471.162",
            "confirmed_at": "2026-10-19"
          }
        ],
        "note": "Searched: terms, privacy policy, docs (llms-full.txt) and Zefix. Not searched: FINMA's register of authorised institutions and SRO member lists (interactive searches).",
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "cashout": {
        "status": "not_applicable",
        "reason": "The recipient redeems zBNB to its own address and may unwrap it to BNB on BNB Chain; converting to local currency is outside the protocol.",
        "burden": "institution",
        "refs": [
          {
            "criterion": "C5",
            "index": 0
          }
        ],
        "checked_at": "2026-10-09",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        }
      },
      "maturity": {
        "first_deployment": {
          "status": "evidenced",
          "value": {
            "date": "2026-02-04",
            "block": 79259750,
            "what": "zBNB token proxy 0x4388…5c54 on BNB Chain, created through factory 0x29c8…281d in tx 0xc1880e18…7909 sent by 0xc692…49ac, with first implementation 0xda2f…acb8."
          },
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0x4388D5618B9e13Bd580209CDf37a202778C75c54",
              "address": "0x4388D5618B9e13Bd580209CDf37a202778C75c54",
              "block_number": 79259750,
              "detail": "The app's token config gives deployed_block_number 79259750 for zBNB on BNB Chain; eth_getBlockReceipts for that block (bsc-dataseed) shows tx 0xc1880e18a029867dfee46087c5a199644d23a65487d457a3edb24979147f7909 emitting the proxy's first Upgraded (implementation 0xda2fd3a6979d5304bc36aab4d1f17b8b82bcacb8), OwnershipTransferred (to 0xc69251d8…49ac) and Initialized logs. Block dated 2026-02-04 13:40:30 UTC. Sourcify has no creation data for the proxy.",
              "checked_at": "2026-10-09",
              "recheck": "cast receipt 0xc1880e18a029867dfee46087c5a199644d23a65487d457a3edb24979147f7909 --rpc-url https://bsc-dataseed.bnbchain.org"
            }
          ],
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "entity": {
          "status": "evidenced",
          "value": {
            "legal_name": "Ryodan Systems AG",
            "jurisdiction": "CH-ZG",
            "register_url": "https://www.zefix.ch/en/search/entity/list/firm/1494951",
            "registration_number": "CHE-291.471.162"
          },
          "evidence": [
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.io/privacy-policy",
              "detail": "The privacy policy (18 February 2026) names the operator of the website and app.",
              "checked_at": "2026-10-09",
              "quote": "Ryodan Systems AG, Gartenstrasse 6, 6300 Zug, Switzerland",
              "confirmed_at": "2026-10-19"
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://www.zefix.ch/ZefixREST/api/v1/firm/1494951.json",
              "detail": "Zefix record, Aktiengesellschaft in Zug, status existing, same address; purpose software development including decentralised finance applications.",
              "checked_at": "2026-10-09",
              "quote": "CHE-291.471.162",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "The terms define an unnamed \"Operator\" of the app, website and docs; only the privacy policy names Ryodan Systems AG. Who holds the owner Safes is not stated.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "incidents": {
          "status": "unknown",
          "note": "Searched: docs (llms-full.txt, FAQ, support), terms and website. The official repository is not public, so there is no advisory channel to check; EmergencyTriggered and ActivateEmergency logs on the Verifier could not be scanned (no archive BSC RPC). paused() is false today.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        },
        "changes": {
          "status": "evidenced",
          "value": [
            {
              "date": "2026-02-04",
              "summary": "zBNB token proxy deployed with implementation 0xda2f…acb8, owned by the EOA 0xc692…49ac.",
              "url": "https://bscscan.com/tx/0xc1880e18a029867dfee46087c5a199644d23a65487d457a3edb24979147f7909"
            },
            {
              "date": "2026-02-05",
              "summary": "Terms of Use last updated (privacy policy dated 2026-02-18).",
              "url": "https://zerc20.io/terms-and-conditions"
            },
            {
              "date": "2026-04-14",
              "summary": "Shared Blocklist 0x847b…4Df9 deployed (block 92449195).",
              "url": "https://sourcify.dev/server/v2/contract/56/0x847b6E2dBB28A3a163C6e0fcA9B0222b9C1E4Df9?fields=deployment"
            },
            {
              "date": "2026-04-15",
              "summary": "zERC20 implementation 0x857a…c748 deployed (block 92624068); the token proxy now points to it, so the token was upgraded on or after this date (upgrade transaction not located).",
              "url": "https://sourcify.dev/server/v2/contract/56/0x857afA597B87513df9B2317A60677A617a6Ac748?fields=deployment"
            }
          ],
          "evidence": [
            {
              "tier": "verified",
              "kind": "onchain",
              "url": "https://sourcify.dev/server/v2/contract/56/0x857afA597B87513df9B2317A60677A617a6Ac748?fields=deployment",
              "address": "0x857afA597B87513df9B2317A60677A617a6Ac748",
              "block_number": 92624068,
              "detail": "Sourcify creation data gives block 92624068 (2026-04-15 05:41:04 UTC) for the implementation and 92449195 (2026-04-14 07:48:05 UTC) for the Blocklist, both from 0x5eF8…17d3; the initial implementation in the proxy's deploy receipt was 0xda2f…acb8.",
              "checked_at": "2026-10-09",
              "recheck": "curl -s \"https://sourcify.dev/server/v2/contract/56/0x857afA597B87513df9B2317A60677A617a6Ac748?fields=deployment\""
            },
            {
              "tier": "documented",
              "kind": "document",
              "url": "https://zerc20.io/terms-and-conditions",
              "detail": "Terms version date.",
              "checked_at": "2026-10-09",
              "quote": "Last Updated: February 05, 2026",
              "confirmed_at": "2026-10-19"
            }
          ],
          "note": "Upgrade, owner-transfer, blocklist and fee-change logs could not be listed because public BSC RPCs serve no archive logs; the docs mention a migration of older Verifiers to the redeem-fee version without a date.",
          "checked_at": "2026-10-09",
          "assessed_by": "AI research agent (operational), 2026-10-09",
          "review": {
            "status": "pending"
          }
        }
      },
      "volume": {
        "status": "unknown",
        "spec": {
          "chain_id": 56,
          "addresses": [
            "0xb05977Af4aA54117910ed72141F674531894774A"
          ],
          "topic0": "0x1f4ac1471301500d629e712f8c24211eca2b5702a5a53730db4d0f19671abff3",
          "event": "RedeemFeeAccrued(address indexed recipient, address indexed feeRecipient, uint256 grossAmount, uint256 feeAmount)",
          "amount_word": 0,
          "token": "0x4388D5618B9e13Bd580209CDf37a202778C75c54",
          "decimals": 18,
          "symbol": "zBNB",
          "window_days": 30,
          "exclusions": "Redeems (payouts to recipients) on the zBNB Verifier on BNB Chain, gross of redeem and relay fees. Counted only while redeemFeeBps is above 0, since the event is skipped when the fee is zero. Redeems on other chains' Verifiers and plain public zBNB transfers are excluded."
        },
        "note": "Teleport and TeleportWithRelayerFee carry the same amounts but split across two topics; RedeemFeeAccrued is emitted on both paths. Not computed; BSC log ranges need an archive RPC (RPC_56).",
        "assessed_by": "AI research agent (operational), 2026-10-09",
        "review": {
          "status": "pending"
        },
        "reason": "not computed on 2026-10-19: no blocks-per-day estimate for chain 56"
      },
      "notes": "The allowlisted root prover and the hosted indexer are required and closed, so operator controls apply; custody is self-custody, so custodial controls are left unset. Terms name an unnamed Operator; the privacy policy names Ryodan Systems AG. Bot facts (B2.1, B2.3, B8.2, B9.x) untouched."
    }
  }
}