Don't trust 00trust. Check it.
Every claim in a report points to a specific commit, compiler version and contract hash. Anyone can check an audit without trusting this website.
Four checks. No trust required.
- 01
Open the public audit page.
Every published audit has its own page at 00trust.io/a/<report-id>.
- 02
Hash the JSON report.
Download the JSON report and compute its hash. It must match the report hash on the page and in the on-chain registry.
- 03
Compare the verifier keys.
Read the verifier keys of the deployed contract on Midnight and compare their hashes with the audited hashes listed in the report.
- 04
Rebuild it yourself.
If the repository is public, check out the audited commit, compile it with the listed compiler version and compare the hashes yourself.
$ 00trust verify <report-id>→ fetching report.json report hash 9f3a…c41e registry 9f3a…c41ematch→ reading verifier keys on Midnight withdraw b71d…02afmatch deposit 04ce…9a13match set_owner e8a0…771bmatch✓ audit current · commit 4c1e9a2
A verification guide and a small command line tool will be published, so this can be done without 00trust’s website.
One verifier key per circuit.
On Midnight, each circuit of a deployed contract is represented on-chain by a verifier key. 00trust compiles the audited code and records the hash of each verifier key, with the commit and the compiler version. Anyone can compare them with the deployed contract.
When an audit becomes outdated
A contract’s maintenance authority can insert, remove or replace verifier keys after deployment, without changing the contract address. If a linked deployment no longer matches the audited hashes, its public page shows the audit as outdated.
New version, new audit
A new version of a contract means new verifier keys, so new hashes, so a new audit. Older audits stay visible with their own hashes.
Responsibility
Making sure the deployed contract matches the audited hashes is the owner’s responsibility, and anyone can check it.
Hashes only. Anchored on Midnight.
A small registry contract on Midnight stores hashes only: no code, no findings, no project secrets. Only 00trust’s signing key can write to it, and the registry’s own maintenance authority is published.
What it stores, per report
- Report ID
- Report hash
- Hashes of the audited verifier keys
- Audit date
- Status: current or revoked
What anyone can prove
- A report existed at a given date.
- The report was not changed after publication.
- The report covers a specific set of verifier keys.
Current, outdated or revoked.
Owners can add a badge to their README or website. It links to the public page and always shows the current status.
The deployed verifier keys match the audited hashes.
The deployed verifier keys no longer match the audited hashes.
The audit was withdrawn by 00trust, with a public reason.
[](https://00trust.io/a/<report-id>)Everything but the source code.
Each published audit has its own page at 00trust.io/a/<report-id>, and each project a page listing all its audits in order. A private audit is still anchored by its report hash, so its date can be proven when it is published later.
Published
- Project name, logo and links
- GitHub repository link if public, or name only if private
- Commit audited and compiler version
- Contract hashes and verifier key hashes per circuit
- Scores, findings and their status
- Audit date and agent versions
- On-chain anchor transaction
- Status: current, outdated or revoked
Never published
The source code.