From 5b1c9079dd157450d4f0036a6e54a929a089d054 Mon Sep 17 00:00:00 2001 From: Aere Network Date: Mon, 17 Aug 2026 10:42:54 +0300 Subject: [PATCH] The free scan now carries the confidence label, not just the colour Measured 2026-08-16: a 42-byte contract that merely STORES the constant 0x0AE1 and never calls anything still scores GREEN, with the reference marked medium confidence. So the headline colour does not separate a resolved call from a bare constant, and a client who tests that in five minutes would find it before we admitted it. The scan text now says, per address, whether a CALL to each verifier resolved from the bytecode or whether only the address is present, and says plainly that a present address can also be plain data. The colour stays what the scanner computes; the sentence next to it carries what it means. --- raport.js | 3 +++ scan-gratuit.mjs | 20 ++++++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/raport.js b/raport.js index 4b7fc6d..3f11e07 100644 --- a/raport.js +++ b/raport.js @@ -93,6 +93,9 @@ not-measured lines say why. ${comanda} +The toolkit is public and installs nothing: +https://git.aere.network/aere-network/pqc-migration-toolkit + Point \`--rpc\` at a node you run yourself. Nothing here depends on trusting the party that wrote this report, and that is the point: an exposure report you cannot re-run is an opinion with a logo on it. diff --git a/scan-gratuit.mjs b/scan-gratuit.mjs index 2a0794d..dbb2735 100644 --- a/scan-gratuit.mjs +++ b/scan-gratuit.mjs @@ -39,7 +39,15 @@ else { // migrarea, sa primeasca "nu am putut masura adresa". const stare = citesteVerdict(text); const cod = (text.match(/code:\s*(\d+)\s*bytes/) || [])[1] || null; - const verif = [...text.matchAll(/^\s*-\s*(0x[0-9a-f]+)\s+(.+?)\s*(\[[a-z]+\])?$/gim)].map((m) => m[2].trim()); + // Eticheta de incredere e informatia care conteaza, mai mult decat culoarea verdictului: o + // referinta "call-proximate" inseamna ca apelul s-a rezolvat din bytecode, una "medium" inseamna + // ca doar constanta e prezenta si putea ajunge acolo si ca simpla data. Masurat 2026-08-16: un + // contract de 42 de octeti care doar STOCHEAZA constanta iese tot GREEN. Deci culoarea singura nu + // separa cele doua cazuri, si textul catre client trebuie sa poarte eticheta. + const refer = [...text.matchAll(/^\s*-\s*(0x[0-9a-f]+)\s+(.+?)\s*\[([a-z]+)(, call-proximate)?\]\s*$/gim)] + .map((m) => ({ nume: m[2].trim(), incredere: m[3], apel: !!m[4] })); + const verif = refer.map((r) => r.nume); + const cuApel = refer.filter((r) => r.apel).length; const deschise = [...text.matchAll(/^\s*\*\s*(\[(?:VERIFY|MEASURE)\][^\n]*)/gim)].map((m) => m[1].trim()); // The one sentence that has to be true and has to be useful. @@ -52,12 +60,11 @@ else { // it says so in its own [VERIFY] note. Claiming "can reach" in the sales hook when the tool // itself refused to settle it would be selling a maybe as a yes, in the first sentence a // prospect reads. So the wording follows the measurement, and the caveat travels with it. - const nesigur = deschise.some((d) => /no CALL to it was resolved|may be staged/i.test(d)); verdict = 'The bytecode of this contract references ' + verif.length + ' live post-quantum verifier' + (verif.length === 1 ? '' : 's') + ' (' + verif.slice(0, 3).join(', ') + (verif.length > 3 ? ', and more' : '') + '). ' - + (nesigur - ? 'We could NOT confirm from bytecode alone that it calls them: the addresses are pushed, but the call target may be assembled at runtime. So this is a promising sign, not a proven capability, and settling it needs the source or a call trace.' - : 'The calls to them resolved from the bytecode, so the verification half of a migration is already reachable in this contract.'); + + (cuApel > 0 + ? 'For ' + cuApel + ' of them the CALL resolved from the bytecode, so the verification half of a migration is genuinely reachable in this contract.' + : 'For NONE of them could we resolve a CALL from the bytecode: the addresses are present, but a present address can also be plain data. So this is a lead, not a proven capability, and settling it needs the source or a call trace. We are telling you this because the headline verdict alone does not separate the two cases.'); } else verdict = 'This contract reaches no post-quantum verifier. Everything it authorises today rests on ECDSA secp256k1, which is exactly the primitive the published migration timelines are about. That is the normal situation in 2026, not a criticism.'; @@ -79,7 +86,8 @@ else { linii.push(''); } linii.push('CHECK US, DO NOT TRUST US'); - linii.push(' git clone the toolkit and run the same thing against a node you operate:'); + linii.push(' git clone https://git.aere.network/aere-network/pqc-migration-toolkit'); + linii.push(' then run the same measurement against a node you operate:'); linii.push(' node scan.js ' + ADRESA + ' --rpc https://your-own-node'); linii.push(' If your number differs from ours, that difference is the interesting part and we'); linii.push(' want to hear about it.');