Crossfoot

Method

What this explorer claims, what it does not claim, and the words it uses. Every page shows evidence, not assurance.

What the explorer shows

Crossfoot audits tokenized-asset value feeds from the outside. It reads public chain data at pinned blocks, replays the rules the feed contract itself advertises, and writes a reproducible evidence bundle whose root hash every page cites. The explorer reads what the renderer and the consumer agent wrote: the feeds table, the per-feed timelines, the findings and the decision records. It computes no verdict of its own, and it never widens a decision into a third word.

Two targets are covered today. svZCHF, the Frankencoin savings vault, is the exact control: the value is rebuilt from the contractual terms in exact decimal arithmetic and compared with the chain at pinned blocks, field by field, with a residual table. The Midas custom feed family on Ethereum mainnet is the posting-path target: 66 feeds, 60 of them bounded and replayed, 6 derived wrappers without a bound, listed and not replayed. For every Midas feed the NAV is INPUT_GAP, because the underlying portfolio is not observable; nothing about the value itself is recomputed there. Midas pages therefore say posting path replayed and NAV: INPUT_GAP.

The verdict vocabulary

One vocabulary for both targets, in precedence order. A higher word outranks a lower one when both apply.

  • INPUT_GAP: a required series is unobtainable; outranks every other word.
  • INSUFFICIENT_WINDOW: a check lacked rounds or days to run. Not a pass.
  • MODEL_INCONSISTENT: the two model paths disagree; the chain is not judged.
  • OBSERVED_DEVIATION: a nonzero residual, or a rule violation on the posting path.
  • SOURCE_STALE: an input could not be read at the pinned block, or the feed's liveness is not LIVE and no posting-path finding exists.
  • MODEL_MATCH or CONSISTENT: all values equal, or all rules satisfied on enough data.

For a Midas feed the verdict is OBSERVED_DEVIATION when at least one round took the path without the on-chain check while exceeding the bound in force, INSUFFICIENT_WINDOW when rounds could not be attributed and no such post was found, SOURCE_STALE when the feed is not live and no such post exists, and CONSISTENT otherwise.

The posting path

A Midas custom feed has two setters behind the same admin role. One checks the new value against a deviation bound and a minimum spacing before writing the round. The other writes the round with a minimum and maximum check alone. Both emit the same event, so a consumer reading the latest round sees no difference between them.

Midas documents the second setter as its process for high-deviation updates, which it states require a different process with a higher quorum for approval than routine updates. That quorum is applied off chain, and nothing on chain lets a reader verify it. The posting path is therefore the consumer's on-chain signal, and Crossfoot is the public record of which rounds took it.

The replay's technical term for such a round is the finding kind GUARD_BYPASS, defined narrowly: a successful post through the unchecked setter, not the feed's initial post, whose deviation against the answer stored at the previous block exceeded the bound in force at that block. The bound is read from archive state at block minus one, never from head, so later bound changes cannot inflate or hide a finding. A round through the unchecked setter that stayed within the bound is an unguarded post and not a finding of the same kind.

A GUARD_BYPASS finding is a statement about how a value was posted, not about the value. Crossfoot does not say a value is wrong; it says whether the rule was followed and, where the terms allow it, whether the value can be rebuilt from them.

Posting path words: GUARDED when every attributed round went through the check, ADMIN_GUARD_BYPASSED when at least one round took the path without the check while over the bound, UNATTRIBUTED when rounds could not be attributed and no such post was found.

Liveness

Liveness is reported alongside the posting path and never folded into it. LIVE: the latest post is younger than the threshold (30 days at the window block). STALE: the latest post is older than the threshold and the answer is not the placeholder. PLACEHOLDER: the answer is exactly 1.00000000 after more than one round and the latest post is older than the threshold. INIT_ONLY: a single round at the placeholder value, whatever its age.

Decisions

The consumer agent decides, per feed, whether automatic acceptance may proceed (ALLOW) or must wait for a human (REVIEW). There is no REFUSE, because a posting-path finding does not prove the posted value wrong. Every decision carries the subgraph deployment ID, the indexed block, the hash of every query and response, and the bundle root of the Crossfoot run it relied on, so a third party can re-check it. The decision table is deterministic; no language model is involved.

Keys

Where a page names a poster, it names an on-chain key. One key means one on-chain key. Nothing here says who holds a key or who controls an executor address.

What the subgraph indexes

The subgraph indexes on-chain data: rounds with the selector that posted them, the deviation and the bound in force, bound changes from upgrade events, posters, and the Frankencoin rate changes and vault flows. Verdicts, decisions and bundles stay off chain; the subgraph is the queryable record of the posted side, and the agent joins it with the off-chain result.

Limits

  • The implementation source is verified for mRE7 and for the two mTBILL implementations. Every other implementation address carries implementation_verified: false; its spacing rule comes from a bytecode scan, never from verified source.
  • The argument that no other bound change occurred rests on checkpoint equality and the upgrade and initialize events; it is recorded as such, not as a proof.
  • Rounds routed through Safes are attributed by decoding the Safe call; without a trace endpoint, other internal calls stay unattributed and the counts are lower bounds.
  • Selector semantics on the mGLOBAL growth feed's three-argument setters are unverified and noted on the record.
  • Bundles are the reproducible artifact. Where no archive URL is known, the page shows the bundle root and the verify instructions instead of a download.

Disclosure

Auth, Polar billing and Convex project setup adapted from internal boilerplate written before the event; all Crossfoot-specific code (feeds, findings, decisions, alerts, risk-feed API, x402 path) written during ETHOnline 2026.

What the explorer shows right now

Render
ingestion kd71t7rdbe88wnwssw0yvcev558e4fwp, rendered from 194beb4ba61d9151a15afddee6c05e2ae0d6206b, received 2026-09-10 20:59 UTC
Window block
91,260,041
Bundles
  • backed at block 25,949,464: 9f3d39bb82dde6a8cd64c9a13e11af04bb29de51a188814d8a3925f2fe0877d3
  • centrifuge at block 25,949,464: 7a72e3900532dc596a1a58a56163900e44bdd8f33a60da5143bb81199b5c005c
  • chainlink at block 25,949,464: 1af77164083cbd16ac37130fca04e9c64dd0d0854066c7bb91ff8fae3b506803
  • frax at block 25,885,408: 3462607a924e3bbaaaa7faf5293a42f9dcae5fee8c948fa6e7501050ea41bcbb
  • hashnote at block 25,949,464: 2d348a602779b9ce51440197598ac3bbcd9e83e1d735d4f4bf83f4f0d02b7e30
  • maple at block 25,885,541: deb9cf9b94b47ed6cff1cd4a14a20406136621f9422f6e896b5a016ace8df59f
  • midas at block 25,949,464: 9c34963ec326f7c6fb47d2ab5d0d77b5640c044a0033261b9610bd32454665ab
  • ondo at block 25,949,464: 70e0bc7970ffafd957f560d8c6a16dc69716139077f777f05c9ff3f888f3c856
  • openeden at block 25,949,464: e462567a152b83cf41ae0fb0a115c3a71df6d9f798310ea93d671ca1e22ae46d
  • sky at block 25,885,408: a2fe154537e400698e40b50d59310c55ca6241aff1dd13434748ec4b766d0e1b
  • superstate at block 25,949,464: 6aedf8d795aec5956610f3745673bd7ab0b801b388333ecece34b7704c735651
  • susde at block 25,885,407: cfa2fd624a850b104b49e98ee4e18b724d8f8396d541dd80f381b0b0cf46d174
  • svzchf at block 25,853,000: 6cf3893273191578a790a9dba90c165791e9821a1762cf8a6c04f78abaa220b9
  • tectonic at block 91,260,041: b5425f4c1154d97734bd6c931dec915f1b77a83cdaa84af883675e5ea9158995
  • usdy at block 25,885,411: 044b8be93c9a895b1302083a0533c3dce1e2d8695abd8a262b8adfee172b0fc9
Decision run
20260910T205941Z, deployment QmeTCucCXDhT27pMMExg2EtDx1t7SA3Abgcw2p4BuZgmdQ, indexed block 25,949,534
Claims
  • A GUARD_BYPASS finding is a statement about how a value was posted, not about the value: the round took the path without the on-chain check.
  • A feed that took the path without the on-chain check is routed to REVIEW; the posted value is not called wrong.
  • The consumer decision has two words, ALLOW and REVIEW; REFUSE is never emitted.
  • NAV recomputation is INPUT_GAP for every Midas feed; svZCHF is recomputed in full.
  • One key means one on-chain key; nothing is claimed about who holds it.
  • The subgraph indexes on-chain data only; verdicts and hashes stay off chain.
  • Verdicts, posting paths, liveness words and decisions are printed exactly as ingested.
  • Auth, billing and the Convex project setup are ported from internal company boilerplate; every Crossfoot-specific line was written during the event.