Evidence row 2634065

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://api.aiskills402.com/v1/skills/jwt-verification-review/file"
    ]
  ],
  "name": "JWT Verification Review",
  "owner_address": "0xbc0dcc70d8b5d85541d86ffc68d988fd59c22e68",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 60,
        "network": "eip155:8453",
        "payTo": "0xbc0dcc70d8b5d85541d86ffc68d988fd59c22e68",
        "scheme": "exact"
      }
    ],
    "description": "JWT Verification Review — Reviews ONE piece of code that verifies JSON Web Tokens for the five mistakes that let a forged or stale token in, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches an algorithm taken from the token header or no fixed algorithm list, an expiry check switched off, neither audience nor issuer checked, a payload read with decode where verify is needed, and a signing secret written into the so…",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "type": "http"
          },
          "output": {
            "example": {
              "file": {
                "content": "<the SKILL.md file>",
                "encoding": "utf-8",
                "name": "SKILL.md"
              },
              "name": "JWT Verification Review",
              "ok": true,
              "receipt": {
                "settled": true,
                "tx": "0x<settlement transaction>"
              },
              "redownload": {
                "token": "<64 hex chars>",
                "url": "<api>/v1/purchases/<token>"
              },
              "sha256": "<sha256 of SKILL.md>",
              "skill": "jwt-verification-review",
              "version": "1.0.0"
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "headers": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "type": "object"
                },
                "method": {
                  "enum": [
                    "GET",
                    "HEAD"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-11-03T03:05:12.538Z",
    "quality": {
      "l30DaysTotalCalls": 2,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-11-03T03:05:12.292Z"
    },
    "resource": "https://api.aiskills402.com/v1/skills/jwt-verification-review/file",
    "serviceName": "JWT Verification Review",
    "tags": [
      "agent-skill",
      "jwt-verification-review",
      "jwt",
      "authentication",
      "token-verification"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "JWT Verification Review — Reviews ONE piece of code that verifies JSON Web Tokens for the five mistakes that let a forged or stale token in, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches an algorithm taken from the token header or no fixed algorithm list, an expiry check switched off, neither audience nor issuer checked, a payload read with decode where verify is needed, and a signing secret written into the so…"
}

What the leaf hashes

{"body":"c8da22fcb87639134d0ac55cc705d6463d6dd805a4b2eb97da14cd3dde2c7f0d","id":2634065,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793734489043067,"prev":527910,"subject":"x402_bazaar:https://api.aiskills402.com/v1/skills/jwt-verification-review/file","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-11-03 (425475 rows).

1. 0xa67593f78851f6ef029db3ed26c17f154ee5cb44fd8d72ce4285149407ebcc3c
2. 0x41132d3d7e35f2fb62b4b3a3c6c06e02ce53984cb448c3a7a0fe477d4f25f25d
3. 0x603cc97ecc30bcf341de92dff1f827698ed19fbaac838080ba495264abc9b034
4. 0xbaa9a48ed1c698efcb4e53e12331656af76266eeb03c1a14ad5e5661cbc4bc09
5. 0xf32542ff187bfaf60f58120430b2ecd5604f27b109e71d09e55df780ea8a84ea
6. 0xab9320dc27cf0200485432c824aaaee62073ee055fe6379995a39599ebd56229
7. 0x88569f439b7da7654dc6b839ecedfc58e84d8fde1875e0fd28f4f46812a24027
8. 0x56bc902a83b5bdfc2e15aa6c913ef635e2a6d1b7cfe9c7d7f51333270836c148
9. 0x6a0517b0fe442cf50fe3d44fe370c5bd9746124c2a284b79c3d7055dcff3c42c
10. 0xf3e6d990025e4fdd9e99c3b388588bb9da68751b44a65e89b3e16b4f05fb2ca4
11. 0xa23df5e8348854cb7971c7213f251d4612500291a87825917d5562b3d9ea1810
12. 0x815a60e45e734228befa37c27152dd91545295d9f9b2b149d67f91c9810546c3
13. 0x53a3eed7cbfaf81d389119a28838f038ff9374739b7125ff237e74956b8919f7
14. 0xc11e64de1e3489c6f039a4438e19d61260cc35d128740205319e373cf66438a1
15. 0xc8c3351be4f517ca5732d6f5ee3d1d64170b8e4410d31b9c614949031fbc07a0
16. 0xdbc1c0882584cff2eba84dcd18af41b5fd070127c962a21b00db1ec3e352cc94
17. 0x39dab39081985bbfffe23b080399a9d1a9cb9c2c8960102350c4212113cb2cba
18. 0xac5402954216dc6c7020a6405675c8fc3b0828c2ab02943d80de52677a2f1fc3
19. 0x85f3a27c16056a361d9ba33355a575ca7123f86de901b204c88953c4b8ea441a

Day root

0xb646ffa569e24bf8336b0a15a9d98d0a2f1239f58e10c2b18a9d22e43343566a

Chained

0x35e926359fd19031c6b5e08fb3b44f2524386a57c8fdd353336c185603f53d43

Published

On Arc Testnet, block 70601990: 0xa5f9dadba13cde129126b950e64b815e6833cb8ff53b75026c9dbe769c3768c7