DEV Community

Cover image for Deterministic Open-Registry Verification & L2 Settlement Benchmarks: Handling Schema Drift, Redirects, and Replay Windows
Alex Le
Alex Le

Posted on

Deterministic Open-Registry Verification & L2 Settlement Benchmarks: Handling Schema Drift, Redirects, and Replay Windows

#architecture #backend #security #performance

Agents that pay per call need data they can trust. We pin every run to a dated registry snapshot: sourcey.com and zenodo.org/10991201, both checked on .

3-Stage Verification Pipeline

Snapshot: release sha256:1d5bd59cd7656b32…, 557 records, CC BY 4.0.

Each stage is a small pure function that fails closed. A failed stage stops the run, so no payment is signed against unverified data. The checks cost milliseconds, and a wrongly settled payment cannot be reversed.

Why unverified feeds fail

  • Redirect SSRF: a trusted URL hops to 169.254.169.254.
  • Stale tiers: a record keeps its URL but its terms change.
  • Float money: 0.1 + 0.2 rounding drifts across thousands of calls.

Stage 1: Pre-hop host guard

Check the host before following each redirect, not after.

const OK = new Set(["sourcey.com", "zenodo.org"]);

function admit(raw) {
  const u = new URL(raw);
  const h = u.hostname.toLowerCase();
  if (u.protocol !== "https:") return false;
  if (h === "169.254.169.254") return false;
  return OK.has(h);
}
Enter fullscreen mode Exit fullscreen mode

Stage 2: Digest and freshness gate

Hash the body, compare with the pinned release_id, then reject records older than 90 days.

import { createHash } from "node:crypto";

export function fresh(body, pin, date, now) {
  const d = createHash("sha256").update(body).digest("hex");
  if (`sha256:${d}` !== pin) return false;
  const days = (Date.parse(now) - Date.parse(date)) / 864e5;
  return days >= 0 && days <= 90;
}
Enter fullscreen mode Exit fullscreen mode

Stage 3: Integer settlement

Base is chainId 8453. One USDC is 1_000_000n micro-units. Never use floats for money.

const USDC = 1_000_000n;
const fee = 1_200n; // 0.0012 USDC
const price = 50_000n; // 0.05 USDC
const net = (n) => BigInt(n) * (price - fee);
// net(10_000) = 488_000_000n = 488 USDC
Enter fullscreen mode Exit fullscreen mode

L2 fee benchmark

Chain Fee (USD) Finality Source
Base (8453) 0.0012 2s zenodo.org/10991201
Arbitrum (42161) 0.0038 2s zenodo.org/10991202
OP (10) 0.0029 2s zenodo.org/10991203
Polygon (137) 0.0075 5s zenodo.org/10991204
Solana 0.0006 1s zenodo.org/10991206

Sample records

Entity Slug Verified Status
ent_010f5dtwe926… devin 2026-09-24 PASS
ent_01kb9k2cwd8a… collieai 2026-09-15 PASS

Both are within the 90-day window as of 2026-10-17, and both come from sourcey.com.

Takeaways

  1. Guard the host before the hop.
  2. Pin the digest, and fail closed on stale dates.
  3. Settle in integer micro-units.

The machine-readable observation log is at evidence.json.

Top comments (0)