Verify it yourself

What the app checks on every loadCopy Anchor Link

• latest.json and the bundle it names carry the operator's Ed25519 signature, checked against the key built into the app (see file formats). Nothing unsigned is ever shown.
• The bundle's SHA-256 matches the hash latest.json names, and its sequence number matches too.
• Every chip the mint signs comes with a DLEQ proof against its published key for that amount, checked on your device before the chip is kept, so the mint can't sign your chips with a key meant to mark you.
• Every position certificate is checked against the operator key before it's saved.

Verify: your positionsCopy Anchor Link

The Verify page checks every position on this device and sends nothing anywhere:

• The certificate's signature against the operator key.
• Its price against what you accepted: the signed ask (or a parlay's price) is no more than the limit your order carried.
• The payout's arithmetic: stake ÷ ask gives the signed payout. A position you partly closed is replayed from its first signed terms through each reduce, which must land on the terms signed last.
• Parlays: the combined price from the legs' asks, and the payout.
• Its result, recomputed from the signed prints: the Line from the opening prints, then two of three closing votes, for Up/Down; two of three closing prints inside or outside the edges, for bands; each leg, for parlays.
• Its prints against the minute closes: each print must be the exchange's 1-minute close signed in the hourly files for the minute ending at the open or the close. The operator never revises a minute once recorded, so they agree exactly.
• What was paid against what was due.

A Window that settled more than 10 minutes ago has left the minute bundle; Verify recomputes it from its hour's prints file, which is published 12 minutes after that hour ends, and says so until then.

Proof: the public recordCopy Anchor Link

The Proof page shows the signed record anyone can check:

• the latest bundle's signatures and hash, and the link to the bundle before it: that file is fetched, its signature checked, and its SHA-256 compared with this bundle's previous, so a dropped or swapped minute shows;
• the pricing inputs and each asset's σ;
• the last settled Windows, each recomputed from its prints, and a button that recomputes every settlement in the last day's prints files, checking each print against the same files' 1-minute closes.

By handCopy Anchor Link

1. Fetch latest.json, its bundle and an hour's prints-YYYYMMDDHH.json from the data host.
2. Check each sig: Ed25519 over the file's canonical JSON with sig removed, the signature in base64url.
3. For a Window: compare each exchange's closing print with its opening print (exact decimals), and take two of three. You can fetch each exchange's own 1-minute candles to check the prints themselves.
4. For a price: ask = ⌈P·10⁴⌉ + 250 from the formula on Rules, and payout = ⌊stake·10⁴ / ask⌋ rounded down to 1,000 zatoshi.