Skip to content

Verification path · no wallet

Check it yourself. Trust nothing we say.

Seven steps, top to bottom. Steps 1 and 2 run a quick check in your browser. Steps 3 to 6 open each recorded call on /verify or name a verification script. Step 7 is optional. If you see something else, the claim fails.

Try it free — testnet

Reading the passive health check…

Where each check comes from: computed in your browserread from NEAR mainnetfetched from OutLayeragainst Intel's root / PCSdata we publish (repo) Only the last one is our word; everything else you can re-run without us.

  1. Step 1: The code running in the enclave is the code in the repo

    fetched from OutLayercomputed in your browseragainst Intel's root / PCSread from NEAR mainnet

    Intel signs a report naming the code that ran, and we compare its fingerprint with the current build, ed0f614a.

    Run all 37 checks on /verify
    What you should see
    The quick check shows Pass. On /verify, all checks are green: the worker downloaded from FastFS hashes to ed0f614a…, the quote's report data matches, and Intel's certificate chain verifies. Badge: Current build. Published with add_versionalt ↗.
    Proof 3 items
    current build
    ed0f614acd83c8dc4851901206f5e5f065a3a6e7731cf8cc8d6a3e2bfd66a1b8
    published in
    GXZtL6hgscWUAh7SpZLA5SBLyrVe4w9bCxz2Kmb4q1K5Explorer ↗Alt ↗
    attested call
    ed2c7a62-411f-4f8f-b06d-b214898e0ec4Open
    Prefer a terminal? Verification script: verify.sh

    Rebuilds the worker from source with Rust and prints the same hash. Read the script ↗

  2. Step 2: The NFT contract is the one in the repo

    read from NEAR mainnetcomputed in your browser

    NEAR's public RPC reports the code hash of keyhole-devmo.near, and we compare it with the wasm committed in the repo.

    What you should see
    The quick check shows Pass. The contract's only minter is an account whose key was generated inside the enclave.
    Proof 3 items
    expected code hash
    3cZsaySYgqZntFaRKEUffQUMGqRjkQ2DuSmFWXwiKGZH
    contract
    keyhole-devmo.nearExplorer ↗Alt ↗
    repo file
    contracts/keys/deployed/keyhole_keys.wasmExplorer ↗
    Prefer a terminal? Verification script: 1-contract.sh

    Same comparison from a terminal, using curl and sha256sum. Read the script ↗

  3. Step 3: Checks on build a55ebb14: only the real holder gets in

    fetched from OutLayerdata we publish (repo)

    These five calls ran on the previous build, a55ebb14. Each answer, refusals included, was produced inside the enclave and signed by Intel.

    What you should see
    Each Verify this call opens /verify with the verdict Genuine enclave, previous build (not the current one). That is expected for these calls, because they ran on build a55ebb14.

  4. Step 4: Selling the key moves the account; the old holder is locked out

    read from NEAR mainnetfetched from OutLayerdata we publish (repo)

    The key moved from account A to account B on build a985fd87 (not the current build ed0f614a). A and B are team test wallets, not independent users. Before the move A reads its balance. After it, A is refused and B reads the same balance. A replayed request and an early withdrawal by B are refused too.

    What you should see
    Each call below is labelled build a985fd87, previous. Its attestation names that wasm, not the current ed0f614a. Click Verify this call to check one. The sale is one NEAR transaction, and its receipt shows SuccessValue.
    Transfer 1 item
    sale: nft_transfer, A → B (build a985fd87)
    89vSYY4tbeNPuNuhHB8YmkkAWAcjW5VdniQm3ePHuPYzExplorer ↗Alt ↗

    The site gateway also refuses a session-scheme withdraw with HTTP 403 session_scope, before any enclave call. It has no call id.

    Recorded on earlier builds (10 calls)
    Earlier transfers 2 items
    key transfer A → B (earlier build)
    G35r5pmCTffvKMShjPcwTkds1z8SuCHdJr32qGGzYktDExplorer ↗Alt ↗
    key back to A (earlier build)
    HGKe7Dzd3ERMLkWYcVvffV6opweQqN3wbfFevo44uDUnExplorer ↗Alt ↗

  5. Step 5: Tier caps hold on real trades

    fetched from OutLayerdata we publish (repo)

    A Bronze key may trade at most $1 at a time, and a 2 USDC swap was refused before anything moved.

    What you should see
    /verify shows the refusal with green checks. All 30 recorded mainnet steps are in the repo.
    Prefer a terminal? Verification script: 2-attestations.sh

    Checks each of the 30 recorded steps against its attestation. In the browser instead: open any call id from docs/evidence/mainnet-e2e on /verify. Read the script ↗

  6. Step 6: Each key can sign for other chains

    read from NEAR mainnetfetched from OutLayer

    With Chain Signatures, NEAR's MPC network signed for the EVM address derived from this key alone.

    What you should see
    The signature recovers to 0xe39C947d…f063. The MPC transaction below shows v1.signer.sign called by the minter, and the beat transaction was signed by the limited key: it may only call beat on the contract.
    Proof 2 items
    MPC sign
    7P9VFx4pz5oxyXpXkyDVE6SheDuTqHgQcEM2vgKFUAfKExplorer ↗Alt ↗
    beat (limited key)
    B1BH9eZycbXqgwod2dqbn6e5UWY8TKTw2ZawyYqLRDtGExplorer ↗Alt ↗

  7. Step 7: Optional: try it with your own wallet

    computed in your browserread from NEAR mainnet

    Steps 1 to 6 need no wallet. With a NEAR wallet or MetaMask you can mint a free key, one signature, and the enclave pays the storage.

    Mint a free keyOpen your vaultGet a 1Click price
    What you should see
    Your result shows a call id The receipt number of one enclave run. Paste it into /verify to check that run yourself. and a Verify link. It checks out on /verify just like step 1. In your vault, press Read balance.

    MetaMask may warn “Malicious site”. Its scanner flags every *.vercel.app address, including ones that were never deployed. Details are in research/METAMASK_FLAG.md.

Who sees what

PartySeesDoes not see
NEAR (anyone)Token id, holder, tier, transfer time, the minter's mint and beat transactionsBalances, trades, history, caps
KEYHOLE website gatewayThe signed request and the reply it relays to the holder's browser. Bodies are not loggedAnything without the holder's fresh signature
OutLayer TDX enclaveEverything for the call it runs, sealed by Intel TDX and attestedNothing is hidden from the code, which is why the code hash is checked
OutLayer custody walletThe key account's balances and the swaps it settlesWho holds the NFT
1Click solversThe asset pair and amount of a quoteThe key, its holder, its history
Next holder of the keyThe account, its balances, earlier history rows as hashesEarlier holders' trade details
Previous holderOnly what they did while holding it. After the transfer every request is refused (not_owner)The new holder's balances and trades

Who can change things: keyhole-devmo.near owns the contract (owner-only set_minter and set_royalty, royalty capped at 10%) and publishes worker versions with add_version. Every version is on chain, and an attestation always names the exact build that ran, so a new version cannot rewrite an old proof.

What this does not prove

  • The attestation proves which code ran on which input and output. It does not prove the code is bug-free. The source is open; the threat model is in THREAT_MODEL.md.
  • Trust rests on Intel TDX and the OutLayer operator's quote collateral, like any TEE system.
  • Amounts in the recorded runs are tiny on purpose (fractions of a cent to $0.02).