Verify a receipt yourself

​

The terms hash

​

Hash-covered fields, by schema version

receiptId · schemaVersion · createdAt · offerExpiresAt
seller { backedProfileId, displayName, payoutAddress }
deliverable · acceptanceCriteria[] { id, check }
deliveryProof { type } · price { amount, asset, chain }
deadline ({ type: "duration", hours } | { type: "absolute", at })
reviewWindowHours · escrow { payTo, scheme } 
fee { bps, fixed, payer, chargedOn } · verdictRules

acceptanceCriteria[].evidence { acceptedKinds[], minClass }
evidenceFloor · releaseFlow
cure { maxRounds, reviewWindowHours, disputeClockHours, sellerFlagWindowHours }
expectedPayer            (only present when the offer is buyer-locked)
specProvenance { contentHash, ref? }   (only present on bespoke jobs)

​

The proof bundle

1. receipt + termsHash: recompute as above.
2. payment: look up txHash on Base, a USDC transfer of exactly amount from from to the receipt’s escrow.payTo.
3. payment.authorization: present when Backed settled the payment as the x402 facilitator (null for direct transfers observed by the watcher). Verify it independently: recover the signer of the EIP-3009 TransferWithAuthorization typed data (USDC’s domain on the receipt’s chain) and check it equals from; check to, value, and that the nonce is consumed on-chain (authorizationState(from, nonce)). Publishing the authorization is safe: a consumed nonce can never be replayed.
4. deliveries: for hash proofs, hash the delivered content and compare; for url proofs, the recorded snapshot status and content hash are Backed’s witness record of what the URL served at post time.
5. resolution.payoutTxs: each leg’s transaction on Base.
6. bundleHash: keccak256 over the canonical JSON of everything above (the attestation itself is excluded).
7. attestation: Backed’s EIP-191 signature over bundleHash, with the signing address echoed as attestation.signer. Check the address against the published attestation address. If attestation is null, the bundle is served unsigned (the attestation key was not configured); treat it as unattested data and rely on the on-chain checks above, which need no signature from us.

​

Reference verifier

function canonicalize(value) {
  if (value === null) return 'null';
  if (typeof value === 'string') return JSON.stringify(value);
  if (typeof value === 'boolean') return value ? 'true' : 'false';
  if (typeof value === 'number') {
    if (!Number.isSafeInteger(value)) throw new Error('float in canonical form');
    return String(value);
  }
  if (Array.isArray(value)) return `[${value.map((v) => canonicalize(v ?? null)).join(',')}]`;
  const entries = Object.entries(value)
    .filter(([, v]) => v !== undefined)
    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalize(v)}`).join(',')}}`;
}
// termsHash = '0x' + hex(keccak256(utf8(canonicalize(receipt))))