← The evidence ledger
Evidence row 2201830
Observed , by sync.x402_bazaar/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://unicode-text-tools.x402tookit.com/bidi-check
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 2528d6e5cac74348fd4dd4e618032586b890b4906df69ff4bec609fbc92cdd78
- Leaf
- 0x01df872d11de56fe392936526b9fe07a649127b04101724b4f91e8e58d84c0b8
What was observed
{
"endpoints": [
[
"x402",
"https://unicode-text-tools.x402tookit.com/bidi-check"
]
],
"name": "Unicode Text Safety Tools",
"owner_address": "0xb531320805c5bed1d46aeadcf4f008fdf172dbda",
"raw": {
"accepts": [
{
"amount": "20000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:8453",
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact"
},
{
"amount": "20000",
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "D6ZhtNQ5nT9ZnTHUbqXZsTx5MH2rPFiBBggX4hY1WePM",
"transactionVersions": [
0
]
},
"maxTimeoutSeconds": 300,
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"payTo": "DUPiupXtuox38dcGoXUKer5mAydCzmaHjrbQ66qeEm8s",
"scheme": "exact"
},
{
"amount": "20000",
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:137",
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact"
},
{
"amount": "20000",
"asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:42161",
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact"
}
],
"description": "Detect Trojan Source bidi controls (CVE-2021-42574): overrides, isolates, unbalanced openers, stray closers, with positions.",
"extensions": {
"bazaar": {
"info": {
"input": {
"method": "GET",
"queryParams": {
"text": "if (access != \"user // check admin \") { run(); }"
},
"type": "http"
},
"output": {
"example": {
"asOf": "2026-10-21T01:34:51.193Z",
"controlCount": 4,
"controls": [
{
"codepoint": "U+202E",
"column": 20,
"index": 19,
"line": 1,
"name": "RIGHT-TO-LEFT OVERRIDE",
"utf16Index": 19
},
{
"codepoint": "U+2066",
"column": 22,
"index": 21,
"line": 1,
"name": "LEFT-TO-RIGHT ISOLATE",
"utf16Index": 21
}
],
"degraded": false,
"disclaimer": "Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.",
"notChecked": [
"whether the control sits inside a comment or string (that needs a language parser)",
"the visual order a given editor would display",
"…1 more"
],
"overrideCount": 1,
"problems": [
{
"codepoint": "U+202E",
"column": 20,
"index": 19,
"kind": "UNTERMINATED",
"line": 1,
"note": "U+202E RIGHT-TO-LEFT OVERRIDE is never closed before the end of the line, so it affects following text.",
"utf16Index": 19
},
{
"codepoint": "U+2066",
"column": 39,
"index": 38,
"kind": "UNTERMINATED",
"line": 1,
"note": "U+2066 LEFT-TO-RIGHT ISOLATE is never closed before the end of the line, so it affects following text.",
"utf16Index": 38
}
],
"reasons": [
"Bidi overrides and unclosed isolates reorder displayed characters (Trojan Source, CVE-2021-42574): a reviewer sees different code from the compiler."
],
"source": "computed locally",
"summary": "4 bidi control(s), 2 unbalanced or stray, 1 override(s): this can make displayed text differ from what a parser reads.",
"truncated": false,
"unbalancedCount": 2,
"verdict": "TROJAN_SOURCE_PATTERN"
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"properties": {
"text": {
"description": "Source code or text to scan, up to 20000 characters (longer is refused with 400)",
"type": "string"
}
},
"required": [
"text"
],
"type": "object"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"properties": {
"asOf": {
"type": [
"null",
"string"
]
},
"controlCount": {
"type": [
"null",
"number"
]
},
"controls": {
"items": {
"properties": {
"codepoint": {
"type": [
"null",
"string"
]
},
"column": {
"type": [
"null",
"number"
]
},
"index": {
"type": [
"null",
"number"
]
},
"line": {
"type": [
"null",
"number"
]
},
"name": {
"type": [
"null",
"string"
]
},
"utf16Index": {
"type": [
"null",
"number"
]
}
},
"type": "object"
},
"type": [
"array",
"null"
]
},
"degraded": {
"type": [
"boolean",
"null"
]
},
"disclaimer": {
"type": [
"null",
"string"
]
},
"notChecked": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"overrideCount": {
"type": [
"null",
"number"
]
},
"problems": {
"items": {
"properties": {
"codepoint": {
"type": [
"null",
"string"
]
},
"column": {
"type": [
"null",
"number"
]
},
"index": {
"type": [
"null",
"number"
]
},
"kind": {
"type": [
"null",
"string"
]
},
"line": {
"type": [
"null",
"number"
]
},
"note": {
"type": [
"null",
"string"
]
},
"utf16Index": {
"type": [
"null",
"number"
]
}
},
"type": "object"
},
"type": [
"array",
"null"
]
},
"reasons": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"source": {
"type": [
"null",
"string"
]
},
"summary": {
"type": [
"null",
"string"
]
},
"truncated": {
"type": [
"boolean",
"null"
]
},
"unbalancedCount": {
"type": [
"null",
"number"
]
},
"verdict": {
"type": [
"null",
"string"
]
}
},
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"lastUpdated": "2026-11-01T23:24:08.135Z",
"quality": {
"l30DaysTotalCalls": 1,
"l30DaysUniquePayers": 1,
"lastCalledAt": "2026-11-01T23:24:07.841Z"
},
"resource": "https://unicode-text-tools.x402tookit.com/bidi-check",
"serviceName": "Unicode Text Safety Tools",
"tags": [
"unicode",
"bidi",
"trojan-source",
"code-review",
"security"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Detect Trojan Source bidi controls (CVE-2021-42574): overrides, isolates, unbalanced openers, stray closers, with positions."
}What the leaf hashes
{"body":"2528d6e5cac74348fd4dd4e618032586b890b4906df69ff4bec609fbc92cdd78","id":2201830,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793646809059826,"prev":null,"subject":"x402_bazaar:https://unicode-text-tools.x402tookit.com/bidi-check","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (444186 rows).
- 0x01df87cd1a93149231365d9cde236bf2e2009ff246c2e410c77a3e2a9dae0a9f
- 0xbbf9c177596a0415b400c59c1f6bad82d45e7411110cc7612542c85047158f87
- 0xccf9f9a882a886c9f2af45665db673935b945ccb78da9d5921d957bd1bc56e64
- 0xf551e5bb6c91f2d06ab8a77337fb9d33f3d32c562af51635516aefd5b6f1f7d8
- 0x7cd11065bcbf681f856caee1e466101edabd38f00cef22aea4904f4d60a8807a
- 0xad2755fb3b49c04f2728ad75ae866995ff5f388cd43d5dfe9302db3ec8c8a943
- 0x0df6c0322d3aca8b3353f4a7ffe3838d5ccd946364cbde3c3c78372725305789
- 0x16c62a06504e6193e0c27ddc79967da97b1126911f74a58dd8eba401b60fb88d
- 0xea00068221b98e2febcef8ddb570aa1e2331a6b60f5129b8163e772f8d7df0a3
- 0x3204a7768f9126572bf43e9c5afa2210a09d4eb04d184eb71f448cc55e01b06e
- 0x06176a1984ad07b5bed809f9917145c50e37d26626abe1f82716ffa19eb6b66c
- 0x0154d753e5f594e54f1ab6d5100a317d12face9f45bc53b289185639f13d17d9
- 0x9ccfa562467b683727533a101c56f2ec1b15d392976c5a1d03db8b6563b90233
- 0x9acdcc385ecc9f1094faf2e01677d863638d23bede5aed4ca22def76698e0af3
- 0x150a4dbcf309a6bb857da0b59f7588bd57a20fca094e579bf41d6cc6df9c7bff
- 0x7cb861d18f06406535ade133f716d897f27d257cf0121f99d94c78c713c4b54d
- 0x53a741b69e9e51c4a288a74712aa6ac3fb28c8923cd3e6461d161c4f2d48b31a
- 0x050f2978b537f7afb21ee1551577cdf146d1c56f4df12d24315ae5e69366b0a4
- 0x365b161a4b68d750dcc4b3ecce1154a2163c87b08762079428e68f0ebb6a754e
- Day root
- 0x78fecaabbe319e56f5c4b80fc02e2052e198ad24781da8832a475ff65f2002d1
- Chained
- 0xdc35957db5d1371ca382b9152878ffece28ec7c5cb4f98fd71ddb367f8b999b2
- Published
- On Arc Testnet, block 70432815: 0x56b814612eb2e3e544153df3e91e1f7199106d1e430c7d8c6b653feeb9ebe9af