The on-chain certificate behind reputa.xyz: a soulbound ERC-721 that records a wallet's reputation score as a dated snapshot. Not tradeable, not transferable - on Reputa, reputation can't be bought, only proven.
Deployed on Base: 0x5e425f840a449a30f0a3a48d2fd6b694e227e623 (source verified)
- Soulbound: every transfer and approval path reverts. One badge per wallet,
tokenId = uint160(wallet). Re-certification updates the badge instead of minting a second one. - Server-signed vouchers (EIP-712): the contract only mints with a voucher signed by the
Reputa server, and only when
msg.senderis the certified wallet itself. Nobody can mint someone else's reputation. - Holds no funds, moves no funds: no payable function, no receive/fallback, zero external calls, no token approvals. The worst case of a leaked signer key is a wrong badge - never lost money. The signer is rotatable.
- No dependencies: compiles standalone with solc >= 0.8.24.
Seven independent checks, zero confirmed findings - full details in audit/:
| Check | Result |
|---|---|
| Slither (101 detectors) | 0 high, 0 medium |
| slither-check-erc (ERC-721) | conformant (soulbound reverts by design) |
| Solhint | 0 errors |
| EVM property tests (Ganache + viem) | 19/19 pass, 3 independent fuzz runs |
Foundry (forge test) |
17/17 pass incl. 2 fuzz properties x 512 runs |
| Aderyn (88 detectors) | 0 confirmed (2 flagged highs are contextual false positives, documented) |
| solc SMTChecker (CHC + z3, formal verification) | zero warnings across assert/overflow/underflow/divByZero/outOfBounds/balance |
forge test -vv # 17 tests, fuzzing included (no forge-std needed)
slither contracts/ReputaBadge.sol
solhint contracts/ReputaBadge.sol
solc contracts/ReputaBadge.sol --model-checker-engine chc \
--model-checker-targets "assert,underflow,overflow,divByZero,outOfBounds,balance" \
--model-checker-timeout 60000Don't trust, verify: reputa.xyz/audit.html
MIT