# Alpha v0.1.0
Source: https://docs.trustblock.run/changelog/0.1.0
Changelog for Trustblock v0.1.0
### Features
* **Basic Profile Management**:
* Auditors can now edit their profile picture, name, and description
* Ability to add firm's headcount and creation date
* **Audit Publication**: Auditors can publish audits on Testnets
* **Metrics**: Each auditor profile includes metrics calculated from their audits' stats and data
* **Auditor Search**: Users can search for auditors using filters such as:
* TVL (total value secured)
* Area of expertise
* Chains
* Name
* **Audit Search**: Users can easily retrieve an audit by typing the report's or project's name
### Documentation
* Comprehensive documentation added for all features and functionalities at [https://docs.trustblock.run/](https://docs.trustblock.run/)
* We encourage you to explore this release's new features and improvements
* We welcome your feedback and contributions
# Alpha v0.2.0
Source: https://docs.trustblock.run/changelog/0.2.0
Changelog for Trustblock v0.2.0
### π General Big News
We are now production-ready, with the following updates:
* Publishing on-chain is disabled by default
* Option to publish audits on testnet chains
* Focus on user experience and organic growth
* Preparing migration tool for mainnet release
* Recommendation to start uploading audits now
### π Breakthrough Features
#### CLI Tool
* Introducing the Trustblock CLI for uploading audits without UI
* Easy integration into existing workflows
* \[Read more about using our CLI here]
#### Labels
* Add labels to any UI by including a script and formatted div
* \[Read more about integrating labels here]
#### π·οΈ Labels widget
#### API Access
* Access Trustblock API with unique API key from auditor profile
* Ideal for complex operations using Trustblock's data
* \[Check out our API documentation here]
#### π§ Security data API
### π Other Features
* Auditors can now edit the links on their profiles
### β‘οΈ Performance Improvements
* Improved platform loading times by a factor of 6
### π Bug Fixes
* Fixed a crash issue when navigating to your profile from another auditor's profile
# Alpha v0.3.0
Source: https://docs.trustblock.run/changelog/0.3.0
Changelog for Trustblock v0.3.0
### π General Big News
* We have started migrating audits from partner auditors onto Trustblock.
* Bringing previously released reports to Trustblock can be a long and thorough task.
* We're offering our beloved early adopters the opportunity to handle this potentially painful task for them!
### π Breakthrough Features
#### Auditor wrapper
As an auditor, you can enhance transparency and foster trust in your business by utilizing Trustblock's Auditor Wrapper:
* Integrate this advanced tool into your website
* Present your business metrics in an easy-to-comprehend and engaging way
* Transform raw numbers into compelling narratives
* Showcase your business's strengths
* Foster greater trust among your stakeholders
#### π Metrics widget
### π Other Features
* CLI can now be used with your API Key, making its usage and configuration easier to handle. \[Check it out here]
### π Bug Fixes
* Fixed a bug where the Twitter URLs submitted from onboarding forms were wrongly formatted
* Fixed an issue causing long names on audits cards to overflow
# Alpha v0.3.1
Source: https://docs.trustblock.run/changelog/0.3.1
Changelog for Trustblock v0.3.1
### π General Big News
* Migrated previous audits from Safetin, Pessimistic & Hashex to Trustblock
* Some auditors have started integrating the auditor wrapper (e.g., Safetin's website)
* Moving to integrate QuillAudits & SolidProof next
* Planning to roll out public announcements by the end of next week, ending stealth mode
### π Main Features
#### Auditor wrapper customization
* Added customization options for the auditor wrapper to better serve auditors' branding needs
* Read more \[link needed]
* Thanks to Safetin for initially sharing this idea
### π Other Features
* Removed requirement for issues names and descriptions upon publication
* Decision made after internal discussions
* Data already available in reports
* Makes publishing more straightforward
* Updated CLI documentation accordingly (read more \[link needed])
* Added search functionality for projects by domain on the publishing form
### π Bug Fixes
* Fixed incorrect calculation of issues metrics
# Alpha v0.3.2
Source: https://docs.trustblock.run/changelog/0.3.2
Changelog for Trustblock v0.3.2
### π General Big News
* We're finally out of stealth mode
* Onboarded five new auditors since then
* Preparing everything to start onboarding platforms
### π Main Features
#### Dynamic widgets
We're proud to offer dynamic widgets from now on:
* Metrics and labels widget will listen to the values of colors, addresses, and sizes
* Automatically refresh if these are updated
* Example: For websites with light and dark modes, passing new values when switching themes will automatically refresh the widget
#### Label widget
* Added customization options for the labels widget
* Necessary due to varying platform branding, colors, and overall look
* Thanks to Mobula for sharing this request
### π€ Wording/Design changes
* Changed wording of audits published tag:
* From: 'X audits published'
* To: 'X audits published on Trustblock'
* Applied on both trustblock.run and widgets
* Reason (highlighted by Hashex): Some auditors' audits are private or not published, new wording implies more audits could have been published
* Changed the issues reported icon to a check circle
### π Bug Fixes
* Issues metrics were not correctly calculated
* Web-based audits were not correctly working
* TVS metrics were not always accurately calculated on null values
* New projects created on publish audit could lead to some unexpected state
* Issues fixed were not accurately calculated
# Alpha v0.4.0
Source: https://docs.trustblock.run/changelog/0.4.0
Changelog for Trustblock v0.4.0
### π General Big News
We now support four additional chains: Arbitrum, Optimism, Fantom & ZkSync.
Platforms can now finally onboard and start using labels & API.
### π Main Features
#### Chain support
* We're proud to support four additional chains
* Trustblock is now compatible with:
* Ethereum
* Polygon
* Bnb
* Avalanche
* ZkSync
* Arbitrum
* Optimism
* Fantom
* We support metrics for every chain except for ZkSync, where, unfortunately, we could not find a reliable data source
#### Platform onboarding
One of our most important milestones has finally been reached. As of today, platforms can finally onboard and start using labels & API to enhance web3's security and user-friendliness. For now, we only work with close partners to test things out.
### π Bug Fixes
* Fixed an issue causing emails not to be properly sent
* Fixed a bug where telegram fields were not properly saved
* Fixed a bug happening on the publish audit interface
* Added a new authentication flow
### π¦ Miscellaneous
* Added logs to better apprehend future bugs
* Improved total transactions secured count
* Shifted from our heavy reliance on EVM address in favor of slugs to be less EVM dependant
* Improved performances X2
* Added widget playground pages
# Beta v1.0.0
Source: https://docs.trustblock.run/changelog/1.0.0
Changelog for Trustblock v1.0.0
### Big News
We have successfully completed our most ambitious technical migration to date and have fully transitioned to AWS. This change will enhance performance and introduce unique new features.
### Product updates
***
#### π New homepage
While we will miss our old homepage, it never truly met our expectations as it lacked a welcoming feel.
Our goal was to create a more engaging entry point that encourages users to explore our extensive security hub, recognizing the critical role of first impressions in this process.
Therefore, we redesigned the homepage to be both lighter and more inviting, while preserving nearly the same level of information.
#### π Contractless reports
We strongly support audits that are directly linked to contracts. However, it's not feasible to exclude all previously conducted audits that do not meet this criterion. Our aim is to familiarize the web3 security community with this approach. To achieve this, we will also accommodate audits that are not tied to specific contracts. We will ensure that the coverage status of projects, whether they have associated contracts or not, is always transparently communicated.
#### π Better metrics
Metrics are highly valued in our ecosystem, and we've dedicated significant effort to enhance their representativeness and insightfulness. In this vein, we've redefined our Total Value Secured (TVS) calculation method, aligning it more closely with the actual value secured by auditors.
Additionally, we've introduced three distinct measures for each numerical value: minimum, average, and maximum, to provide a comprehensive view.
We've also redesigned the auditor page to be more visually intuitive and user-friendly, making it easier to understand at a glance.
#### π Project page
In our pursuit to provide a more user-centric experience, we've recently shifted our focus towards a project-oriented approach. This means users will now find it easier to navigate directly to project pages rather than audit pages, enhancing their overall experience. Nevertheless, we've ensured that audit pages are still readily accessible from within the project pages to maintain our commitment to transparency.
#### Our API is out
We are excited to announce the launch of our API, which is now fully operational. This API provides programmatic access to our platform's data, enabling developers to integrate our features into their applications.
Learn how to integrate Trustblock's security data API on your website.
#### π₯ New Labels
As highlighted in the recent update, the focus has shifted from audits to projects. In line with this new direction, the design of our labels has been refreshed to better integrate into platforms and projects while ensuring the delivery of valuable information to all viewers.
#### π·οΈ New tags
We've added more project tags to give detailed insights about an auditor's focused work areas.
# Beta v1.1.0
Source: https://docs.trustblock.run/changelog/1.1.0
Changelog for Trustblock v1.1.0
### Product updates
* Migrated our authentication and onboarding process for improved stability and login methods.
### Bugs fixed
* Fixed many bugs which should bring better experience overall.
# Beta v1.1.1
Source: https://docs.trustblock.run/changelog/1.1.1
Changelog for Trustblock v1.1.1
### Product updates
* Updated the auditor onboarding process; pseudo-identifiers are no longer accepted.
### Bugs fixed
* Corrected a visual issue causing unnecessary right margin on the auditor profile page's top metrics.
* Resolved a bug where additional categories were not displayed with fully rounded corners.
* Fixed a pagination problem that resulted in an excessive number of pages being sent.
* Addressed a malfunction in the "Publish another audit" button (reported by CFG Ninja).
* Enhanced the clarity of error messages on the Publish Audit form.
* Eliminated a bug causing the app to crash post-login.
* Fixed a failure in the publication system related to IPFS report uploads (reported by CFG Ninja).
# Beta v1.1.2
Source: https://docs.trustblock.run/changelog/1.1.2
Changelog for Trustblock v1.1.2
### Product updates
* Updated the publishing UI:
* A dropzone was added to facilitate the report import.
* Every time a new contract is added, it will automatically fill the inputs with the last added contract's information.
* Improved the design of the integrator page.
* Updated the onboarding prospect chain labels.
* Improved the meta tags on each page.
* Improved the error messages on the interface.
* Updated our validator to handle Twitter's new domain x.com.
* Switched from x-trustblock-api-key to Authorization header.
### Bugs fixed
* Fixed a bug where some users were not able to onboard.
* Fixed a bug causing metrics not to be calculated.
* Fixed the "Request an audit" button.
* Fixed responsive issues on mobile.
* Fixed contracts' table overflow on the audit page.
* Fixed query parameters on the homepage.
# Beta v1.2.0
Source: https://docs.trustblock.run/changelog/1.2.0
Changelog for Trustblock v1.2.0
### Product updates
* New domain app.trustblock.run
* We're still in Beta but want to build a future-proof SEO.
* You can now head to your profile and update your login email.
* Revamped publishing experience
* We've added an AI assistant that will extract some data from your report and prompt you with its suggestions, making the publishing process much faster.
* We've also greatly improved the overall design and strive to make this process as easy as possible.
* Added details and info bubbles to help better understand some specific parts or fields.
* We don't accept links with subpaths on the project's website URL when publishing an audit any more
* To make our future autonomous audit verification effective we need direct URL such as `https://website.com`. The problem is that in some cases, we were getting some URLs that were redirected to a presale, which is far from ideal, both for verification purposes and domain extraction.
* Project's emails are not unique throughout our entire database anymore
* This change is necessary because some auditors might not have access to a project's email address; as such, we recommend that they add theirs.
* We now accept Github links with subpaths
* Some projects might be shared in a big repository or else.
* The request audit button on auditors' profile pages now redirects to a Google Form for the Trustblock team to collect insights about the lead's needs.
* When onboarding is successful, a modal pops up, similar to when an audit publication is successful.
### Bugs fixed
* Fixed a bug where the contract selector on publish audit would have a weird offset in some specific settings.
* Fixed a bug causing newly added contracts to not be prioritized in our metrics calculation system.
* Fixed some bugs on the login where the "Not Authorized" banner would appear too soon.
* Fixed a bug that was displaying the wrong row number on profiles' tables
* Fixed a bug where the error message coming back from API wouldn't be displayed
# Beta v1.3.0
Source: https://docs.trustblock.run/changelog/1.3.0
Changelog for Trustblock v1.3.0
### Product updates
* Publish audit revamp:
* Separated each section of the old design into different steps to facilitate auditors' publication of audits.
* Widgets re-design & performance improvement.
* Improved the search design on the home page.
* Better user feedback thanks to loading skeletons.
* Improved the metrics blocks on auditors' profiles.
* Added a navigation breadcrumb on many of our pages to facilitate the overall navigation on the platform.
* Improved the design of all Tables.
* Improved the design of our Code Preview UI component.
* Added some small onboarding design changes.
* Added Cookies consent.
### Bugs fixed
* Fixed a bug preventing users from updating their profile picture. Many thanks to Runtime Verification & Omniscia for reporting this bug to us!
* Fixed a bug where new users wouldn't get redirected to the Onboarding page after signing up.
* Fixed many errors on widgets.
* Fixed a typo on a publish audit error message.
* Added many new logs from our back end to better assist our users.
* Fixed many different performance & design bugs.
# Beta v1.4.0
Source: https://docs.trustblock.run/changelog/1.4.0
Changelog for Trustblock v1.4.0
### Product updates
* New onboarding experience:
* We minimized the number of steps to onboard and improved the design of the onboarding page.
* Chains & Categories re-design:
* We felt that the previous design was not very user-friendly, with too much information on pages. As such we redesigned to display less information by default and added a tooltip to display more information.
* Support for web-based reports:
* We added a new type of report, web-based reports. This type of report is useful for auditors to publish audits with fileless reports.
* Support for contracts on private repositories:
* We added a new type of contract, private repositories. This type of contract is useful for auditors to publish audits where the contract is not hosted on a public repository.
* Added a new `conductedAt` field to the publishing. This field is required when creating an audit.
* Added a new `chains` field to the publishing. This field is required when creating a project upon publishing.
Learn how to publish an audit on Trustblock.
### Bugs fixed
* Fixed a bug where contracts on the publish audit page would not be correcly displayed and validated.
* Fixed a bug where metrics for auditors with only off-chain audits would not be calculated.
* Fixed a bug where the onboarding page would not be displayed for new users.
* Fixed a bug where the inactive auditors would be displayed on the homepage & on search.
### Performance improvements
* As usual, we improved the performance of the platform.
### Security improvements
* We improved the overall security of the platform.
# Beta v1.5.0
Source: https://docs.trustblock.run/changelog/1.5.0
Changelog for Trustblock v1.5.0
### Breaking changes
As we are moving to a new version, we had to make some breaking changes in the Publishing API:
* We simplified the authorization process for reports uploads.
```git
const uploadAuthResponse = // Request to the above route
// Get the response's data from the authorization route
const uploadAuth = uploadAuthResponse.data;
// Create a form data to send the file over to Pinata
const formData = new FormData();
- formData.append('file', file);
- formData.append(
- 'pinataMetadata',
- JSON.stringify({
- name: uploadAuth.fileName // Use the name sent by the authorization route
- })
- );
- const pinataOptions = JSON.stringify({
- cidVersion: 0
- });
- formData.append('pinataOptions', pinataOptions);
+ formData.append('file', file);
+ formData.append('pinataMetadata', JSON.stringify(uploadAuth.pinataMetadata));
+ formData.append('pinataOptions', JSON.stringify(uploadAuth.pinataOptions));
// Perform a POST request on the URL sent by the authorization route
const uploadResponse = await axios.post<{ IpfsHash: string }>(uploadAuth.url, formData, {
maxBodyLength: Infinity,
headers: {
'Content-Type': `multipart/form-data;`,
Authorization: `Bearer ${uploadAuth.apiKey}` // Pass the API key sent by the authorization request
}
});
// Here you get the reportFileCid needed by the publish audit route.
const reportFileCid = uploadResponse.data.IpfsHash;
```
* Changed the `contractType` allowed values:
```git
- "on_chain"
- "off_chain"
- "secret"
+ "onChain"
+ "offChainPublic"
+ "offChainPrivate"
```
Learn how to publish an audit on Trustblock.
### Product updates
* Updated our TVS third party service.
* We moved away from dex.guru in favor of Mobula which will provide more accurate and up to date TVL data.
* As of now, metrics are also calculated for auditors who only have off-chain reports.
* Uniformized the display of issues on the project & audit pages.
* Updated the wording of contracts types to better fit our product.
* Added new chains on the auditor onboarding step:
* Sui
* Aptos
* Sustrate -> Polkadot
### Bugs fixed
* Fixed a bug where the profile picture would not be displayed on auditor pages.
* Fixed a bug not accepting discord links invites.
* Fixed a bug where pressing enter on the publish form would not switch to the next step.
* Fixed a bug where projects' images would not be displayed after running a search on Homepage.
* Fixed a bug where the `conductedAt` would not be properly limited.
* Fixed a bug where audits with similar contracts would not be created but the client would not be notified.
* Fixed a bug where similar secret contracts could be created on the same project.
### Performance, Security & Reliability improvements
* As usual, we improved the performance of the platform.
* Improved our monitoring and alerting systems.
* Improved the performanes on auditor search.
# Beta v1.5.1
Source: https://docs.trustblock.run/changelog/1.5.1
Changelog for Trustblock v1.5.1
### Product updates
* Landing website redesign.
* Added new blog.
*
### Bugs fixed
* Improved SEO overall.
* Changed mentions of "Polygon" to "Polygon (POS)".
* Auditor search sorted by number of audits published + TVS.
# Beta v1.6.0
Source: https://docs.trustblock.run/changelog/1.6.0
Changelog for Trustblock v1.6.0
### Big News
This is one of the most important updates we have made so far, including better data aggregation, improved api and user experience and support for more chains.
### Product updates
* Better data aggregation for projects.
* From now on we automatically aggregate rekts
* and other contracts related to a project.
* Added new blog.
* Automatic audits aggregation.
* We automatically aggregate audits for the biggest web3 projects.
* Rework of the getProjectSecurity endpoint.
Learn how to integrate Trustblock's security data API on your website.
* Support for new chains.
Learn which chains are supported by Trustblock.
* We added a dedicated account page for users.
* Improved the user experience on our homepage.
* Improved overall SEO & responsiveness.
* Added a global search bar to help you find what you need.
### Bugs fixed
* Fix layout on safari browser.
* Fix bug where contracts were not mandatory to create an audit.
* Fix bug where the metrics were not properly calculated for some projects.
* Fix auditor search.
### Performance, Security & Reliability improvements
* Better performances thanks to global caching on the webapp.
# Beta v1.7.0
Source: https://docs.trustblock.run/changelog/1.7.0
Changelog for Trustblock v1.7.0
### Product updates
* UI Revamp of the project and audit pages.
* Added an edit audit feature.
* You can now edit your published audit after it has been published (the project and the report can't be edited).
* Added new tags
* Infrastructure
* Privacy
* Identity
* Simplified the upload report API process.
* Better & Faster metrics calculation for auditors.
### Bugs fixed
* Fixed various bugs.
* Fixed the auditor total transactions secured metric.
### Performance, Security & Reliability improvements
* Increased performances on the webapp & overall system by a factor of 10.
# Beta v1.8.0 (latest)
Source: https://docs.trustblock.run/changelog/1.8.0
Changelog for Trustblock v1.8.0
This release primarily focuses on enhancing the overall stability and efficiency of the platform. It includes significant bug fixes, performance optimizations, and major updates to underlying libraries. These improvements aim to provide a smoother and more reliable user experience.
### Product updates
* Contracts displayed on the project page.
* New chains:
* Lukso
* Mina
* Ton
* Zircuit
* Astar
* Peaq
* Vana
* FiveIre
* Plume
* New tags:
* Identity
* Privacy
* Infrastructure
* Improved login & sign up flow.
### Bugs fixed
* Fixed various bugs.
### Performance, Security & Reliability improvements
* Added pagination on many pages, improving the user experience & overall performance.
# What's different?
Source: https://docs.trustblock.run/comparison
The table provides a succinct comparison of Trustblock's functionalities against other platforms, highlighting unique features and capabilities across the web3 security landscape.
| Feature | Trustblock | Decentralized Audit Marketplaces | Audit Aggregator Platforms | Blockchain Security Analysis Tools | Community-Driven Audit Platforms | Classic Audit Firms |
| :------------------------------------------ | :----------------------------------------------------------------: | :----------------------------------------------------------------: | :----------------------------------------------------------------: | :----------------------------------------------------------------: | :----------------------------------------------------------------: | :----------------------------------------------------------------: |
| Direct Audit Upload | | | | | | |
| Easy Onboarding for Auditors | | | | | | |
| Accessible Audit Data | | | | | | |
| Unique ID for Verification | | | | | | |
| User-Friendly Data Presentation | | | | | | |
| Real-time Security Monitoring | | | | | | |
| API for Web3 Integration | | | | | | |
| Objective Auditor Metrics | | | | | | |
| Scalable Audit Handling | | | | | | |
| Crowdsourced Security Insights | | | | | | |
| Advanced Vulnerability Detection Algorithms | | | | | | |
| Expert-led Security Training and Workshops | | | | | | |
| In-house Security Auditors | | | | | | |
- Feature Fully Supported
- Partial Support or Limited Functionality
- Feature Typically Not Supported or Not Available
# Decentralization Plan
Source: https://docs.trustblock.run/decentralization-plan
How Trustblock intends to decentralize in the future
*Dear Web3 Community,*
As pioneers in the web3 security space, we at Trustblock are deeply committed to fostering a decentralized future. Our mission is to enhance trust and transparency within the auditing ecosystem by leveraging the power of decentralized technologies. We believe that by working collaboratively with the community, we can overcome the challenges inherent in decentralization and build a platform that serves the interests of all stakeholders.
### **The Evolution of Trustblock**
**Our Initial Vision**
Trustblock was founded with the ambition to create a fully decentralized platform where clients and auditors could interact seamlessly on-chain. Our initial model featured:
* **Direct On-Chain Interactions:** Clients could request audits, negotiate terms, and finalize agreements with auditors through smart contracts.
* **Secure Fund Management:** Funds were held in escrow within smart contracts, ensuring release only upon successful audit completion and client approval.
* **Enforced Accountability:** Auditors committed to specific delivery dates, with mechanisms allowing clients to reclaim funds if deadlines were not met.
**Choosing the Hard Path**
In an industry where launching a token generation event (TGE) has become a common practice to quickly raise funds and gain market attention, we deliberately chose a different route. We decided not to initiate a TGE from the outset, prioritizing the development of a robust platform over immediate fundraising through token sales.
**Our Reasons**
* **Building Real Value First:** We believe that the foundation of any successful platform lies in its utility and the value it provides to its users. By focusing on developing Trustblock's core functionalities first, we ensure that any future token integration will have genuine utility within a mature ecosystem.
* **Avoiding Premature Tokenization:** Launching a token without a fully developed platform can lead to speculative trading without real adoption. We aimed to prevent creating a token that lacks intrinsic value or utility.
* **Fostering Trust:** By not rushing into a TGE, we demonstrate our commitment to long-term success and building trust with our community and stakeholders.
**Lessons Learned**
While our initial approach embodied the principles of decentralization, we encountered practical challenges that necessitated a strategic pivot:
* **Auditor Feedback:** Many auditors expressed a preference for off-chain interactions, finding the fully decentralized system complex and less efficient for their workflows.
* **Flexibility Constraints:** The immutability of smart contracts limited our ability to iterate and adapt the platform in response to user feedback and evolving needs.
* **Transaction Costs:** Despite optimization efforts, transaction fees remained a barrier for some users, affecting the accessibility and scalability of the platform.
### **Our Commitment to Decentralization**
**Balancing Decentralization with Practicality**
We remain steadfast in our commitment to decentralization, focusing on areas where it delivers the most value:
* **Core Decentralization:** Prioritizing the decentralization of critical components such as auditor certification, data integrity, and governance.
* **Enhanced Flexibility:** Developing a modular architecture that allows for iterative improvements without compromising the decentralized ethos.
* **Collaborative Development:** Engaging with the community to co-create solutions that align with the collective vision for a decentralized security hub.
**Exploring Decentralized Auditor Verification**
A key challenge we are addressing is the decentralization of auditor verification. Ensuring that auditors are vetted without relying on centralized authorities is crucial for maintaining trust and impartiality. We are currently exploring several approaches:
1. **Decentralized Governance via Tokens**
* **Community Involvement:** Introducing a governance token to empower stakeholders to participate in decision-making processes, including auditor verification.
* **Benefits:** Aligns the platform's evolution with the interests of the community, promoting transparency and shared responsibility.
* **Considerations:** Implementing safeguards to prevent conflicts of interest and ensure that verification decisions are made impartially.
2. **Verified Integrators (Platform Collaboration)**
* **Strategic Partnerships:** Collaborating with major platforms and protocols that utilize audit data to help verify auditors.
* **Benefits:** Leveraging the vested interest of integrators in accurate data ensures that only credible auditors are verified.
* **Considerations:** Establishing mutually beneficial incentives for integrators to participate actively in the verification process while maintaining decentralization.
3. **Community-Driven Verification with Incentive Mechanisms**
* **Staking and Slashing Models:** Auditors stake tokens when publishing audits, which can be forfeited in cases of malpractice. Community members can challenge potentially fake or fraudulant audits, promoting a self-regulating ecosystem.
* **Benefits:** Economic incentives discourage malicious behavior and encourage thorough vetting by the community.
* **Considerations:** Designing robust mechanisms to prevent collusion and ensure the effectiveness of the staking model without imposing undue burdens on auditors.
4. **Client Validation**
* **Direct Confirmation:** Enabling clients to validate audits, providing an additional layer of verification from the entities directly commissioning the audits.
* **Benefits:** Enhances trust by involving clients in the verification process and reduces reliance on central authorities.
* **Considerations:** Implementing measures to authenticate client responses and prevent fraudulent confirmations.
### **Collaborative Path Forward**
**Engaging the Community**
We recognize that the success of Trustblock hinges on active collaboration with the broader Web3 community. Your insights, expertise, and feedback are invaluable as we navigate the complexities of decentralization.
* **Open Dialogue:** We will be hosting community calls and forums to discuss our decentralization roadmap, gather input, and address questions.
* **Contributions Welcome:** We encourage community members to share ideas and propose solutions that can help refine our approaches.
* **Transparent Development:** Regular updates will be provided to keep you informed about our progress and any challenges we encounter.
**Immediate Actions**
While we work towards fully decentralized solutions, we are taking concrete steps to reinforce our commitment:
* **On-Chain Certifications:** Weβll begin to publish auditor certifications on-chain using technologies like Verax and the Ethereum Attestation Service (EAS), enhancing transparency and immutability.
* **Progressive Decentralization:** Implementing interim measures that gradually decentralize aspects of the platform, allowing for iterative learning and adaptation.
### **Addressing the Challenges**
**Technical Complexity**
Implementing decentralized verification systems is inherently complex. We are dedicating significant resources to research and development to ensure that our solutions are secure, scalable, and effective.
**Economic Incentives**
Creating a system that aligns the interests of auditors, clients, and verifiers is crucial. We are exploring game-theoretical models and incentive structures that promote honest participation and deter malicious activities.
**Maintaining Integrity**
Our foremost priority is to maintain the integrity and reliability of Trustblock. All decentralization efforts are being undertaken with careful consideration to ensure that they enhance, rather than compromise, the quality and trustworthiness of the platform.
### **Looking Ahead**
**Our Vision**
We envision Trustblock as a cornerstone of the decentralized Web3 ecosystemβa platform where trust is established through transparent, community-driven mechanisms rather than centralized control.
**Key Focus Areas**
* **Innovation:** Continuously exploring and integrating cutting-edge technologies that facilitate decentralization.
* **Collaboration:** Building strong partnerships with industry leaders, platforms, and community organizations to foster a robust ecosystem.
* **Education:** Promoting awareness and understanding of decentralization principles to encourage broader participation.
### **Join Us in Shaping the Future**
We invite you to be an active participant in Trustblock's journey toward decentralization. Your involvement is essential in shaping a platform that reflects the collective aspirations of the Web3 community.
**Get Involved**
* **Connect with Us:** Join our [Discord](https://discord.gg/sEYtryFFvX) to engage with the team and other community members.
* **Stay Updated:** Follow us on [X](https://x.com/TrustblockHQ) and [LinkedIn](https://www.linkedin.com/company/trustblockhq) for the latest news and updates.
* **Provide Feedback:** Share your thoughts and suggestions on our [community forum](https://discord.gg/sEYtryFFvX).
Decentralization is not just a feature but a fundamental principle that guides Trustblock's development. We are committed to navigating the challenges with transparency and integrity, and we believe that, together with the community, we can build a platform that sets new standards for trust and decentralization in the auditing ecosystem.
We look forward to your active participation and are excited about the possibilities that lie ahead.
Sincerely,
The Trustblock Team
*Note: This message is part of our ongoing commitment to transparency and collaboration. We appreciate your support and are eager to work together to achieve our shared goals.*
# Introduction
Source: https://docs.trustblock.run/introduction
Learn more about Trustblock
> Trustblock empowers auditors with a solution to share their audits transparently & deliver essential security data to the decentralized world.
## Core Features
Audits published on Trustblock are easily accessible, verifiable & tied to their auditors, thus saving users from scams and impersonators.
We calculate & display metrics for each auditors based on their published audits, thus allowing everyone to objectively evaluate them.
Our labels help users navigate through the web3 space securely by displaying essential & critical security to them thanks to our labels.
Trustblock makes audits reactive and intelligent objects usable by everyone & every off-chain or on-chain systems.
# Audit Provider (AP)
Source: https://docs.trustblock.run/roles/auditor
This section is dedicated to web3 expert dedicated to help secure web3 protocols.
## Why should I upload my audits on Trustblock?
The current state of web3 security is critical, with billions of dollars being drained from DeFi protocols through hacks and scams.
While audits are the most secure, community-regarded, and expected step for every protocol, finding the right auditor and ensuring the report's authenticity can be challenging.
Trustblock offers a solution that enhances web3 security by allowing auditors to publish their audits transparently, making them verifiable, immutable, and linked to smart contracts.
And it's **completely free** to use.
#### 1. Seamless publishing flow
We secure your reports and provide cutting-edge UI and CLI to publish your audits.
Learn how to publish an audit on Trustblock.
#### 2. Metrics
On top of that, we calculate verifiable and insightful metrics based on your audits' history.
These metrics can help you keep track of your business and enhance your reputation and prove your worth to your clients in a partial way while ensuring their communities you have the required experience and skills to succeed.
We build our product by keeping our auditors' partners' interest at best, and our top priority is to provide you with valuable tools relevant to your business and clients.
#### 3. Critical state monitoring
We are closer than ever to releasing a system allowing you to add unsafe contract state updates tracking upon audit publication. All you'll have to do is set up the transactions on which contracts and conditions our monitoring should be triggered and what should happen when our system is being triggered:
* Invalidate the audit automatically
* Raise a critical issue
* Send you an alert by email
This makes audits brighter than ever as they become reactive to smart contract changes. For example, your audit could automatically invalidate itself if a contract upgrade happens.
## How is it benefiting everyone in web3?
Uploading your audits also helps the whole web3 ecosystem by making your reports usable objects instead of isolated pdf files:
* **Labels**: Can be used on DEXes, AMMs, ICOs/Presales, and even wallets to give clear visual indicators of the health status of smart contracts that users interact with.
* **On-chain security data**: We can provide critical data to protocol directly within their smart contracts. Thus granting protocols with secured and dynamic connections between their smart contracts and others.
## How can I join Trustblock as an auditor?
The Trustblock team verifies all auditors.
Since we are relaying data to the whole ecosystem, ensuring that data isn't fraudulent is a priority. We will continue to approve auditors this way until we find a more decentralized approach that maintains high-security standards.
If you want to join, please complete [our onboarding form here](https://app.trustblock.run/sign-up?type=auditor).
As an auditor, you can also use labels, API and display your Trustblock's metrics widget on your website. Check the links below for more information.
Learn how to integrate Trustblock's metrics widget on your website.
Learn how to integrate Trustblock's labels on your website.
Learn how to integrate Trustblock's security data API on your website.
# Platform/Protocol (Integrator)
Source: https://docs.trustblock.run/roles/integrator
This section is dedicated to web3 apps & protocols that want to use Trustblock's data.
## Why should I integrate with Trustblock?
Audits hold data that is critical to everyone to web3.
Searching for the audit of a project is tedious and challenging, and dodging scams and impersonators is tedious and difficult.
We believe bridging audits and their critical data would drastically enhance people's experience on web3, saving them from poorly secured contracts and scams.
Moreover, it helps keep your users focused on what they expect to achieve when visiting your app and increases retention.
Here's how we can help you:
#### 1. Labels
We provide labels that can be used within your user interface to maximize user-friendliness.
Whatever your app's type, labels are an essential feature that makes your user journey more accessible and secure.
Whether you're a wallet, DEX, or market analysis tool, providing your users with the information they require is valuable in an ecosystem where due diligence is a process that only a few master.
Learn how to integrate our labels by clicking below:
Learn how to integrate Trustblock's labels on your website.
#### 2. Access security data
On top of that, we calculate verifiable and insightful metrics based on your audits' history.
With Trustblock, you can access a protocol's security data by fetching them from your contracts or off-chain system and by sending the address of the smart contract you want to obtain information on.
Here are some examples of applications:
* A secured DEX that only swaps tokens that have no critical issue
* A wallet that blocks transactions on non-audited contracts
* Secured LP that automatically converts their funds for a token that has an exploit
* Insurance protocol that checks on the fly if the contract requested for coverage by a user fulfills the protocol's internal security standards.
* And more...
Learn how to integrate our API by clicking below:
Learn how to integrate Trustblock's security data API on your website.
## How can I join Trustblock as an integrator?
The Trustblock team verifies all platforms.
Since we are relaying data to the whole ecosystem, ensuring that data isn't used maliciously is a priority. We will continue to approve platforms this way until we find a more decentralized approach that maintains high-security standards.
If you want to join, please complete the [onboarding form here](https://app.trustblock.run/sign-up?type=integrator).
# Searching for an auditor
Source: https://docs.trustblock.run/roles/project
This section is dedicated to web3 projects that want to find auditors for their projects.
## Why should I use Trustblock to find my auditor?
As of now, auditors are selected on a word-of-mouth/reputation basis.
We think it is suboptimal as audits are technical products, so projects should select auditors according to technical criteria.
Thanks to on-chain data, we calculate objective/relevant/verifiable metrics for auditors based on their previous audits.
Metrics allow you to pick an auditor according to your needs and expectations instead of randomly messaging auditors you've heard of.
Moreover, we provide a unique and straightforward search system to find the auditor that best fits your needs.
Trustblock is ready to assist you in matching with an auditor tailored to your project's specific needs at no charge. If you're interested in this personalized service, you're encouraged to fill out [the form to initiate the matchmaking process](https://forms.gle/YeEKWZqvdWjKMGQY6).
This support streamlines the auditor selection process, making it more efficient and tailored to your project's unique requirements, and does so without any financial commitment from you.
## Should I ask my auditor to publish my project's audit on Trustblock?
Having your audits on Trustblock increases trust between your team and your community.
We upload audits on IPFS, so they cannot be falsified and are unique and verifiable by anyone in a more open/transparent way. Your users no longer have to worry about your audit's origin.
They can check everything related to your audit, including the auditor.
Moreover, Trustblock is a relay for several platforms to know if a contract is audited.
Dexes, Presales, Charts, and Analytics use Trustblock's system to fetch a contract's audit.
This means that having it on our system increases your visibility and allows your project to be trustable by people that didn't hear about you yet.
## My audit is on Trustblock. Now, what?
Our network of platforms will display your audit labels every time their users deal with one of your contracts on another platform.
You can now add your audit label to your website using our widget.
Learn how to integrate Trustblock's labels on your website.
# Web3 User
Source: https://docs.trustblock.run/roles/user
This section is dedicated to web3 users who want to find audits for projects they use.
## What's in it for me?
As of today, audits can be pretty hard to find.
You can ask the community for the audit, but:
* You have to wait for a reply.
* The shared audit might be a fake PDF or a phishing website.
* You don't know if the reviewed code inside the audit is the same as the one deployed (the one you are going to send transactions to)
With Trustblock, you can verify audits on our platform:
* Audits are attached to smart contracts.
* Audits are attached to the auditors' wallets
* All audits have unique IDs, and auditors have unique addresses.
* You can search for an audit by name.
Audits published on our system are then used by other platforms. So when a project has an audit published on Trustblock, its visibility increases and is relayed by the rest of web3 as secured/verified.
## Can I help with the project?
Yes, and it is pretty straightforward.
You can ask the project team to provide an audit published on Trustblock for their smart contracts.
This will ensure that the smart contracts you use have been reviewed and secured by verified auditors while avoiding fake pdf reports and fake auditor websites.
# Create a new audit
Source: https://docs.trustblock.run/technical/endpoints/create-a-new-audit
post /v1/audit
Trustblock API route to create a new audit
# Get upload report authorization
Source: https://docs.trustblock.run/technical/endpoints/get-upload-report-authorization
GET /v1/auditor/upload-report-authorization
Trustblock API route to get upload report authorization
# Technical Guides
Source: https://docs.trustblock.run/technical/introduction
Learn how to use Trustblock
## Guides
Learn how to publish an audit on Trustblock.
Learn how to integrate Trustblock's metrics widget on your website.
Learn how to integrate Trustblock's labels on your website.
Learn how to integrate Trustblock's security data API on your website.
# Labels Widget
Source: https://docs.trustblock.run/technical/labels-widget
Trustblock labels are visual gateways to display the security state of a project on a website.
## Setup
Import the script to your website entry HTML file as follows:
```html
...
```
If you already know the project you want to display the label for and are not in a dynamic context, then you should use `data-tb-project-slug`.
Head to [app.trustblock.run](https://app.trustblock.run), find the project you want to get the label for, and copy the slug in the URL.
Then add the div to your website:
```html
```
**Parameters**
* `data-tb-project-widget` is a required parameter that allows the widget to be initialized.
* `data-tb-project-slug` is a required parameter that specifies the slug of the project you want to display the label for.
* `data-tb-color` is an optional parameter that specifies the color of the widget, can be `light` or `dark`.
* `data-tb-mode` is an optional parameter that specifies the sizing behavior of the widget, can be `fit` or `fill`.
If you are in a dynamic context, then you can either use:
* `data-tb-contract-evm-address` alongside with `data-tb-contract-chain`.
* or `data-tb-project-domain`.
Then add the div to your website:
```html
```
**Parameters**
* `data-tb-contract-evm-address` is a required parameter (if not using `data-tb-project-domain`) that specifies the EVM address of the contract you want to display the label for.
* `data-tb-contract-chain` is a required parameter (if not using `data-tb-project-domain`) that specifies the chain of the contract you want to display the label for. Check the list of [supported chains here](/technical/supported-chains).
* `data-tb-project-domain` is a required parameter (if not using `data-tb-contract-evm-address` and `data-tb-contract-chain`) that specifies the domain of the project you want to display the label for.
* `data-tb-color` is an optional parameter that specifies the color of the widget, can be `light` or `dark`.
* `data-tb-mode` is an optional parameter that specifies the sizing behavior of the widget, can be `fit` or `fill`.
#### [Give it a try on our playground](https://app.trustblock.run/widget/project)
# Metrics Widget
Source: https://docs.trustblock.run/technical/metrics-widget
Trustblock's metrics widget allows you to display your business metrics in a way that is easy to comprehend and engaging for your audience.
As an auditor, you can enhance transparency and foster trust in your business by utilizing Trustblock's metrics widget.
By integrating it into your website, you'll be able to present your business metrics in a way that is easy to comprehend and engaging for your audience.
This dynamic approach to data display will transform your raw numbers into compelling narratives, showcasing your business's strengths and fostering greater trust among your future clients.
## Setup
Import the script to your website entry HTML file as follows:
```html
...
```
Add the widget div anywhere you want on your website:
```html
...
```
**Parameters**
* `data-tb-auditor-widget` is a required parameter that allows the widget to be initialized.
* `data-tb-auditor-slug` is a required parameter that specifies the slug of the auditor you want to display the metrics for.
* `data-tb-text-color` is an optional parameter that specifies the color of the text in the widget and accepts a hex color code.
* `data-tb-bg-color` is an optional parameter that specifies the background color of the widget and accepts a hex color code.
* `data-tb-accent-color` is an optional parameter that specifies the accent color of the widget and accepts a hex color code.
#### [Give it a try on our playground](https://app.trustblock.run/widget/auditor)
# Step by step guide
Source: https://docs.trustblock.run/technical/publish
Trustblock's step by step guide to publish an audit
Head to [app.trustblock.run](https://app.trustblock.run) to sign in.
Click on your name at the top right of the screen.
At the bottom of your profile's page, you'll see a "Publish an audit" button redirecting you to the audit publication form once you click on it.
Follow the instructions on the form and submit it.
To publish an audit through our API, you must structure your data object in a specific way involving four parts: audit, issues, contracts, and project.
```typescript
// The full data structure of an audit
type FullAudit = {
...auditObject,
issues: issueObject[],
contracts: contractObject[],
project: projectObject
}
```
```typescript
// The audit data structure
type AuditData = {
// The audit data is at the first level of the full data object.
name: string, // The name of the audit
description: string, // The description of the audit
reportType: 'file' | 'web', // The type of the report
reportFileCid?: string, // The cid of the IPFS hosted report file
reportUrl?: string, // The URL of the report
conductedAt: number, // The date of the audit in seconds
}
```
The name and description expected here are not supposed to be the ones of the project audit. Still, the audit itself, e.g., If you audited the liquidity locker of a project named TokenA, the name of the audit would be Liquidity Locker.
To obtain a valid `reportFileCid`, you will have to perform an upload on our IPFS provider, Pinata.
In order to upload a file successfully, you will first have to fetch the necessary authorization to do so by calling our dedicated route.
Once you have retrieved your authorization response from the previous request, you must upload the file effectively.
```typescript
const uploadAuthResponse = // Request to the above route
// Get the response's data from the authorization route
const uploadAuth = uploadAuthResponse.data;
// Create a form data to send the file over to Pinata
const formData = new FormData();
formData.append('file', file);
formData.append('network', 'public');
// Perform a POST request on the URL sent by the authorization route
const uploadResponse = await axios.post<{ cid: string }>(uploadAuth.url, formData, {
maxBodyLength: Infinity,
headers: {
'Content-Type': `multipart/form-data;`,
}
});
// Here you get the reportFileCid needed by the publish audit route.
const reportFileCid = uploadResponse.data.cid;
```
If you want to publish an audit with a web based report, you will have to submit a valid URL through the `reportUrl` field.
Every issues have two attributes: status (`IssueStatus`) & severity (`IssueSeverity`).
An issue status can either be `fixed` or `not_fixed`.
An issue severity can either be `low`, `medium`, `high` or `critical`.
We know all auditors have different values for these fields; our goal was to simplify so that everyone can adapt their own system to ours.
The most important kind of issues are the `not_fixed` `critical` ones.
We are always welcoming suggestions, so don't hesitate to contact us!
```typescript
// The issues data structure
type Issue = {
name: string, // The name of the issue
description: string, // The description of the issue
status: IssueStatus, // The status of the issue
severity: IssueSeverity // The severity of the issue
}
```
> All your issues must be stored inside a list passed to the main request body.
Every contract has a type (`ContractType`) field, which can either be: `onChain`, `offChainPublic` or `offChainPrivate`.
Depending on the type, the contract must have different fields.
Additionally, to the type field, two other fields are required to submit an on-chain contract: `address` & `chain`.
`chain` can either be [one of the supported chains](/technical/supported-chains).
```typescript
// The on-chain contract data structure
type OnChainContract = {
type: 'onChain', // The type of the contract
chain: supported_chains, // The chain of the contract
address: 'string' // The address of the contract
}
```
A public repository contract needs three fields: `repositoryUrl`, `repositoryCommitHash` & `repositoryFilePath`.
```typescript
type OffChainPublicContract = {
type: 'offChainPublic', // The type of the contract
repositoryUrl: 'string', // The repository url of the contract
repositoryCommitHash: 'string', // The repository commit hash of the contract
repositoryFilePath: 'string' // The repository file path of the contract
}
```
A private repository contract needs one field: `name`.
```typescript
type OffChainPrivateContract = {
type: 'offChainPrivate', // The type of the contract
name: 'string' // The name of the contract
}
```
Our system will automatically check if the audit's project already exists in our database by relying on links.website.
```typescript
type Project = {
name: string, // The name of the project
description: string, // The description of the project
links: {
website: string, // The website URL of the project
twitter: string, // The twitter URL of the project (optional)
discord: string, // The discord URL of the project (optional)
telegram: string, // The telegram URL of the project (optional)
github: string, // The discord URL of the project (optional)
youtube: string, // The telegram URL of the project (optional)
linkedIn: string, // The discord URL of the project (optional)
},
tags: ['analytics', 'collectibles', 'finance', 'gaming', 'security', 'social', 'wallet', 'other'], // Pass as many values as relevant
chains: supported_chains[], // Pass as many values as relevant
}
```
`chain` can either be [one of the supported chains](/technical/supported-chains).
To make sure your request never fails, pass all the data needed to create a project, including `links`, `name`, `description`, `chains` and `tags`.
```typescript
type FullAudit = {
name: string, // The name of the audit
description: string, // The description of the audit
reportType: 'file' | 'web', // The type of the report
reportFileCid?: string, // The cid of the IPFS hosted report file
reportUrl?: string, // The URL of the report
conductedAt: number, // The date of the audit in seconds
issues: [
{
name: string, // The name of the issue
description: string, // The description of the issue
status: IssueStatus, // The status of the issue
severity: IssueSeverity // The severity of the issue
},
...
],
contracts: [
{
type: 'offChainPublic', // The type of the contract
repositoryUrl: string, // The URL of the repository, e.g. https://github.com/Uniswap/v3-core
repositoryCommitHash: string, // The commit hash of the repository, e.g. 4024732be626f4b4299a4314150d5c5471d59ed9
repositoryFilePath: string, // The path to the audited contract, e.g. contracts/NoDelegateCall.sol
} | {
type: 'onChain', // The type of the contract
chain: supported_chains, // The chain of the contract
address: 'string' // The address of the contract
} | {
type: 'offChainPrivate', // The type of the contract
name: 'string' // The name of the contract ; usually the contract file name
},
...
],
project: {
slug: string, // The slug of the project
domain: string // The domain of the project
//Only one of the above fields is required.
} | {
name: string, // The name of the project
description: string, // The description of the project
links: {
website: string, // The website URL of the project
twitter: string, // The twitter URL of the project (optional)
discord: string, // The discord URL of the project (optional)
telegram: string, // The telegram URL of the project (optional)
github: string, // The discord URL of the project (optional)
youtube: string, // The telegram URL of the project (optional)
linkedIn: string, // The discord URL of the project (optional)
},
tags: ['analytics', 'collectibles', 'finance', 'gaming', 'security', 'social', 'wallet', 'other'], // Pass as many values as relevant
chains: supported_chains[], // Pass as many values as relevant
}
}
```
Once you have structured your data object, you can send the request to our API.
***
## And then what?
That's it!
Your audit is published and now accessible through our system.
We refresh metrics on Trustblock every day at a fixed time, and as such, your profile should be updated pretty soon after publishing your audits with the newest metrics.
Learn how to integrate Trustblock's metrics widget on your website.
The audit you publish will now be available from labels and API. Check the links below for more information.
Learn how to integrate Trustblock's labels on your website.
Learn how to integrate Trustblock's security data API on your website.
# Security Data API
Source: https://docs.trustblock.run/technical/security-api
get /v1/project/security
A single route, infinite possibilities.
At Trustblock, we firmly believe in making things easy for everyone, thus our motivation to create one single route where you could access as much valuable data as possible for your own integrations.
Head to [app.trustblock.run](https://app.trustblock.run) to sign in.
Then click on the top right corner on your username, scroll down and click the copy button to get your API key.
# Supported Chains
Source: https://docs.trustblock.run/technical/supported-chains
The chain parameter is used globally all over Trustblock, here is a list of all available values for it.
Possible values:
* `ethereum`
* `polygon`
* `avalanche`
* `bnbchain`
* `arbitrum`
* `optimism`
* `fantom`
* `zksync`
* `base`
* `polygonZkEvm`
* `scroll`
* `blast`
* `starknet`
* `solana`
* `stellar`
* `sui`
* `tron`
* `injective`