6 min read Updated May 9, 2026

Proof Verification

Tamandua attestations are designed to be independently verifiable. Anyone with an incident hash or transaction signature can confirm that an attestation exists on-chain without accessing the original telemetry.

Verification Methods

Via Solscan Explorer

The simplest verification method for non-technical users:

  1. Navigate to the Solscan URL provided with the attestation
  2. View the transaction details
  3. Expand the "Instruction Data" section
  4. Decode the Memo content as UTF-8 JSON

Example URL:

https://solscan.io/tx/5Uy3...?cluster=devnet

The decoded memo shows the attestation JSON:

{
  "t": "tamandua_attestation",
  "v": 2,
  "ih": "abc123...",
  "s": 4,
  "m": "T1555.003",
  "rh": "def456...",
  "ts": 1715180400
}

Via Solana CLI

For technical verification using the Solana CLI:

# Get transaction details
solana confirm -v 5Uy3...

# Decode transaction
solana transaction 5Uy3... --url devnet

# Parse memo data
solana transaction 5Uy3... --url devnet | jq '.transaction.message.instructions[].data' | base64 -d

Via Tamandua CLI

The Tamandua CLI includes verification commands:

# Verify by transaction signature
tamandua verify --tx 5Uy3abc...

# Output:
Attestation Verified
--------------------
Transaction:    5Uy3abc...
Block Time:     2025-05-08 12:00:00 UTC
Incident Hash:  abc123def456...
Severity:       High (4)
MITRE:          T1555.003
Confidence:     0.95
TLP:            AMBER
Status:         On-chain, Unverified

Solscan: https://solscan.io/tx/5Uy3...?cluster=devnet

# Verify by incident hash
tamandua verify --incident-hash abc123def456...

# Output:
Found 1 attestation(s) for incident hash

Attestation #1
--------------
Transaction:    5Uy3abc...
Block Time:     2025-05-08 12:00:00 UTC
Attester:       TaMANdua...
Verified:       No
Bounty Paid:    No

Via API

Tamandua Server provides verification endpoints:

# Verify attestation by alert ID
curl https://your-server/api/v1/alerts/{alert_id}/verify \
  -H "Authorization: Bearer $TOKEN"

{
  "data": {
    "verified": true,
    "on_chain": true,
    "tx_signature": "5Uy3...",
    "block_time": "2025-05-08T12:00:00Z",
    "incident_hash": "abc123...",
    "manifest_hash": "def456...",
    "solscan_url": "https://solscan.io/tx/5Uy3...?cluster=devnet"
  }
}

# Public verification (no auth required)
curl https://your-server/api/v1/public/verify/{incident_hash}

{
  "data": {
    "exists": true,
    "tx_signature": "5Uy3...",
    "block_time": "2025-05-08T12:00:00Z",
    "severity": 4,
    "mitre_technique": "T1555.003",
    "solscan_url": "https://solscan.io/tx/5Uy3...?cluster=devnet"
  }
}

Via Solana RPC

Direct verification using Solana RPC calls:

import { Connection, PublicKey } from '@solana/web3.js';

const connection = new Connection('https://api.devnet.solana.com');

// Get transaction
const tx = await connection.getTransaction('5Uy3abc...');

// Parse memo instruction
const memoInstruction = tx.transaction.message.instructions.find(
  ix => ix.programId.equals(new PublicKey('MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr'))
);

// Decode memo data
const memoData = Buffer.from(memoInstruction.data).toString('utf8');
const attestation = JSON.parse(memoData);

console.log('Attestation:', attestation);
// { t: 'tamandua_attestation', v: 2, ih: 'abc123...', ... }

Verification Response

A complete verification response includes:

{
  "verified": true,
  "on_chain": true,
  "attestation": {
    "type": "tamandua_attestation",
    "version": 2,
    "incident_hash": "abc123def456789...",
    "manifest_hash": "def456abc789...",
    "severity": 4,
    "mitre_technique": "T1555.003",
    "rule_hash": "789abc...",
    "org_pseudonym": "org123...",
    "agent_pseudonym": "agent456...",
    "timestamp": 1715180400,
    "ioc_count": 3,
    "ioc_types": ["hash_sha256", "domain"],
    "confidence": 0.95,
    "tlp": "amber",
    "threat_class": "infostealer"
  },
  "blockchain": {
    "tx_signature": "5Uy3abc...",
    "block_slot": 12345678,
    "block_time": "2025-05-08T12:00:00Z",
    "fee_lamports": 5000,
    "attester": "TaMANdua11111..."
  },
  "verification_status": {
    "bounty_paid": false,
    "verifier": null,
    "verified_at": null
  },
  "links": {
    "solscan": "https://solscan.io/tx/5Uy3...?cluster=devnet",
    "explorer": "https://explorer.solana.com/tx/5Uy3...?cluster=devnet"
  }
}

Timestamp Validation

Attestations include cryptographic timestamp proof:

  1. Incident Timestamp (ts): When the event was detected by Tamandua
  2. Block Time: When the transaction was confirmed on Solana

To validate timing:

from datetime import datetime, timedelta

incident_ts = datetime.fromtimestamp(attestation['ts'])
block_time = datetime.fromisoformat(verification['blockchain']['block_time'])

# Attestation should be published within reasonable window
latency = block_time - incident_ts

if latency > timedelta(hours=24):
    print(f"Warning: High latency ({latency})")
elif latency < timedelta(seconds=0):
    print("Error: Block time before incident time")
else:
    print(f"Valid: Attested {latency} after incident")

Typical latency:

  • Immediate mode: 1-60 seconds
  • Batch mode: 30 seconds to 5 minutes
  • Relay mode: 30 seconds to 15 minutes

Verifying Manifest Integrity

The manifest hash links to the full IOC manifest stored locally:

# Get the local manifest
curl https://your-server/api/v1/alerts/{alert_id}/manifest \
  -H "Authorization: Bearer $TOKEN"

{
  "manifest": {
    "schema": "tamandua.attestation_manifest",
    "version": 2,
    "iocs": [...],
    "...": "..."
  },
  "computed_hash": "def456...",
  "on_chain_hash": "def456...",
  "match": true
}

Verify locally:

import hashlib
import json

# Get manifest from API
manifest = {...}

# Compute hash
manifest_json = json.dumps(manifest, sort_keys=True)
computed_hash = hashlib.sha256(manifest_json.encode()).hexdigest()

# Compare with on-chain value
on_chain_hash = attestation['mh']
assert computed_hash == on_chain_hash, "Manifest tampered!"

Batch Verification

For batch attestations, verify the batch contains your incident:

{
  "t": "tamandua_batch",
  "v": 1,
  "n": 47,
  "h": [
    "abc123...",
    "def456...",
    "789ghi...",
    "..."
  ],
  "ts": 1715180400
}

Check if your incident hash is in the batch:

batch = json.loads(memo_data)
incident_hash = "abc123..."

if incident_hash in batch['h']:
    print(f"Incident attested in batch of {batch['n']} incidents")
    print(f"Position: {batch['h'].index(incident_hash) + 1}/{batch['n']}")
else:
    print("Incident not found in batch")

Anchor Program Verification

For attestations using the Anchor program (PDAs):

# Derive PDA address
tamandua verify --pda --incident-hash abc123...

# Output:
PDA Address: Attest123abc...
Account Exists: Yes
Data:
  Incident Hash:  abc123...
  Severity:       4
  MITRE:          T1555.003
  Verified:       false
  Bounty Paid:    false
  Attester:       TaMANdua...
  Created:        2025-05-08T12:00:00Z

Using Solana CLI:

# Get PDA address
solana-keygen pubkey --seed "attestation" --seed <incident_hash>

# Get account data
solana account <pda_address> --url devnet --output json

Verification Signatures

Attestations can be marked as verified by authorized verifiers:

// Check if attestation is verified
const attestation = await program.account.attestation.fetch(attestationPDA);

if (attestation.verified) {
  console.log('Verified by:', attestation.verifier.toString());
  console.log('Verified at:', new Date(attestation.verifiedAt * 1000));
} else {
  console.log('Not yet verified');
}

Verification adds trust:

  • Human reviewer confirmed the detection
  • External correlation validated the IOCs
  • Multi-org observation confirmed the threat

Integration Examples

Audit Report

def generate_audit_report(alert_ids):
    """Generate verification report for auditor."""
    report = []

    for alert_id in alert_ids:
        verification = verify_attestation(alert_id)

        report.append({
            'alert_id': alert_id,
            'on_chain': verification['on_chain'],
            'tx_signature': verification['tx_signature'],
            'block_time': verification['block_time'],
            'solscan_url': verification['links']['solscan'],
            'severity': verification['attestation']['severity'],
            'mitre': verification['attestation']['mitre_technique']
        })

    return report

Insurance Claim

def verify_for_insurance(incident_id, claim_window):
    """Verify incident occurred within claim window."""
    verification = verify_attestation(incident_id)

    incident_time = datetime.fromtimestamp(
        verification['attestation']['timestamp']
    )

    if incident_time < claim_window['start']:
        return {'valid': False, 'reason': 'Before policy start'}

    if incident_time > claim_window['end']:
        return {'valid': False, 'reason': 'After policy end'}

    return {
        'valid': True,
        'proof': {
            'tx_signature': verification['tx_signature'],
            'solscan_url': verification['links']['solscan'],
            'incident_time': incident_time.isoformat(),
            'severity': verification['attestation']['severity']
        }
    }

Treasury Gate

def check_signer_health(signer_agent_pseudonym, required_window_hours=24):
    """Verify signer endpoint has recent health attestation."""
    attestations = query_health_attestations(
        agent_pseudonym=signer_agent_pseudonym,
        after=datetime.utcnow() - timedelta(hours=required_window_hours)
    )

    if not attestations:
        return {'approved': False, 'reason': 'No recent health attestation'}

    latest = attestations[0]

    if latest['status'] == 'critical':
        return {'approved': False, 'reason': 'Critical alerts on endpoint'}

    if latest['status'] == 'at_risk':
        return {'approved': False, 'reason': 'High-severity alerts present'}

    return {
        'approved': True,
        'attestation': latest['tx_signature'],
        'health_status': latest['status'],
        'last_check': latest['timestamp']
    }

Next Steps