Pacta — Institutional Counterparty & On-Chain Commitment Index

Public Counterparty Snapshot Portal: https://pacta.wtf/
Machine-Readable Snapshot JSON (v1): https://pacta.wtf/api/v1/index.json
On-Chain Base Registry (pacta.base.eth): 0x35D21Bb4Df6586FE7759b5e57263ffeB3e1fd872 (Sourcify exact_match) · Base EAS Schema 0x7ff4...df83
Foundry Suite & Contracts: contracts/test/PactaGovernanceInvariants.t.sol · contracts/PactaCommitmentRegistry.sol · REMEDIATION_SERVICES.md

Pacta is the Protocol Commitments DRI at Fractal Neurons. We publish a deterministic, block-pinned Counterparty Control-Plane & Timelock Snapshot Index for institutional DeFi risk curators, vault allocators, underwriters, and protocol security teams — documenting how sampled proxy admins, TimelockController delays, RolesAuthority bitmasks, and Gnosis Safe thresholds compare against cited protocol documentation at specific Ethereum Mainnet block heights.

Free pre-execution API for AI agents (launch: $0, no API key, no wallet)

One call tells an agent who can upgrade, pause or blacklist a contract before it interacts with it: a verdict, a 0–100 risk score, the proxy / admin / timelock breakdown and the pinned block. Free during the launch at 60 requests / minute per caller.

• Remote MCP (zero install): claude mcp add --transport http pacta https://pacta-x402.pacta.workers.dev/mcp. Cursor and other clients: {"mcpServers": {"pacta": {"url": "https://pacta-x402.pacta.workers.dev/mcp"}}}. 5 read-only tools: pacta_check_preflight, pacta_scan_control_plane, pacta_scan_timelock_op, pacta_scan_proposal_diff, pacta_get_live_timelocks.

• One curl: curl -s "https://pacta-x402.pacta.workers.dev/v1/check/preflight?chain=ethereum&address=0xA35b1B31Ce002FBF2058D22F30f95D405200A15b"

• OpenAPI 3.1 (ChatGPT Actions, LangChain): openapi.json · agent skill SKILL.md · llms.txt · agent.json · mcp.json

• stdio from a clone: node packages/mcp-server/bin/pacta-mcp.mjs with PACTA_X402_URL=https://pacta-x402.pacta.workers.dev (packages/mcp-server; Docker: the root Dockerfile or packages/mcp-server/Dockerfile). The npm package is not published yet.

• Per-protocol safety records: pacta.wtf/protocols/

x402 v1 + v2 (USDC on Base) is wired in for metered use later; nothing to set up today. High-volume SLAs and on-chain EAS clearance: pacta.wtf/request/.

Related MCP server: contract-guard-mcp

Verification Architecture & Scope Separation

Each public record in the Pacta Index separates scanner archive replay from offline static verification and applies strict scope boundaries:

1. Cited Documentation & Governance Context:

   • Links to the public protocol documentation, deployment registries, or governance forum records evaluated for the sampled contracts at the time of the sprint.

2. Dual-RPC Scanner Archive Replay (pacta-claude / pacta-gemini):

   • Read-only eth_call and eth_getStorageAt checks pinned to an Ethereum Mainnet block height and canonical block hash, replayed across gateway.tenderly.co/public/mainnet and rpc.mevblocker.io for the sampled contracts and getters listed in each summary.

3. Offline Independent Static Verification (pacta-codex):

   • Isolated static review of 4-byte ABI selectors, EIP-55 address checksums, EIP-1967 storage slot derivations, raw-word decode arithmetic, and whole-token quarantine hygiene (the offline verifier container does not issue live network RPC calls).

4. Exploit-Sensitive Findings:

   • Directly callable state mutations, unrevoked legacy EOA authorities, and exploit-sensitive findings (disclosure_only) are excluded from public commits and feeds. Vulnerabilities go through the protocol's Immunefi or Cantina bounty programme, or to a partner audit firm under a 15% referral partnership. Do not submit security vulnerabilities in public GitHub issues.

On-Chain Anchoring on Base Mainnet (pacta.base.eth)

14 Sprints · 37 Indexed Records (14 parameter deltas · 4 protective deltas · 19 aligned baselines).

Sprints 1–16 carry 16 on-chain Base EAS sprint attestations: Sprints 1–12 in multi-attest tx 0x8c53e155a4b2f28ffbf069f1b65952fc8f7d81740f362b8aafb39493c6bd001b and Sprints 13–16 in multi-attest tx 0x11546aac53e3fe57fa6ac9f7e4397f06c58b6803252e099eb9349eca00f2edbf (Base block 57,032,413). Each attestation commits to the sprint's Ethereum block number, canonical block hash and summary SHA-256; Sprints 15–16 records join the public index after review. Every attested sprint summary is cryptographically anchored on Base Mainnet (Chain ID 8453) by our dedicated Tier-2 Attester (pacta.base.eth / 0xcA4E2ff22B69A7284210c47BdeE21Aac1269da09, governed by cold Tier-1 owner 0x4348DF1BEFAffcbA248B5118B1b782B1B2bdEd14):

• PactaCommitmentRegistry (Base Mainnet): 0x35D21Bb4Df6586FE7759b5e57263ffeB3e1fd872 · Sourcify exact_match

• Canonical Base EAS Schema (0x4200...0020): 0x7ff485bc1159dff3c70eefcb9dff2d65be990301760c2d53799e5a45e3badf83 (uint16 sprintId,uint64 chainId,uint64 blockNumber,bytes32 blockHash,uint8 verifiedCount,uint8 driftCount,bytes32 summarySha256,string prURI, as registered on Base)

• Official Basename: pacta.base.eth (forward + reverse L2 resolver verified on Base Mainnet)

Block-Pinned Public Sprint Summaries (Ethereum Mainnet)

14 Sprints · 37 Indexed Records. Site build: python3 tools/refresh_radar.py && python3 tools/onboarding_scan.py && python3 tools/build_site.py && python3 verify_site_v2.py (onboarding_scan.py writes docs/api/v1/onboarding.json, the single source of the live onboarding verification briefs at /briefs/<slug>/: every check is a block-pinned, two-endpoint cross-checked read, and role maps are replayed from event logs with each log verified against its receipt) (the canonical base URL is a single BASE_URL constant in tools/build_site.py; brief pages are rendered from tools/briefs_src/ inside the shared site chrome, and every call to action goes through the in-browser request builder at /request/).

Sprints 15 and 16 are attested on Base (0x967a...ff22, 0x217d...7e58); their summaries and records are published after review.

Running the Foundry Verification Suite

# 1. Deterministic offline unit & candidate-proposal gate suite
forge test --no-match-test "testFork" -vv

# 2. Full suite including block-pinned Ethereum Mainnet archive smoke tests
ETH_RPC_URL="https://gateway.tenderly.co/public/mainnet" forge test -vv

Analytics & privacy

pacta.wtf loads one first-party script, docs/b.js (under 1.5 KB, no dependencies; copy / call-to-action clicks are reported by docs/app.js through it), that sends anonymous page events (page load, protocol page view, 50% / 90% scroll, copy of the MCP URL / curl / SKILL.md link, primary call-to-action clicks, live-checker submits, 404s) with navigator.sendBeacon to Pacta's own gateway, https://pacta-x402.pacta.workers.dev/v1/telemetry/beacon. Each event carries only a redacted path, the referrer host, utm_source and a protocol slug or checked contract address. The path is one of a closed set (/, /protocols/, /protocols/<slug>/ for published pages only, /request/, /briefs/…, /404, /other). Every 404 is sent as /404, so an unknown URL is never sent as typed. A referrer is sent only if it is a public DNS name (never an IP address or a local / intranet host). The gateway re-applies the same rules before storing anything. No cookie is set and no identifier is stored in localStorage (the only stored value is your Paper / Slate theme choice), no third-party analytics are loaded, and browsers that send Do Not Track (navigator.doNotTrack = "1") send nothing. The gateway keeps aggregate counts only, with no raw IP, User-Agent, full referrer URL or query string. Its numbers are observed client metadata (User-Agent families, MCP clientInfo, beacon events): they are not verified humans and not revenue.

Access, Engagements & Contact

• Free and real-time for everyone: every indexed record, the timelock radar, pre-execution briefs, /api/v1/*.json and llms.txt are open to vault curators, allocators and AI risk agents with no key, delay or paywall. Curators never pay.

• 24h Collateral Onboarding & Delta Clearance Attestation — $5,000 USDC flat (optional continuous Aligned badge maintenance: $1,500 / month): for collateral issuers onboarding an asset or clearing a parameter_delta flag. Canonical block-pinned control-plane audit, GitBook / config reconciliation PR, Base Mainnet EAS Aligned attestation in PactaCommitmentRegistry, and a paste-ready Curator Diligence Dossier (PDF + JSON) for Morpho, Euler, Aave and Sky forum proposals. Pay in USDC on Base or Ethereum to the Pacta treasury 0x4348DF1BEFAffcbA248B5118B1b782B1B2bdEd14 (same address on both chains); request at pacta.wtf/request/. See REMEDIATION_SERVICES.md.

• Community queue: free, unscheduled (typically 6–8 weeks).

• Exploit-sensitive vulnerabilities: Immunefi / Cantina bounty programmes, or a partner audit firm (15% referral partnership) — never public issues.

• Organization: Fractal Neurons · @Fractal-Neurons

• Maintainer Account: @pacta-fractal-neurons

• Contact: pacta@dri.network