Every finding we publish carries a timestamp anyone can check.

What is anchored

Receipts publish their paths. Artifacts tied to a specific organization are anchored by hash with the path withheld, so priority is still provable to anyone we hand the file to, without publishing a list of who we have studied. Both kinds verify identically below.

And the same root is on Ethereum mainnet

Base carries the operational anchoring: every finding, every batch, for fractions of a cent. Ethereum L1 carries one periodic root over those batch roots. It is the strongest chain, written rarely, so a counterparty who trusts nothing else about us can still check the timeline in the place they already trust. Weekly, automatically, with a spend stop that simply skips a week rather than overpay when L1 gas is high.

batchLeaf = sha256(0x02 || batchRoot)
node      = sha256(0x01 || min(a,b) || max(a,b))
batches sorted by root; one batch means the combined root is that single batchLeaf

Verify it yourself, right here

Pick a file you were given. Your browser hashes it locally, finds its leaf in the ledger, walks the proof to the root, then reads the anchoring transaction straight from a public Base node and checks that the same root is really onchain. The file never leaves your machine.

Anchor your own, free

This registry is open. If you are about to disclose a security finding, send a draft, share a dataset, or publish anything whose order matters, anchor it first. It is free, there is no account, and you send only the hash, so we never receive your file and could not produce it if anyone asked.

Free is not a promotion. Thousands of hashes ride in one transaction, so one more costs us nothing worth charging for, and a shared record is worth more to us than a toll.

shasum -a 256 my-finding.md          # hash it locally, the file never moves

curl -s -X POST https://vealth.net/anchor/submit \
  -H 'Content-Type: application/json' \
  -d '{"sha256":"<64 hex>","label":"optional note"}'

curl -s "https://vealth.net/anchor/verify?sha256=<64 hex>"   # check any claim, free

Agents with MCP get the same two operations as native tools at https://vealth.net/mcp: anchor_proof and verify_anchor. No key, no wallet, no payment path. There is also a plain-language skill file at prove-you-found-it-first.

Submissions land in the next weekly batch and the Ethereum root of the same run. Keep your file: it is the only thing that can open your proof, because nobody else ever had it.

The algorithm, so you can check it without us

Standard SHA-256 throughout. Leaves are domain separated from internal nodes, so a proof path can never be replayed as a file. Pairs are sorted, so a proof is just sibling hashes with no left or right flags to get wrong.

fileHash = sha256(file bytes)
leaf     = sha256(0x00 || fileHash)
node     = sha256(0x01 || min(a,b) || max(a,b))
an odd node at any level is promoted unchanged to the next level

Or run our verifier from a clone, which recomputes all of it and reads the chain:

npx tsx scripts/provisioning/verify-anchor.ts \
  --file docs/backlog/generated/<artifact>.md \
  --ledger apps/web/public/vealth/proof-ledger.json

What this proves, and what it does not

It proves that these exact bytes existed no later than the block timestamp, and that the anchor was published by our operational wallet. That is priority and integrity: a finding cannot be quietly backdated, edited after the fact, or absorbed without a record of who held it first. It does not prove a finding is correct, and it is not a claim of ownership over anything we describe. Correctness is argued in the artifact itself, where every claim carries a transaction hash or a probe you can re-run. Timestamping alone is a commodity; the work being timestamped is the part that matters.

Anchoring costs us a fraction of a cent per batch, which is why every finding gets one rather than only the ones that look important at the time. Contact: [email protected].