Evidence row 527910

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://api.aiskills402.com/v1/skills/jwt-verification-review/file"
    ]
  ],
  "name": "JWT Verification Review",
  "owner_address": "0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 60,
        "network": "eip155:8453",
        "payTo": "0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4",
        "scheme": "exact"
      }
    ],
    "description": "JWT Verification Review — Reviews ONE piece of code that verifies JSON Web Tokens for the five mistakes that let a forged or stale token in, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches an algorithm taken from the token header or no fixed algorithm list, an expiry check switched off, neither audience nor issuer checked, a payload read with decode where verify is needed, and a signing secret written into the so…",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "type": "http"
          },
          "output": {
            "example": {
              "file": {
                "content": "<the SKILL.md file>",
                "encoding": "utf-8",
                "name": "SKILL.md"
              },
              "name": "JWT Verification Review",
              "ok": true,
              "receipt": {
                "settled": true,
                "tx": "0x<settlement transaction>"
              },
              "redownload": {
                "token": "<64 hex chars>",
                "url": "<api>/v1/purchases/<token>"
              },
              "sha256": "<sha256 of SKILL.md>",
              "skill": "jwt-verification-review",
              "version": "1.0.0"
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "headers": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "type": "object"
                },
                "method": {
                  "enum": [
                    "GET",
                    "HEAD"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-27T08:01:50.657Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-27T08:01:50.43Z"
    },
    "resource": "https://api.aiskills402.com/v1/skills/jwt-verification-review/file",
    "serviceName": "JWT Verification Review",
    "tags": [
      "agent-skill",
      "jwt-verification-review",
      "jwt",
      "authentication",
      "token-verification"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "JWT Verification Review — Reviews ONE piece of code that verifies JSON Web Tokens for the five mistakes that let a forged or stale token in, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches an algorithm taken from the token header or no fixed algorithm list, an expiry check switched off, neither audience nor issuer checked, a payload read with decode where verify is needed, and a signing secret written into the so…"
}

What the leaf hashes

{"body":"178ad4a955a1d9db448453d5c4304bdb683a23a85ac0570d39833e4f58579542","id":527910,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793124871827161,"prev":458232,"subject":"x402_bazaar:https://api.aiskills402.com/v1/skills/jwt-verification-review/file","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0xda51402dd690322837e4d468fb3f03e4689090f32235e593181db2d2ce06463a
2. 0x796e0fa562fafaaf5a98f252a5ce99212808ec81f8554471675ca8e2f5b2c33b
3. 0x4b5fc8c9c6fea575defeba3cd08725bcfc0b3e48915c46e60ad7ddaeaf3fb326
4. 0x076b2fd405ee67ebc7570d14653f59aa12291bd864a31531d292af648f3e824e
5. 0xc15eb63f7472f1d534a9a5d47f425fdd542a155d04d6ecea802e122a7660828f
6. 0x01478ada3641fd17c24d1be605b3d43a6e2631cf5da11fe110541483781918e0
7. 0xcbfe9aedaf293db7357cce85ef08ef5a40d674e29f1a1fec2e907f47b0b5db7d
8. 0x22f30e129d4464e2a76a46569f7be923bbdc9b03105bb2b0a4261961a62fef94
9. 0x8338ce345f26759ee98fe94c8c5b3c745cab32277f861a1cf9046964169b9f91
10. 0x785d263e308fb6ac32ea6e4d757be20921b77dfbf6c9702e0c1b5c1642fc9def
11. 0x51d2dfffae7b5a32ea0581772134c7771ab69d32e784a62f9ee589642395fc86
12. 0x29ce226640d83db3bc63fef23427a7af561200d30ffde9b1b7a61b814b844a39
13. 0x13692b463800846f580925c8ea49b43f92b7df3f9e8d32b8a18802640cca3780
14. 0xd59f3e577867f5105dd7f75598f16da8286185e426dfcdafb84e733fde2b2492
15. 0x24e3e2bb8ee1e8d20756de35f0e0c4ec8eb1f193bd2cf3f077ee1f92f211c34d
16. 0x8745bd887f5ce9f7a49558fd2b04cdcd97a05ea9f8a23f62d0e80cb13d328b0f
17. 0xdf1105afdc109de3c09a98fc8a3864159ad964e6f49b635c105a27a1e1f14310
18. 0x2bf8151e5f157dd183b9de6fa00469551932a7a6e3f33a694895000ac9061197
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4