Check it
yourself.
Every stored scan has a signed receipt. Recompute it here, in this browser, and see exactly which step trusts what.
Run it
now.
Three
steps.
- The hash. The scan’s JSON with keys sorted at every level and no whitespace, hashed with SHA-256. If your copy hashes to the receipt’s
scan_hash, it is the scan that was signed, byte for byte. - The signature. An Ed25519 signature over
scan_hash, checked against the key atGET /v1/receipts/key. It proves Cyclops issued this receipt; it says nothing about whether the scan is right. - The attestation. When switched on, the same
scan_hashis attested on chain through the Ethereum Attestation Service, with the token as recipient. Read from the chain over public RPC, it shows when the scan was recorded, without asking our API.
On-chain attestations are built and switched off. EAS is not deployed on Robinhood Chain yet (checked 2026-10-29: no contract at any address in the EAS deployments list). Until it is, the signed receipt is the record, and every receipt can also be recomputed from the chain at its pinned block with npx tsx apps/api/scripts/verify-scan.ts --token 0x….
What is
attested.
bytes32 scanHash,address token,uint64 scannedAt,uint8 score,string label,uint16 scoreVersion
Recipient: the token. Revocable: yes, so a superseded scan can be marked as such; a revoked attestation is shown as revoked, never hidden. Find every attestation for a token with eth_getLogs on the EAS contract, topic 0 Attested(address,address,bytes32,bytes32), topic 1 the token, topic 3 the schema UID (GET /v1/eas).
A verified receipt means the record was not changed after the fact. It is not a rating and it does not make a token safe; read the editorial standards for what a scan does and does not claim.