# DefiLoops release 0701f391805f: verification bundle This directory is the public record of one release of the DefiLoops agent stack: commit `0701f391805feee9990746bb5dcbd54dbe8a2c40` (branch `runs-rollout`), signed 2026-10-16T11:30:25Z. The repository is private. What is published is its hashes (the signed commit, tree and submodule pins, and an SBOM), the checks that ran before signing, the autonomous review's summary and the hash of its full report, and the FULL SOURCE of the on-chain parts only: the Solidity contracts, the deploy records and capability file, and the ERC-8004 agent cards. Every release is listed at https://defiloops.com/verify/ (machine-readable: https://defiloops.com/verify/releases.json). ## What is here | file | what it is | |---|---| | `statement.json` | the signed statement: commit, tree, submodule pins, the SBOM's sha256, the checks, and the review's summary (counts by severity, unresolved highs) with the sha256 of its full report | | `statement.sigstore.json` | its cosign signature (a Sigstore bundle; no transparency log) | | `sbom.spdx.json` | the SBOM (syft, SPDX) of the commit's whole tree | | `gate.txt` | what the gate (build, tests, vulnerability and lint scanners) reported | | `enclave/keeper-measurements.json` | the keeper enclave's expected AWS Nitro measurements (PCR0, PCR1, PCR2) | | `keys/` | the public release keys | | `source/` | the full source of the on-chain parts, at this commit | | `SHA256SUMS` | the sha256 of every file above | ## 1. Check the signature With [cosign](https://github.com/sigstore/cosign) v2 or later, for each key in `keys/` until one says `Verified OK`: ```sh cosign verify-blob --key keys/sha256-0f94ff99b58ff464bf002bb431c575c37c81b019a7878d1c1728087ae77e6921.pub --bundle statement.sigstore.json \ --insecure-ignore-tlog=true statement.json ``` `--insecure-ignore-tlog=true` is needed because the release is signed offline: nothing goes to Sigstore's public log. The keys in `keys/` come from the same commit, so compare their fingerprints with the ones listed at https://defiloops.com/verify/ before trusting them: ```sh openssl pkey -pubin -in keys/sha256-0f94ff99b58ff464bf002bb431c575c37c81b019a7878d1c1728087ae77e6921.pub -outform DER | sha256sum ``` The file name is that fingerprint. Keys of this release: - `sha256-0f94ff99b58ff464bf002bb431c575c37c81b019a7878d1c1728087ae77e6921` - `sha256-392431900b5e9b16f93939b5e7098c15f41103a5e53a1c0c8e4c02b3c5824e6d` ## 2. Check the SBOM and the other files ```sh sha256sum sbom.spdx.json # must equal statement.json's sbom.sha256: # fea7b8386862d0f98dc09cfae52a4177a9160b7ba85a7ab0f95c484789d4acf5 sha256sum -c SHA256SUMS # every file in this directory ``` The whole directory's IPFS CID can be recomputed with `ipfs add -r -n --cid-version=0 `. ## 3. The autonomous review Before this release was signed, several AI agents (claude-opus-5-5) reviewed its diff from the previous signed release (`12171da4a1ed998028f5efd5f48bfaca3f8e5bd0`): one pass for security and money movement, one for correctness, one for operations and supply chain, and one for the on-chain code when the diff touches it. A second, independent agent then tried to refute every finding and gave each a verdict: CONFIRMED, PLAUSIBLE or REJECTED. The signing script refuses to sign while a CONFIRMED high-severity finding is unresolved (not fixed, and not acknowledged in a committed file with a written reason). **The summary is in the signed statement** (`statement.json`, key `review`). Findings by severity and verdict: `{"high":{"CONFIRMED":0,"PLAUSIBLE":0,"REJECTED":0},"low":{"CONFIRMED":3,"PLAUSIBLE":0,"REJECTED":0},"medium":{"CONFIRMED":4,"PLAUSIBLE":0,"REJECTED":0}}`. Unresolved high: 0. Acknowledged high: 0. **The full report is withheld.** Its findings describe the code of a private repository. Its sha256 is signed in the statement, so anyone who is later handed the report can check that it is the one this release was signed with: ```sh sha256sum review.json # must equal statement.json's review.sha256: # bf94aec67cc2475622aec6ab4c2f6d34e65fa33359696eab2e13cffbd22775bb ``` **What this proves:** that the review ran on this release's diff, and found what the summary counts. **What it does not prove:** that the code is free of bugs. A model can miss things, and a reviewer reads a diff, not every line it touches. It is evidence, not a guarantee. ## 4. The enclave The keeper (the part that holds the agents' signing keys) runs in an AWS Nitro enclave. The enclave image recorded at this commit measures to `PCR0 = 896e972ba284caf8212842e44f9aee157b62edc27705ea3657d0d04e3c73964855307c67c47ba2508d67fe3d59753b6c` Any other code measures differently. The production AWS KMS key policy decrypts the keeper's keys only for an enclave whose attested PCR0 is on its list (during a rollout the list also holds the previous image's). ## 5. The container images The digests of the container images built from this commit are verified by our production box, against the same release keys, before it runs them. They are not published here. ## 6. The on-chain source `source/` holds these files exactly as they are at the commit (paths are the repository's). Nothing else of the repository is published: each path is on an explicit allowlist, and the publishing script refuses any other. - `contracts/lib/kernel.PINNED` - `contracts/remappings.txt` - `contracts/src/AccountKycForwarder.sol` - `contracts/src/AdapterCuration.sol` - `contracts/src/AdapterInstaller.sol` - `contracts/src/Agent.sol` - `contracts/src/AgentRegistry.sol` - `contracts/src/BaseAdapter.sol` - `contracts/src/NoExtraValidator.sol` - `contracts/src/OwnerMigrateDelegate.sol` - `contracts/src/PolicyExecutor.sol` - `contracts/src/PolicyGate.sol` - `contracts/src/ProtocolDeployer.sol` - `contracts/src/RentPositionForwarder.sol` - `contracts/src/RootBinding.sol` - `contracts/src/RootOwner.sol` - `contracts/src/SafeMigrateConnector.sol` - `contracts/src/UpgradeTimelock.sol` - `contracts/src/VersionRegistry.sol` - `contracts/src/adapters/AaveRevertAdapter.sol` - `contracts/src/adapters/AaveV3Adapter.sol` - `contracts/src/adapters/AaveV4Adapter.sol` - `contracts/src/adapters/AcrossAdapter.sol` - `contracts/src/adapters/CctpAdapter.sol` - `contracts/src/adapters/CowPresignAdapter.sol` - `contracts/src/adapters/DeleverageAaveV3Adapter.sol` - `contracts/src/adapters/DeleverageAaveV4Adapter.sol` - `contracts/src/adapters/DeleverageMorphoAdapter.sol` - `contracts/src/adapters/LeverageAaveV3Adapter.sol` - `contracts/src/adapters/LeverageAaveV4Adapter.sol` - `contracts/src/adapters/LeverageMorphoAdapter.sol` - `contracts/src/adapters/LoanCloseAdapter.sol` - `contracts/src/adapters/LoanShiftAdapter.sol` - `contracts/src/adapters/MorphoAdapter.sol` - `contracts/src/adapters/OwnerMigrateAaveV3Adapter.sol` - `contracts/src/adapters/OwnerMigrateMorphoAdapter.sol` - `contracts/src/adapters/OwnerTransferAdapter.sol` - `contracts/src/adapters/PropertyAdapter.sol` - `contracts/src/adapters/PullFromOwnerAdapter.sol` - `contracts/src/adapters/RentAdapter.sol` - `contracts/src/adapters/RevertFiAdapter.sol` - `contracts/src/adapters/RevertLeverageAdapter.sol` - `contracts/src/adapters/RevertRangeAdapter.sol` - `contracts/src/adapters/SafeExitAdapter.sol` - `contracts/src/adapters/SwapAdapter.sol` - `contracts/src/adapters/UniswapAdapter.sol` - `contracts/src/adapters/lib/FlashEngine.sol` - `contracts/src/adapters/lib/LoanHealth.sol` - `contracts/src/adapters/lib/UniTick.sol` - `contracts/src/generated/PolicyVerifier.sol` - `contracts/src/generated/Poseidon3.sol` - `contracts/src/validators/ERC1271RootValidator.sol` - `contracts/src/validators/GatedECDSAValidator.sol` - `contracts/src/validators/WebAuthnRootValidator.sol` - `deploy/addresses-base-mainnet.json` - `deploy/erc8004/agent-card.json` - `deploy/erc8004/agent-cards/eip155-8453-0x8004A169FB4a3325136EB29fA0ceB6D2e539a432-141335.json` - `deploy/erc8004/agent-cards/eip155-8453-0x8004A169FB4a3325136EB29fA0ceB6D2e539a432-145599.json` - `deploy/erc8004/agent-cards/eip155-8453-0x8004A169FB4a3325136EB29fA0ceB6D2e539a432-145600.json` - `deploy/erc8004/agent-cards/eip155-8453-0x8004A169FB4a3325136EB29fA0ceB6D2e539a432-145601.json` - `deploy/erc8004/agent-cards/eip155-8453-0x8004A169FB4a3325136EB29fA0ceB6D2e539a432-145602.json` - `deploy/erc8004/agent-cards/eip155-8453-0x8004A169FB4a3325136EB29fA0ceB6D2e539a432-145603.json` - `deploy/erc8004/agents/repay-and-withdraw.registration.json` - `deploy/erc8004/agents/supply-usdc-aave.registration.json` - `deploy/erc8004/agents/swap-then-supply.registration.json` - `deploy/erc8004/agents/swap-usdc.registration.json` - `deploy/erc8004/agents/withdraw-aave.registration.json` - `deploy/erc8004/capabilities.json` - `deploy/erc8004/registration.json` - `deploy/erc8004/well-known.json` - `deploy/manifest-base-mainnet.json` These files are not signed one by one: the signature covers the commit's tree hash, and checking one file against it would need directory listings that name private files. What ties the deployed contracts to this source is their public verification on Basescan and Sourcify. ### Deployed on Base (`deploy/addresses-base-mainnet.json` at this commit) | contract | address | verified source | |---|---|---| | adapter_curation | `0x63A1D7e97Fb9Ed3F4655494373cba9e684D291B5` | [Basescan](https://basescan.org/address/0x63A1D7e97Fb9Ed3F4655494373cba9e684D291B5#code), [Sourcify](https://repo.sourcify.dev/8453/0x63A1D7e97Fb9Ed3F4655494373cba9e684D291B5) | | adapters.aave_revert | `0xf4411DDDf943e0b69A68922AbC53e20647a96D61` | [Basescan](https://basescan.org/address/0xf4411DDDf943e0b69A68922AbC53e20647a96D61#code), [Sourcify](https://repo.sourcify.dev/8453/0xf4411DDDf943e0b69A68922AbC53e20647a96D61) | | adapters.aave_v3 | `0x77aa7539a03ecCf8eE3ECFe0A63E9e62DF81239d` | [Basescan](https://basescan.org/address/0x77aa7539a03ecCf8eE3ECFe0A63E9e62DF81239d#code), [Sourcify](https://repo.sourcify.dev/8453/0x77aa7539a03ecCf8eE3ECFe0A63E9e62DF81239d) | | adapters.aave_v4 | `0xE254A42Eb48A1Bf6dB8288f25fFC86aCAc59b011` | [Basescan](https://basescan.org/address/0xE254A42Eb48A1Bf6dB8288f25fFC86aCAc59b011#code), [Sourcify](https://repo.sourcify.dev/8453/0xE254A42Eb48A1Bf6dB8288f25fFC86aCAc59b011) | | adapters.across | `0x4C5c26452249aaBaD6276b4412F142C0f72bE564` | [Basescan](https://basescan.org/address/0x4C5c26452249aaBaD6276b4412F142C0f72bE564#code), [Sourcify](https://repo.sourcify.dev/8453/0x4C5c26452249aaBaD6276b4412F142C0f72bE564) | | adapters.cctp | `0x7eca43fBe6260753c1DaE575914Cf03347F7D4ab` | [Basescan](https://basescan.org/address/0x7eca43fBe6260753c1DaE575914Cf03347F7D4ab#code), [Sourcify](https://repo.sourcify.dev/8453/0x7eca43fBe6260753c1DaE575914Cf03347F7D4ab) | | adapters.cow_presign | `0xc9cB4CC5430391d301e19B018B8d57208b211D35` | [Basescan](https://basescan.org/address/0xc9cB4CC5430391d301e19B018B8d57208b211D35#code), [Sourcify](https://repo.sourcify.dev/8453/0xc9cB4CC5430391d301e19B018B8d57208b211D35) | | adapters.deleverage_aave_v3 | `0x15baB97c4Fc5A366824257dF6313a53eb9A700e2` | [Basescan](https://basescan.org/address/0x15baB97c4Fc5A366824257dF6313a53eb9A700e2#code), [Sourcify](https://repo.sourcify.dev/8453/0x15baB97c4Fc5A366824257dF6313a53eb9A700e2) | | adapters.deleverage_aave_v4 | `0xf4AFA080E5fee63163fd094dd18b347fdD66a0D1` | [Basescan](https://basescan.org/address/0xf4AFA080E5fee63163fd094dd18b347fdD66a0D1#code), [Sourcify](https://repo.sourcify.dev/8453/0xf4AFA080E5fee63163fd094dd18b347fdD66a0D1) | | adapters.deleverage_morpho | `0x05D25E7B8EB0863aA6F8f0626a8674665CC44D12` | [Basescan](https://basescan.org/address/0x05D25E7B8EB0863aA6F8f0626a8674665CC44D12#code), [Sourcify](https://repo.sourcify.dev/8453/0x05D25E7B8EB0863aA6F8f0626a8674665CC44D12) | | adapters.leverage_aave_v3 | `0x08cCA37C5E98Ad9f8F64a7598092434ec3aD99E1` | [Basescan](https://basescan.org/address/0x08cCA37C5E98Ad9f8F64a7598092434ec3aD99E1#code), [Sourcify](https://repo.sourcify.dev/8453/0x08cCA37C5E98Ad9f8F64a7598092434ec3aD99E1) | | adapters.leverage_aave_v4 | `0x6415C1EcFc69731090202569f5aBD482740b1A40` | [Basescan](https://basescan.org/address/0x6415C1EcFc69731090202569f5aBD482740b1A40#code), [Sourcify](https://repo.sourcify.dev/8453/0x6415C1EcFc69731090202569f5aBD482740b1A40) | | adapters.leverage_morpho | `0xe415fe7a119e8F7fD5bb6dfCC6f9CE291257b27A` | [Basescan](https://basescan.org/address/0xe415fe7a119e8F7fD5bb6dfCC6f9CE291257b27A#code), [Sourcify](https://repo.sourcify.dev/8453/0xe415fe7a119e8F7fD5bb6dfCC6f9CE291257b27A) | | adapters.loan_close | `0x40777838248653BF0A13E680350fB38D2fd3291c` | [Basescan](https://basescan.org/address/0x40777838248653BF0A13E680350fB38D2fd3291c#code), [Sourcify](https://repo.sourcify.dev/8453/0x40777838248653BF0A13E680350fB38D2fd3291c) | | adapters.loan_shift | `0xBC353402398411c2671c699738692928b49ee2EF` | [Basescan](https://basescan.org/address/0xBC353402398411c2671c699738692928b49ee2EF#code), [Sourcify](https://repo.sourcify.dev/8453/0xBC353402398411c2671c699738692928b49ee2EF) | | adapters.morpho | `0xf1A688243c12EDf7d6Bb3478E50C3A46AD5c85BE` | [Basescan](https://basescan.org/address/0xf1A688243c12EDf7d6Bb3478E50C3A46AD5c85BE#code), [Sourcify](https://repo.sourcify.dev/8453/0xf1A688243c12EDf7d6Bb3478E50C3A46AD5c85BE) | | adapters.owner_migrate_aave_v3 | `0x27acD0Bd7fb70856c6c58543C6024998980a3b07` | [Basescan](https://basescan.org/address/0x27acD0Bd7fb70856c6c58543C6024998980a3b07#code), [Sourcify](https://repo.sourcify.dev/8453/0x27acD0Bd7fb70856c6c58543C6024998980a3b07) | | adapters.owner_migrate_morpho | `0xf281692BEdfa2820D1D1c07313EdA36386d5E6D5` | [Basescan](https://basescan.org/address/0xf281692BEdfa2820D1D1c07313EdA36386d5E6D5#code), [Sourcify](https://repo.sourcify.dev/8453/0xf281692BEdfa2820D1D1c07313EdA36386d5E6D5) | | adapters.owner_transfer | `0x82c2f23A1484d1c6C6e8b28D74E6b0E775c7A481` | [Basescan](https://basescan.org/address/0x82c2f23A1484d1c6C6e8b28D74E6b0E775c7A481#code), [Sourcify](https://repo.sourcify.dev/8453/0x82c2f23A1484d1c6C6e8b28D74E6b0E775c7A481) | | adapters.property | `0xd08125495Cf32d67C6B7c428879147e32df15456` | [Basescan](https://basescan.org/address/0xd08125495Cf32d67C6B7c428879147e32df15456#code), [Sourcify](https://repo.sourcify.dev/8453/0xd08125495Cf32d67C6B7c428879147e32df15456) | | adapters.pull_from_owner | `0x719682F780Bb771e625110443D94da1a01f2b5B1` | [Basescan](https://basescan.org/address/0x719682F780Bb771e625110443D94da1a01f2b5B1#code), [Sourcify](https://repo.sourcify.dev/8453/0x719682F780Bb771e625110443D94da1a01f2b5B1) | | adapters.rent | `0xD7382084f9398c077673d47DF0DA7894a0f3fA40` | [Basescan](https://basescan.org/address/0xD7382084f9398c077673d47DF0DA7894a0f3fA40#code), [Sourcify](https://repo.sourcify.dev/8453/0xD7382084f9398c077673d47DF0DA7894a0f3fA40) | | adapters.revert_fi | `0xA79507EB07FE6788d57BDCE0D2a62B74963B577B` | [Basescan](https://basescan.org/address/0xA79507EB07FE6788d57BDCE0D2a62B74963B577B#code), [Sourcify](https://repo.sourcify.dev/8453/0xA79507EB07FE6788d57BDCE0D2a62B74963B577B) | | adapters.revert_leverage | `0xe425cA950EFfC6d13d96fBcE84B21109Fbe85Ecd` | [Basescan](https://basescan.org/address/0xe425cA950EFfC6d13d96fBcE84B21109Fbe85Ecd#code), [Sourcify](https://repo.sourcify.dev/8453/0xe425cA950EFfC6d13d96fBcE84B21109Fbe85Ecd) | | adapters.revert_range | `0xe737DD928F8164C51CE9dae8Ab0aBB5FaC578e1F` | [Basescan](https://basescan.org/address/0xe737DD928F8164C51CE9dae8Ab0aBB5FaC578e1F#code), [Sourcify](https://repo.sourcify.dev/8453/0xe737DD928F8164C51CE9dae8Ab0aBB5FaC578e1F) | | adapters.safe_exit | `0xde2857cB6E3423a33D31E654617Ca30B0e774f8E` | [Basescan](https://basescan.org/address/0xde2857cB6E3423a33D31E654617Ca30B0e774f8E#code), [Sourcify](https://repo.sourcify.dev/8453/0xde2857cB6E3423a33D31E654617Ca30B0e774f8E) | | adapters.swap | `0x6DF18D9FD0A3242a3fbe3EE8253dB59A1183aBAF` | [Basescan](https://basescan.org/address/0x6DF18D9FD0A3242a3fbe3EE8253dB59A1183aBAF#code), [Sourcify](https://repo.sourcify.dev/8453/0x6DF18D9FD0A3242a3fbe3EE8253dB59A1183aBAF) | | adapters.uniswap | `0xB9D93870Ba22A97f3A58D4f78Cf9CF3341162BCD` | [Basescan](https://basescan.org/address/0xB9D93870Ba22A97f3A58D4f78Cf9CF3341162BCD#code), [Sourcify](https://repo.sourcify.dev/8453/0xB9D93870Ba22A97f3A58D4f78Cf9CF3341162BCD) | | agent | `0xa5a3450Cb304Fbb4293ef97B1a944D9E13BaC586` | [Basescan](https://basescan.org/address/0xa5a3450Cb304Fbb4293ef97B1a944D9E13BaC586#code), [Sourcify](https://repo.sourcify.dev/8453/0xa5a3450Cb304Fbb4293ef97B1a944D9E13BaC586) | | installer | `0x064BcBC2294ee29aB823D7052b3a4275d8554Baa` | [Basescan](https://basescan.org/address/0x064BcBC2294ee29aB823D7052b3a4275d8554Baa#code), [Sourcify](https://repo.sourcify.dev/8453/0x064BcBC2294ee29aB823D7052b3a4275d8554Baa) | | policy_executor | `0xE4B4fc5F5B5FD5354258aa5D4c7B16000f33a088` | [Basescan](https://basescan.org/address/0xE4B4fc5F5B5FD5354258aa5D4c7B16000f33a088#code), [Sourcify](https://repo.sourcify.dev/8453/0xE4B4fc5F5B5FD5354258aa5D4c7B16000f33a088) | | policy_gate | `0x9972847c5D3dEAd7a97c1f18747cCB32396bE804` | [Basescan](https://basescan.org/address/0x9972847c5D3dEAd7a97c1f18747cCB32396bE804#code), [Sourcify](https://repo.sourcify.dev/8453/0x9972847c5D3dEAd7a97c1f18747cCB32396bE804) | | policy_verifier | `0xBFa8eF771A1Ea0ef281aa1f51E703bD05a25Ff7B` | [Basescan](https://basescan.org/address/0xBFa8eF771A1Ea0ef281aa1f51E703bD05a25Ff7B#code), [Sourcify](https://repo.sourcify.dev/8453/0xBFa8eF771A1Ea0ef281aa1f51E703bD05a25Ff7B) | | poseidon3 | `0xfDDa22866aA5f8229666DE6A3561ef0EA150605f` | [Basescan](https://basescan.org/address/0xfDDa22866aA5f8229666DE6A3561ef0EA150605f#code), [Sourcify](https://repo.sourcify.dev/8453/0xfDDa22866aA5f8229666DE6A3561ef0EA150605f) | | proxy_deployer | `0xAb03F0B353F010B5884922d885c411B1C2f46a37` | [Basescan](https://basescan.org/address/0xAb03F0B353F010B5884922d885c411B1C2f46a37#code), [Sourcify](https://repo.sourcify.dev/8453/0xAb03F0B353F010B5884922d885c411B1C2f46a37) | | registry | `0x186F92092a3965f43e21BC212A35fa22633c3bd6` | [Basescan](https://basescan.org/address/0x186F92092a3965f43e21BC212A35fa22633c3bd6#code), [Sourcify](https://repo.sourcify.dev/8453/0x186F92092a3965f43e21BC212A35fa22633c3bd6) | | version | `0x63125879b83d7d1e03bFc3A05b40fa8819d8FE46` | [Basescan](https://basescan.org/address/0x63125879b83d7d1e03bFc3A05b40fa8819d8FE46#code), [Sourcify](https://repo.sourcify.dev/8453/0x63125879b83d7d1e03bFc3A05b40fa8819d8FE46) | The registry, installer, agent, policy gate and curation entries are proxies: explorers show the verified implementation behind each. Not listed: `adapters.bridge`, a test fixture for forks, whose recorded address has (and must have) no code on Base.