Evidence row 121256

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://sicher.halowerk.com/v1/webhook-signature"
    ]
  ],
  "name": "sicher.halowerk.com/v1/webhook-signature",
  "owner_address": "0x2880edfff13100677bf97a3cbdf3bc34771c4e5e",
  "raw": {
    "accepts": [
      {
        "amount": "2000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "asset": "USDC",
          "assetTransferMethod": "eip3009",
          "eip712Domain": {
            "chainId": 8453,
            "name": "USD Coin",
            "verifyingContract": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
            "version": "2"
          },
          "name": "USD Coin",
          "network_name": "Base Mainnet",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x2880EdfFF13100677Bf97A3CBdF3Bc34771C4E5E",
        "scheme": "exact"
      }
    ],
    "description": "Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "body": "{\"synthetic\":true,\"event\":\"documentation-example\"}",
              "provider": "github",
              "secret": "HALOWERK-public-synthetic-example-never-use-for-authentication",
              "signature": "sha256=fdfaa7380ce9e369a7d90e8651603bb777a4f008dd3070b056d2b59122d602f8"
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "additionalProperties": false,
                  "properties": {
                    "body": {
                      "description": "The raw request body exactly as received, not re-serialised.",
                      "maxLength": 200000,
                      "type": "string"
                    },
                    "headers": {
                      "description": "All request headers; the right one is picked by provider.",
                      "type": "object"
                    },
                    "message_id": {
                      "description": "Message id for schemes that sign one, e.g. Svix.",
                      "maxLength": 200,
                      "type": "string"
                    },
                    "provider": {
                      "description": "Which provider signed the request.",
                      "enum": [
                        "github",
                        "stripe",
                        "shopify",
                        "slack",
                        "svix",
                        "generic_hmac"
                      ],
                      "type": "string"
                    },
                    "secret": {
                      "description": "The signing secret.",
                      "maxLength": 2000,
                      "minLength": 1,
                      "type": "string"
                    },
                    "signature": {
                      "description": "The signature header value. Required unless headers is given.",
                      "maxLength": 2000,
                      "type": "string"
                    },
                    "timestamp": {
                      "description": "Timestamp, if the provider signs one and it is not in the headers.",
                      "maxLength": 40,
                      "type": "string"
                    },
                    "tolerance_seconds": {
                      "default": 300,
                      "description": "How old a signed timestamp may be.",
                      "maximum": 86400,
                      "minimum": 1,
                      "type": "integer"
                    }
                  },
                  "required": [
                    "provider",
                    "body",
                    "secret"
                  ],
                  "type": "object"
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST",
                    "PUT",
                    "PATCH"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-08T05:40:41.664Z",
    "quality": {
      "l30DaysTotalCalls": 3,
      "l30DaysUniquePayers": 3,
      "lastCalledAt": "2026-10-08T05:40:41.242Z"
    },
    "resource": "https://sicher.halowerk.com/v1/webhook-signature",
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Providers each build their signing string differently — some sign only the body, others prepend a timestamp, an id, or a version marker in a fixed order — and getting that order wrong produces a mismatch that looks exactly like an attack. This checks the signature the way the named provider actually specifies, with constant-time comparison, and returns the string that was signed so a mismatch can be debugged instead of guessed at."
}

What the leaf hashes

{"body":"6a8438c4f30b81343e32ade7b73925b4250f3051ee6d3e9a28abb2b57f2ba5b1","id":121256,"kind":"listing","method":"baseline/1","observed_us":1793025619681111,"prev":null,"subject":"x402_bazaar:https://sicher.halowerk.com/v1/webhook-signature","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0x6135dddd36fb410d44c8662ae6ce8909379ffb0a66381e407027747fda89d9aa
2. 0xdeda1c8c3580799cf558ea3feab587b0787b04799a080e58af995f830af974e1
3. 0x2fb2f89331ff87136b893f1a60ff2d10cd4a214e54df63e80bfc7143c9d883f1
4. 0x78fa752d89b042e6af9900d879842caa44d6aeda07984db2cfd041c376ad0967
5. 0xaf26019e51a68109baa1161c39575f6ba38eb964467c2469ba42822c619ea812
6. 0xfb489120ab8dafe6bbb57bc3bd8f610cf9f0bc37879ab48217a760b74b35f247
7. 0xbf4e0e23143df37bb8964d4734287805e79a0a70c8bbda18a9180c565ce69317
8. 0xaefe332113201cb816d74994a30cf3a175f5786c155884fcdfb430d2b109cbe9
9. 0x23d47664fa94c7855ae00ca65c51f506eeae8b0db1df0269cdac5186318cdff3
10. 0xe260b2e40b95bbf4bea407155c3f0fd2821a2b48a48010e119c9c3a25f20adb5
11. 0x52877ea072e10a1d3a921f7b54362005ad7a9baf5c99f31ec73a534bfea8930d
12. 0xf4e3bedc99674db9d8ab4bc7655992ec76f822b327e6c89599b0baa3756fbd19
13. 0x89fcaf55e37dd777228f271b79ea895534a66ec0d184363c2a6eb1b4d23c9ef1
14. 0x216cebb9ae5414599109a02297c4817d7d1c6b1394afeb97efe38e32f0053974
15. 0x7726154b91b2ad65b13849ef6cb6443b1f0ff113a3089c9bd5f2bcfc16be099d
16. 0x47b89901b0f07938a6b9a66ddf35683903f79d756a7c7763665fd632758b08d0
17. 0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d
18. 0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae