FlashRouter

Verifying our claims

Everything the desk publishes is designed to be checked without contacting the desk. This page lists the procedures.

The deployed contract

  1. Ask any Base node: eth_getCode("0x13ED5bB77711A6cdd3B0963c2D97A185f7E6879C", "latest").
  2. Strip the 0x prefix, decode the hex to bytes, and hash with SHA-256.
  3. Expect 3,306 bytes and 4df724cbc83fd69d3e3253a5093e493affb43c4c7bb1ec15c3d590163e24d7ae.

The flash premium

Call the Aave V3 Pool on Base at 0xA238Dd80C259a72e81d7e4664a9801593F98d1c5 with selector 0x074b2e43 (FLASHLOAN_PREMIUM_TOTAL()). The result is the premium in basis points. On 2026-09-04 it was 5. The API re-reads it on every quote; the site's estimator prints which value it used.

An attestation

  1. Take the envelope. Note kid, public_key, and signature.
  2. Confirm public_key matches the entry for that kid at GET /v1/pof/key or in the repository file api/worker/KEYS.md.
  3. Remove signature; serialize the rest with keys sorted recursively and no whitespace; verify the Ed25519 signature over the UTF-8 bytes.
  4. Ask any node for the balance at observation.start.hash and observation.end.hash; both must be at least claimed.
  5. Confirm both block hashes are finalized on the chain in question.
# Node 20+ offline signature check
import { createPublicKey, verify } from "node:crypto";
const att = JSON.parse(process.argv[2]);
const { signature, ...unsigned } = att;
const canon = JSON.stringify(unsigned, Object.keys(unsigned).sort());
const key = createPublicKey({ key: Buffer.concat([
  Buffer.from("302a300506032b6570032100", "hex"),
  Buffer.from(att.public_key, "base64") ]), format: "der", type: "spki" });
console.log(verify(null, Buffer.from(canon), key, Buffer.from(signature, "base64")));

A tradeline

Open the client account on any XRPL explorer or call account_lines on any XRPL node. The line to the issuer shows the limit, the balance (drawn amount), and peer_authorized: true once the issuer has approved it. account_objects with type escrow shows collateral; type credential shows the verification credential. Every draw, repayment, and accrual is a Payment in the account's transaction history with a memo naming its kind.

The amendment status

Fetch the Amendments ledger entry at index 7DB0788C020F02780A673DC74757F23823FA3014C1866E72CC4CD8B226CD6EF4 from any XRPL node. Each enabled amendment is listed by id, where id is the first 32 bytes of SHA-512 of the feature name in upper-case hex. SingleAssetVault is 81BD2619B6B3C8625AC5D0BC01DE17F06C3F0AB95C7C87C93715B87A4FD240D8 and LendingProtocol is 565B90CA1AB2B9D42208ED10884188C64F9E19083DECB9634AAF06EB03299509; neither was present on 2026-09-04.

This documentation

Every operational claim here is rendered from status/public-status.json in the repository, which records the commit that last changed it. The same file is served at https://flashrouter.io/public-status.json and GET /v1/status. The PDF downloads on the documentation page list their SHA-256 so a copy you were sent can be compared against the published one.

The source

https://github.com/FTHTrading/flashrouter. Unit tests run with node --test in api/worker and site; the copy gate runs with python tools/copyguard-local.py; status surfaces are checked with python tools/render-status.py --check.