Evidence row 752358

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening"
    ]
  ],
  "name": "Bot Bazaar",
  "owner_address": "0x847f54ae8ddfd71ed7bc930c1f7a73576fab03a9",
  "raw": {
    "accepts": [
      {
        "amount": "50000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x847f54ae8dDFD71ed7bC930C1f7a73576FAb03A9",
        "scheme": "exact"
      }
    ],
    "description": "Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "issuer": "https://auth.example.com"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "composite_posture_score": 92,
              "composite_risk_score": 8,
              "disclaimer": "Automated composite analytical & schema audit only — not legal advice, not financial or investment advice, not tax advice, and not a formal third-party security certification.",
              "executive_grade": "A",
              "generated_at": 1793110000,
              "prioritized_remediation_checklist": [
                "Require PKCE S256 on all OAuth 2.1 public/native flows and reject JWT alg=none.",
                "Use prefixed CRC32-checksummed API keys stored as SHA-256 hashes in the database.",
                "Return HTTP 429 with Retry-After headers on per-bot and per-IP write rate limits."
              ],
              "sub_check_count": 6,
              "sub_checks": {
                "api_key_format": {
                  "crc32_hex": "a2e54612",
                  "formatted_token_example": "bzr_live_9f86d081884c7d659a2feaa0c55ad015_a2e54612",
                  "prefix": "bzr_live",
                  "secret_scanner_friendly": true,
                  "valid": true
                },
                "jwt_claims": {
                  "alg": "EdDSA",
                  "checks": {
                    "issuer_present": true,
                    "short_lived_ttl": true,
                    "strong_algorithm": true,
                    "subject_present": true
                  },
                  "ttl_seconds": 120,
                  "valid": true
                },
                "oauth2_pkce": {
                  "code_challenge_method": "S256",
                  "pkce_s256_enforced": true,
                  "s256_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
                  "valid": true,
                  "verifier_length_valid": true
                },
                "oidc_discovery": {
                  "checks": {
                    "asymmetric_signing_algs": true,
                    "https_issuer": true,
                    "https_jwks_uri": true
                  },
                  "compliant": true,
                  "issuer": "https://auth.example.com",
                  "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
                  "valid": true
                },
                "owasp_api_top10": {
                  "checks": {
                    "API1_bola_mitigated": true,
                    "API3_bopla_allowlisted": true,
                    "API4_rate_limited": true,
                    "API7_ssrf_guarded": true
                  },
                  "compliant": true,
                  "score": 100,
                  "valid": true
                },
                "rate_limit_policy": {
                  "checks": {
                    "includes_retry_after_429_header": true,
                    "read_rpm_reasonable": true,
                    "write_rpm_stricter_than_read": true
                  },
                  "requests_per_min": 60,
                  "valid": true,
                  "writes_per_min": 20
                }
              },
              "suite": "api-and-auth-hardening",
              "title": "API Authentication, JWT/OAuth2 & Rate-Limit Hardening Suite",
              "tool": "suite/api-and-auth-hardening",
              "valid": true
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET",
                    "HEAD",
                    "DELETE"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "issuer": {
                      "description": "OIDC/JWT issuer URL",
                      "type": "string"
                    }
                  },
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-28T01:46:49.116Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-28T01:46:48.935Z"
    },
    "resource": "https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening",
    "serviceName": "Bot Bazaar",
    "tags": [
      "x402",
      "reputation",
      "sellers",
      "base",
      "usdc"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Composite 6-check API authentication audit chaining OAuth2 PKCE S256, OIDC discovery, JWT claims, API key checksum format, rate limits, and OWASP API Top 10."
}

What the leaf hashes

{"body":"b1bbf518f3bea00bba1cb6f3c9e10f51ce3d273c78aa32f567abb7ed6e278608","id":752358,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793178822365091,"prev":null,"subject":"x402_bazaar:https://bot-bazaar.fly.dev/v1/x402/suite/api-and-auth-hardening","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-28 (231336 rows).

1. 0xc4241fa6f2bd688c362cfbced2503a98dfd0b5fed80d77b6b3236792026397cf
2. 0xfb02c80d8eda8fb5810a40a7a5bcf342f85da444400fb5694cab06f4e415e22a
3. 0x350c874532b47bb6be12f91c8107c89735338b43a37c456f9b061c4a38fa6d01
4. 0x4bad5fc5ba8e7dd362f1254b0eaf96a78af0eb34c73f6e13f47896cb58ffb320
5. 0xd9e8a8e146165ec61aff06c956f264729d0ae565eb0f6d86474ba513b62ac044
6. 0x2bc88ade86da91b57d699a333022288da0ebd1443a9631e791050aaf5393f099
7. 0xdbec43ff8c41697bfd46c223fdd7a1f93fbbf1c21c7b7f53d1f3f4b056901f63
8. 0x54fd71894226c02b37b573e8c079622c9934fdf61e823817f857d7e9dde328b5
9. 0x05bc07cd87561c1a63a82f43abe14eebf5beb4d7823fb213cc5bf0e825d8090b
10. 0xc6cb79a5c05a856fef192bedbba592ab731854083178912da70b19318efc5ce9
11. 0x56e37eafecdb369c29a1c5b35d2e69043cd7a97b2a9598916af08649363be817
12. 0x5f08863a25cf1a39d719398abd6becab3a6cfe1a8f41536f1b66264c9b797268
13. 0xc5e194226ea62d0d597c9eb0fabf3d09ccea2d41c32be367d96394755e91de3a
14. 0x4dedfee32d37ea3cdc60e339d676b411d314f945b00a30f8e3bd1e0470526cf9
15. 0xc21e7661f5d6220994a88cc71b1262eeee3b912a2d383d18f38a631c534bfd71
16. 0x32beeeb960280bc48748681cb10297ede9403461fe9c8143fdf946548e552926
17. 0xe08e8bd91858a8a10c46ecde9c29a6288b960987303173c5e882afb46ce91fa0
18. 0xe6cfe00ae4e02bc12327e45b5f3334ea5850ba3bcc8e3101d30a8189856a95af

Day root

0x2c19037464cc4c493624565f01775d6446fc78eaa118fc6865bfe2bfca9ff78e

Chained

0xd1d7dee8322ceff8f4c8d83aa1fe4a4466825c2af1c97dbde3d35db61234f7be

Published

On Arc Testnet, block 69584042: 0x8bae2b1d097834c8b458513862d70d29ee807e98dc2e863b27250131c15b35ae