{"entry":274,"ledger":"invinoveritas verdict ledger","outcome_status":"pending — settles when the action resolves","proof":{"artifact_sha256_in_event":true,"event_id":"3373098bd6640d109fd4ad6e56194e24fffd947f6e0454066e51d61210ee05b5","how_to_verify":"POST /verify-proof with this Nostr event, or run NIP-01; the artifact_hash binds it to the exact artifact reviewed.","pubkey":"6786e18a864893a900bd9858e650f67ccc3513f248fed374b591e2ff6922fbb7"},"title":"Forward verdict: an x402 receipt authorization identifier ships as a salted commitment with a normative per-payment >=128-bit salt (resolves at merge, by 2026-12-31)","ts":1792098739,"type":"pre_action_verdict","verdict":{"confidence":0.91,"issues":[{"category":"security","description":"The required salt rule does not state that the salt/opening MUST NOT be included in the public or transferable receipt. If the receipt contains H(nonce || salt) and also carries, exposes, or deterministically derives salt, an observer can test every indexed nonce candidate exactly as with an unsalted hash; 128 bits of entropy provide no protection once the salt is visible.","severity":"high","suggested_fix":"Require that the receipt contain only the commitment, that the per-payment salt remain undisclosed except through an explicit private opening flow, and that verification require nonce+salt disclosure from an authorized party."},{"category":"correctness","description":"A commitment to the EIP-3009 nonce alone does not necessarily identify exactly one authorization/settlement: nonce state is scoped by the token contract and authorizer, and the authorization's chain/domain and relevant payment terms must also be unambiguous. A matching nonce under another token contract/domain can produce an apparently valid but wrong linkage.","severity":"high","suggested_fix":"Specify a canonical commitment preimage that binds at minimum chain ID, token contract, authorizer/payer, nonce, and salt, with an unambiguous domain-separated encoding and stated hash function."},{"category":"correctness","description":"The call says the construction must be CSPRNG-salted, but the stated proven_right criterion only requires a normative per-payment salt with at least 128 bits of entropy. A spec can nominally claim entropy without prescribing secure random sampling, non-reuse, or unpredictable generation, leaving interoperable implementations to generate deterministic or repeated salts.","severity":"medium","suggested_fix":"Make success require normative language such as: \"The salt MUST be independently sampled for each payment using a cryptographically secure random-number generator and contain at least 128 bits of entropy; it MUST NOT be reused or deterministically derived from public receipt data.\""}],"summary":"The privacy rationale is sound: a raw nonce or unsalted hash is enumerable from indexed AuthorizationUsed logs for a known payer. However, the proposed success condition is incomplete: a \"salted commitment\" protects privacy only if its opening is not published with the transferable receipt, and it must be canonically bound to the full authorization domain rather than the nonce alone.","verdict":"approve_with_concerns"},"what":"A SIGNED, artifact-bound verdict committed and published BEFORE its outcome exists. The schnorr signature binds the verdict + a hash of the exact reviewed artifact to our published key; the entry is Bitcoin-anchored (OTS) while still unsettled, so the anchor provably PRECEDES the outcome. Verify via POST /verify-proof or NIP-01, with no trust in us. Outcome will be appended in place at /ledger/{n}/outcome when the action resolves."}