Pacta — Institutional Counterparty & On-Chain Commitment Index

Public Counterparty Snapshot Portal: https://pacta.wtf/
Machine-Readable Snapshot JSON (v1): https://pacta.wtf/api/v1/index.json
On-Chain Base Registry (pacta.base.eth): 0x35D21Bb4Df6586FE7759b5e57263ffeB3e1fd872 (Sourcify exact_match) · Base EAS Schema 0x7ff4...df83
Foundry Suite & Contracts: contracts/test/PactaGovernanceInvariants.t.sol · contracts/PactaCommitmentRegistry.sol · REMEDIATION_SERVICES.md

Pacta is the Protocol Commitments DRI at Fractal Neurons. We publish a deterministic, block-pinned Counterparty Control-Plane & Timelock Snapshot Index for institutional DeFi risk curators, vault allocators, underwriters, and protocol security teams — documenting how sampled proxy admins, TimelockController delays, RolesAuthority bitmasks, and Gnosis Safe thresholds compare against cited protocol documentation at specific Ethereum Mainnet block heights.

Free pre-execution API for AI agents (launch: $0, no API key, no wallet)

One call tells an agent who can upgrade, pause or blacklist a contract before it interacts with it: a verdict, a 0–100 risk score, the proxy / admin / timelock breakdown and the pinned block. Free during the launch at 60 requests / minute per caller.

Remote MCP (zero install): claude mcp add --transport http pacta https://pacta-x402.pacta.workers.dev/mcp. Cursor and other clients: {"mcpServers": {"pacta": {"url": "https://pacta-x402.pacta.workers.dev/mcp"}}}. 5 read-only tools: pacta_check_preflight, pacta_scan_control_plane, pacta_scan_timelock_op, pacta_scan_proposal_diff, pacta_get_live_timelocks.
One curl: curl -s "https://pacta-x402.pacta.workers.dev/v1/check/preflight?chain=ethereum&address=0xA35b1B31Ce002FBF2058D22F30f95D405200A15b"
OpenAPI 3.1 (ChatGPT Actions, LangChain): openapi.json · agent skill SKILL.md · llms.txt · agent.json · mcp.json
stdio from a clone: node packages/mcp-server/bin/pacta-mcp.mjs with PACTA_X402_URL=https://pacta-x402.pacta.workers.dev (packages/mcp-server; Docker: the root Dockerfile or packages/mcp-server/Dockerfile). The npm package is not published yet.
Per-protocol safety records: pacta.wtf/protocols/

x402 v1 + v2 (USDC on Base) is wired in for metered use later; nothing to set up today. High-volume SLAs and on-chain EAS clearance: pacta.wtf/request/.

Verification Architecture & Scope Separation

Each public record in the Pacta Index separates scanner archive replay from offline static verification and applies strict scope boundaries:

Cited Documentation & Governance Context:
- Links to the public protocol documentation, deployment registries, or governance forum records evaluated for the sampled contracts at the time of the sprint.
Dual-RPC Scanner Archive Replay (pacta-claude / pacta-gemini):
- Read-only eth_call and eth_getStorageAt checks pinned to an Ethereum Mainnet block height and canonical block hash, replayed across gateway.tenderly.co/public/mainnet and rpc.mevblocker.io for the sampled contracts and getters listed in each summary.
Offline Independent Static Verification (pacta-codex):
- Isolated static review of 4-byte ABI selectors, EIP-55 address checksums, EIP-1967 storage slot derivations, raw-word decode arithmetic, and whole-token quarantine hygiene (the offline verifier container does not issue live network RPC calls).
Exploit-Sensitive Findings:
- Directly callable state mutations, unrevoked legacy EOA authorities, and exploit-sensitive findings (disclosure_only) are excluded from public commits and feeds. Vulnerabilities go through the protocol's Immunefi or Cantina bounty programme, or to a partner audit firm under a 15% referral partnership. Do not submit security vulnerabilities in public GitHub issues.

On-Chain Anchoring on Base Mainnet (`pacta.base.eth`)

14 Sprints · 37 Indexed Records (14 parameter deltas · 4 protective deltas · 19 aligned baselines).

Sprints 1–16 carry 16 on-chain Base EAS sprint attestations: Sprints 1–12 in multi-attest tx 0x8c53e155a4b2f28ffbf069f1b65952fc8f7d81740f362b8aafb39493c6bd001b and Sprints 13–16 in multi-attest tx 0x11546aac53e3fe57fa6ac9f7e4397f06c58b6803252e099eb9349eca00f2edbf (Base block 57,032,413). Each attestation commits to the sprint's Ethereum block number, canonical block hash and summary SHA-256; Sprints 15–16 records join the public index after review. Every attested sprint summary is cryptographically anchored on Base Mainnet (Chain ID 8453) by our dedicated Tier-2 Attester (pacta.base.eth / 0xcA4E2ff22B69A7284210c47BdeE21Aac1269da09, governed by cold Tier-1 owner 0x4348DF1BEFAffcbA248B5118B1b782B1B2bdEd14):

PactaCommitmentRegistry (Base Mainnet): 0x35D21Bb4Df6586FE7759b5e57263ffeB3e1fd872 · Sourcify exact_match
Canonical Base EAS Schema (0x4200...0020): 0x7ff485bc1159dff3c70eefcb9dff2d65be990301760c2d53799e5a45e3badf83 (uint16 sprintId,uint64 chainId,uint64 blockNumber,bytes32 blockHash,uint8 verifiedCount,uint8 driftCount,bytes32 summarySha256,string prURI, as registered on Base)
Official Basename: pacta.base.eth (forward + reverse L2 resolver verified on Base Mainnet)

Block-Pinned Public Sprint Summaries (Ethereum Mainnet)

14 Sprints · 37 Indexed Records. Site build: python3 tools/refresh_radar.py && python3 tools/onboarding_scan.py && python3 tools/build_site.py && python3 verify_site_v2.py (onboarding_scan.py writes docs/api/v1/onboarding.json, the single source of the live onboarding verification briefs at /briefs/<slug>/: every check is a block-pinned, two-endpoint cross-checked read, and role maps are replayed from event logs with each log verified against its receipt) (the canonical base URL is a single BASE_URL constant in tools/build_site.py; brief pages are rendered from tools/briefs_src/ inside the shared site chrome, and every call to action goes through the in-browser request builder at /request/).

Sprint	Pinned Block	Canonical Block Hash	Base EAS Attestation	Public Summary & Sampled Protocols
Sprint 1	`26399876` (`0x192d484`)	`0x8bf896b892683ff3267b88b367ab015a70cf5caf53542eb405f4f648f6bcde8a`	`0x3404...3058`	`audits/sprint-1/block-26399876-summary.md` — Inverse Finance (`FiRM`), Origin (`OETH`/`OUSD`), Yearn
Sprint 2	`26400152` (`0x192d598`)	`0xa9a61622304ec55c5fec49abbcabec60069f66f28792cf841bdd7aef12ce63aa`	`0xca4b...8101`	`audits/sprint-2/block-26400152-summary.md` — f(x) Protocol v2, Alchemix, Gearbox V3, Reserve
Sprint 3	`26401070` (`0x192d92e`)	`0xcf55f6a42ae610c1f8766b5c2fb676d91f178469fa10ef777eccbb76f6506234`	`0x291e...95a8`	`audits/sprint-3/block-26401070-summary.md` — ether.fi Liquid / Veda BoringVault, Morpho Blue Core
Sprint 4	`26401312` (`0x192da20`)	`0x95866ea3ef8f9a0567ce000bc8075f6dc5fb0f1e80cb4e9999ae624a2f0dc109`	`0xa26f...2986`	`audits/sprint-4/block-26401312-summary.md` — Mellow / Lido Earn, Convex Finance
Sprint 5	`26401405` (`0x192da7d`)	`0x26e155e1569d436406a52ecee31c94d8d8ef2ca4c45d82211a84c8c802be1510`	`0x8042...28e5`	`audits/sprint-5/block-26401405-summary.md` — Fluid / Instadapp, MetaMorpho (`Re7 WETH` / `Re7 USDT`)
Sprint 6	`26401540` (`0x192db04`)	`0x49324aaf84b0ffd4e21026c5345272788bff377f0f86fcdb74280cdfc32a9641`	`0x749d...09fa`	`audits/sprint-6/block-26401540-summary.md` — Maple Finance V2 / Syrup, Liquity V2 (`BOLD`)
Sprint 7	`26401638` (`0x192db66`)	`0xe62ad2969617ad07c23bec298c3d5e197ea7c3084f7f66c90d2eb51d04c6273e`	`0x3e0e...8779`	`audits/sprint-7/block-26401638-summary.md` — Ethena (`USDe`/`sUSDe`), ether.fi Core, Spark / Sky
Sprint 8	`26401725` (`0x192dbbd`)	`0xec3820f0a9db32c01728e66f78dc1958e410269e1077fd1db53df4fbce2ad7a1`	`0xfd7c...a6c2`	`audits/sprint-8/block-26401725-summary.md` — Usual Money (`USD0`), Renzo (`ezETH`), Yearn V3
Sprint 9	`26402160` (`0x192dd70`)	`0xd04a5e8aa3500c5b60d90c25a810ef28eb9d1bfffadf28f1da58a31ed90582dc`	`0x0e01...6eea`	`audits/sprint-9/block-26402160-summary.md` — Compound V3 (`Comet`), Aave V3 / GHO, Kelp DAO (`rsETH`), EigenLayer Core
Sprint 10	`26403121` (`0x192e131`)	`0x71acee2313a2c8eacd7d2c87667dc505310b3e9224d84eaebb71d5a890ef9d1c`	`0xfdd8...0e6c`	`audits/sprint-10/block-26403121-summary.md` — Ondo Finance (`OUSG`/`Flux`), Mantle (`mETH`), Symbiotic Core, Lido (`DualGovernance`)
Sprint 11	`26403523` (`0x192e2c3`)	`0xfc7beaa2338e8054577c0b101b641bc42afca2af39cb85d3fc13cbee32d4681a`	`0x754e...5e42`	`audits/sprint-11/block-26403523-summary.md` — Curve (`crvUSD`), Gearbox V3 / V3.1, Lombard (`LBTC`), Resolv (`USR`/`RLP`)
Sprint 12	`26403676` (`0x192e35c`)	`0xf4246ca23c4c38d520de16080a11b5186d04c8242b2c85edcb04c455d291c3ae`	`0x7caa...6de9`	`audits/sprint-12/block-26403676-summary.md` — Stader (`ETHx`), StakeWise V3 (`osETH`), Swell (`swETH`/`rswETH`), Superstate (`USTB`/`USCC`)
Sprint 13	`26405302` (`0x192e9b6`)	`0xe05f4fd5698556131e7514b3a8eb24960962a768f8e0bfe0e99e3f1681127f65`	`0x6afd...075c`	`audits/sprint-13/block-26405302-summary.md` — ether.fi Core Upgrade Timelock op `0x244e…359f`
Sprint 14	`26406106` (`0x192ecda`)	`0xcb24dfb0b8af01dff9550fbbf6eb589b30d29b9625f41af56c188ae10d086ecf`	`0x8965...b5b8`	`audits/sprint-14/block-26406106-summary.md` — Ethena, Treehouse TREE, Inverse FiRM, Kelp rsETH

Sprints 15 and 16 are attested on Base (0x967a...ff22, 0x217d...7e58); their summaries and records are published after review.

Running the Foundry Verification Suite

# 1. Deterministic offline unit & candidate-proposal gate suite
forge test --no-match-test "testFork" -vv

# 2. Full suite including block-pinned Ethereum Mainnet archive smoke tests
ETH_RPC_URL="https://gateway.tenderly.co/public/mainnet" forge test -vv

Analytics & privacy

pacta.wtf loads one first-party script, docs/b.js (under 1.5 KB, no dependencies; copy / call-to-action clicks are reported by docs/app.js through it), that sends anonymous page events (page load, protocol page view, 50% / 90% scroll, copy of the MCP URL / curl / SKILL.md link, primary call-to-action clicks, live-checker submits, 404s) with navigator.sendBeacon to Pacta's own gateway, https://pacta-x402.pacta.workers.dev/v1/telemetry/beacon. Each event carries only a redacted path, the referrer host, utm_source and a protocol slug or checked contract address. The path is one of a closed set (/, /protocols/, /protocols/<slug>/ for published pages only, /request/, /briefs/…, /404, /other). Every 404 is sent as /404, so an unknown URL is never sent as typed. A referrer is sent only if it is a public DNS name (never an IP address or a local / intranet host). The gateway re-applies the same rules before storing anything. No cookie is set and no identifier is stored in localStorage (the only stored value is your Paper / Slate theme choice), no third-party analytics are loaded, and browsers that send Do Not Track (navigator.doNotTrack = "1") send nothing. The gateway keeps aggregate counts only, with no raw IP, User-Agent, full referrer URL or query string. Its numbers are observed client metadata (User-Agent families, MCP clientInfo, beacon events): they are not verified humans and not revenue.

Access, Engagements & Contact

Free and real-time for everyone: every indexed record, the timelock radar, pre-execution briefs, /api/v1/*.json and llms.txt are open to vault curators, allocators and AI risk agents with no key, delay or paywall. Curators never pay.
24h Collateral Onboarding & Delta Clearance Attestation — $5,000 USDC flat (optional continuous Aligned badge maintenance: $1,500 / month): for collateral issuers onboarding an asset or clearing a parameter_delta flag. Canonical block-pinned control-plane audit, GitBook / config reconciliation PR, Base Mainnet EAS Aligned attestation in PactaCommitmentRegistry, and a paste-ready Curator Diligence Dossier (PDF + JSON) for Morpho, Euler, Aave and Sky forum proposals. Pay in USDC on Base or Ethereum to the Pacta treasury 0x4348DF1BEFAffcbA248B5118B1b782B1B2bdEd14 (same address on both chains); request at pacta.wtf/request/. See REMEDIATION_SERVICES.md.
Community queue: free, unscheduled (typically 6–8 weeks).
Exploit-sensitive vulnerabilities: Immunefi / Cantina bounty programmes, or a partner audit firm (15% referral partnership) — never public issues.
Organization: Fractal Neurons · @Fractal-Neurons
Maintainer Account: @pacta-fractal-neurons
Contact: pacta@dri.network

pacta

Documentation