Vestige protocol · co-signature lab
A signer signs a statement about the chain's latest block. A passkey co-signs it. Vestige.sol checks both P-256 signatures against the chain's own block hash and records the encounter for anyone to verify.
01 · 02 / The ceremony
Beacon: A is an unattended device key that re-signs block head − 1 every block, like a door reader or an IoT device. Handshake: A is a person whose passkey signs once. Either way A declares a window, maxAge blocks, inside what it signs, and B must co-sign within it. The contract sees a signer, a window and a cosigner.
Handshake needs two different passkeys: one for A, one for B. On one device that means enrolling twice; with “Security key / phone” B can be your phone.
Non-extractable WebCrypto P-256 key in IndexedDB. Signs sha256(abi.encode(tag, chainId, vestige, n, blockhash, maxAge)) every block.
A passkey signs the same statement digest as its WebAuthn challenge, once, when you tap.
The passkey signs keccak256(COSIGN_TAG, digest, signerKey), binding itself to A's exact statement.
Enroll a passkey, then co-sign.
None
03 · 04 / Contract
Each attack submits a variant of the current or last accepted evidence. The contract rejects it, and its custom error is logged here.
Reverts are not events, so this log lives in the page. Accepted co-signatures are read back from the chain below.
The JSON log covers what the node never sees: passkey prompts and cancellations, clientDataJSON and authenticator flags, evidence and decoded errors. Match it to the node log by block number or tx hash. Public data only.
05 / Public record
Every Cosigned event, read from the contract's logs, not this browser's storage. Any client with the RPC can rebuild this table and check each co-signature's anchor gap.
| Included | Anchor | Age / window | Mode | Signer | Cosigner | cosignId | Tx |
|---|
06 / Source
The exact files compiled into the deployed bytecode, checked by this page against the code at the contract's address: bytecode, compiler metadata, and every source file's hash.
What this proves: the code at the address is byte-for-byte the compiler output shipped with this page (no constructor arguments or immutables, so the same build is the same code on every chain), and that output's embedded metadata hash commits to these exact files. What it does not: that the compiler turned these files into that output. For that, recompile with the settings above and compare.