Evidence row 3767265

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening"
    ]
  ],
  "name": "Bot Bazaar",
  "owner_address": "0x847f54ae8ddfd71ed7bc930c1f7a73576fab03a9",
  "raw": {
    "accepts": [
      {
        "amount": "50000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x847f54ae8dDFD71ed7bC930C1f7a73576FAb03A9",
        "scheme": "exact"
      }
    ],
    "description": "Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "issuer": "https://auth.example.com"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "composite_posture_score": 92,
              "composite_risk_score": 8,
              "disclaimer": "Automated composite analytical & schema audit only — not legal advice, not financial or investment advice, not tax advice, and not a formal third-party security certification.",
              "executive_grade": "A",
              "generated_at": 1793110000,
              "prioritized_remediation_checklist": [
                "Require PKCE S256 on all OAuth 2.1 public/native flows and reject JWT alg=none.",
                "Use prefixed CRC32-checksummed API keys stored as SHA-256 hashes in the database.",
                "Return HTTP 429 with Retry-After headers on per-bot and per-IP write rate limits."
              ],
              "sub_check_count": 6,
              "sub_checks": {
                "api_key_format": {
                  "crc32_hex": "a2e54612",
                  "formatted_token_example": "bzr_live_9f86d081884c7d659a2feaa0c55ad015_a2e54612",
                  "prefix": "bzr_live",
                  "secret_scanner_friendly": true,
                  "valid": true
                },
                "jwt_claims": {
                  "alg": "EdDSA",
                  "checks": {
                    "issuer_present": true,
                    "short_lived_ttl": true,
                    "strong_algorithm": true,
                    "subject_present": true
                  },
                  "ttl_seconds": 120,
                  "valid": true
                },
                "oauth2_pkce": {
                  "code_challenge_method": "S256",
                  "pkce_s256_enforced": true,
                  "s256_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
                  "valid": true,
                  "verifier_length_valid": true
                },
                "oidc_discovery": {
                  "checks": {
                    "asymmetric_signing_algs": true,
                    "https_issuer": true,
                    "https_jwks_uri": true
                  },
                  "compliant": true,
                  "issuer": "https://auth.example.com",
                  "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
                  "valid": true
                },
                "owasp_api_top10": {
                  "checks": {
                    "API1_bola_mitigated": true,
                    "API3_bopla_allowlisted": true,
                    "API4_rate_limited": true,
                    "API7_ssrf_guarded": true
                  },
                  "compliant": true,
                  "score": 100,
                  "valid": true
                },
                "rate_limit_policy": {
                  "checks": {
                    "includes_retry_after_429_header": true,
                    "read_rpm_reasonable": true,
                    "write_rpm_stricter_than_read": true
                  },
                  "requests_per_min": 60,
                  "valid": true,
                  "writes_per_min": 20
                }
              },
              "suite": "api-and-auth-hardening",
              "title": "API Authentication, JWT/OAuth2 & Rate-Limit Hardening Suite",
              "tool": "suite/api-and-auth-hardening",
              "valid": true
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET",
                    "HEAD",
                    "DELETE"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "issuer": {
                      "description": "OIDC/JWT issuer URL",
                      "type": "string"
                    }
                  },
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-11-06T04:30:56.897Z",
    "quality": {
      "l30DaysTotalCalls": 2,
      "l30DaysUniquePayers": 2,
      "lastCalledAt": "2026-11-06T04:30:56.681Z"
    },
    "resource": "https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening",
    "serviceName": "Bot Bazaar",
    "tags": [
      "x402",
      "reputation",
      "sellers",
      "base",
      "usdc"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10."
}

What the leaf hashes

{"body":"8519a061b5bfb22778a86c7f12a6da0b145337498ca4b9b9c71dac5a01398941","id":3767265,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793996779059473,"prev":752358,"subject":"x402_bazaar:https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-11-06 (303443 rows).

1. 0xf34bcfac92d6be57ac8264bd7a07326df1664064570c8fae6a052b67a41440e0
2. 0x69981a1f198d5d44c025eda292146d106ac9b7f944420d86c41f3a01b5d67ab5
3. 0x0065bbf3702cbc65a581817deb00c69bb9536f84b5f91d3267960ac8799dcdcf
4. 0x0ee3f1a2ca9c26e1ee41bf417af0111f8c7ed32f14ce579c92ae75b73f40f024
5. 0x1838a9df6f6a9af2c69e930b25f173df7d573c6312bf5072a9bc971a404b6994
6. 0xd034abdd388c7f2b6b869df5bf63f1164e53e81f404f8475faed8764d1eae751
7. 0x38e3e460e184e8641af03891ea9d76ea50296eb87bc80e356077cf26aa77d4ff
8. 0xed3e926b969a328cda8eb04cf47bd2488fabdf2f1a13dee794b21cc1d228d721
9. 0x5187d36ef525aa8e4705c093132346796b8d2a2cf397a6425c31193844f9d091
10. 0xd725bf408f59ef63ae6bab3223c418f5301d8dc641bbb4f008ebe2c7c1b1acc4
11. 0x0f69f9dc906d9183284914665f87f53718fa39c4819dd4e1474323bbfe8a0103
12. 0xdc823d204c470b887be4426dead2781d9dbd279e667a368729444e6e7b789bb6
13. 0xa5dc4fb3a7ae09f3d06c57adbff25da103da7a1961739da10aa705af4b5cc1ed
14. 0xadb9e5d5e78a6ef642bc8b18b9f3dd14d6e5d20536651d3ce85fec62d35a6aba
15. 0x0bc8160b8c94aae791142fc9caa83c153cc73b339512089ee494d4e8e7094abe
16. 0x04c1c4929933bae20304ac32084d4b93dcac07567f68e828ac93bbc39eb4614c
17. 0x0ab273486ad4e41bf08c741b20b2ee12e0fc87eaa429a5467c58fd3be34409b9

Day root

0xb30ccefe7182c6f767e1fcbfb5f64ffd649da831f665f65c5ff39cd40512284f

Chained

0xc383f7ef68d2914082484765aa09e42c12c59a74a096ae64127c562618c506d3

Published

On Arc Testnet, block 71111178: 0xfba13cb7ee4ada7f2fee3702a786a2201596be2ffea37dfc281ab4c8e9942fe1