> NETWORK / ATTESTATIONS

Zero Indexer attestations

Independent observations of the experimental shims and hubs serving Zcash wallets. Check their enclave evidence, connection certificates and software release status.

MAINNET · EXPERIMENTAL

Registered endpoints

A curated list, not an operator census

Fresh evidence + TLS matches

Both checks must pass within 15 minutes

Confirmed software releases

Requires an independent build baseline

Evidence and release status are separate. We can check signed enclave evidence and its connection certificate today. Endpoints without independently established build measurements remain release-unconfirmed.

Endpoint observations

Primary checks every 5 minutes · Canary every minute

Zec.rocks

shim

tee.unsafe.zec.rocks:443

Evidence verified

Enclave evidence: Verified
TLS certificate: Matched
Software release: Reproduced build matches

Running build: deploy-fdb613db-a606726Reproduced matchCommit a6067268a04d
Configured hub: hub.zcash.caution.coConfirmed by reproduced buildHub’s own check:Evidence verified Configuration does not prove live routing or hub availability.

Canary · additional observerSigned checks verified

Observed 2026-09-21 02:49:29 UTC · expires 2026-09-21 02:52:29 UTC

Last attempt 2026-09-21 02:46:42 UTC

Measurements & source

Measurements below describe the last attempt. Unsigned source claims are separate from the reviewed build and configuration evidence above.

Deployment source tag; pinned to the reviewed commit. Running build · reproduced match.

Reviewed source commit: a6067268a04d14f9821edf6c83d3bdd94dab3776

Confirmed by matching reproduced build. Configuration evidence ↗

PCR0: 8f916a556a1cc661d1738aa0410905f33d064f666d422515e0ce40cfbb841a3e6c3b4eda5f640ffd941df04c2bfb11c1
PCR1: 8f916a556a1cc661d1738aa0410905f33d064f666d422515e0ce40cfbb841a3e6c3b4eda5f640ffd941df04c2bfb11c1
PCR2: 21b9efbc184807662e966d34f390821309eeac6802309798826296bf3e8bec7c10edb30948c90ba67310f7b964fc500a
TLS certificate SHA-256: 58f59b8337351f39d0953b1610156fd47b36028bcb9f4ed06be3cf1c3c890d6e
Attestation document SHA-256: 1c758996772806fc9f65fc8dc183be6169d98ca5ccddf9caee87ccd7a0d98886
Claimed source commit · unverified metadata: a6067268a04d14f9821edf6c83d3bdd94dab3776
Signed timestamp: 2026-09-21 02:46:42 UTC
Last successful evidence and TLS check: 2026-09-21 02:46:42 UTC
Verifier: cipherscan-nitro-v1:ba0d0c57de673c8576c91a8730775a87575f5c10

Canary runs on CipherScan’s server. Its signing keys are pinned by CipherScan; the monitor itself is not enclave-attested. Both signatures, target evidence, reproduced measurements and TLS binding are checked separately.

Signed statement ↗Evidence ↗Public signing keys ↗Canary policy ↗Source & verification guide ↗

Registered source ↗Release baseline ↗Endpoint reference ↗Observation JSON ↗

Caution

hub

hub.zcash.caution.co:443

Evidence verified

Enclave evidence: Verified
TLS certificate: Matched
Software release: Unconfirmed

Build version: Source/build version not confirmed

Canary · additional observerAwaiting trusted build measurements

Last attempt 2026-09-21 02:46:42 UTC

Measurements & source

Measurements below describe the last attempt. Unsigned source claims are separate from the reviewed build and configuration evidence above.

PCR0: c4c173771f88508f409e22d8a0882255be7bf2263aaa4c7e2e5d97404a8ae0198c26e422d565f28b9b7eb1fd2f564d1c
PCR1: c4c173771f88508f409e22d8a0882255be7bf2263aaa4c7e2e5d97404a8ae0198c26e422d565f28b9b7eb1fd2f564d1c
PCR2: 21b9efbc184807662e966d34f390821309eeac6802309798826296bf3e8bec7c10edb30948c90ba67310f7b964fc500a
TLS certificate SHA-256: 691cf8070f997beeabf30ad34b6beffd84bf2bca977eabbf508b5af4cc1f8a0d
Attestation document SHA-256: 27bf445785c382e424f438e4bed0c42395afe5d3c30871cbb50cef402b96b235
Claimed source commit · unverified metadata: Not provided for the registered source
Signed timestamp: 2026-09-21 02:46:43 UTC
Last successful evidence and TLS check: 2026-09-21 02:46:42 UTC
Verifier: cipherscan-nitro-v1:ba0d0c57de673c8576c91a8730775a87575f5c10

Endpoint reference ↗Observation JSON ↗

What these checks tell you

01 · Fresh enclave evidence

Each check sends a new random challenge. We validate the signed response against the AWS Nitro trust root, check its timestamp and reject debug measurements.

02 · A matching connection

The domain and certificate fingerprint inside the signed evidence must match the HTTPS connection used by our observer.

03 · A separate software check

Release verification needs independently established build measurements. Valid evidence alone does not confirm the expected software or prove that the software is safe.

Canary adds signed observations for endpoints with reproduced build measurements, checked every minute and expiring after three minutes. It runs on CipherScan’s server with operator-pinned signing keys; Canary’s own runtime is not enclave-attested. Connection warnings remain visible even when a recent signed check passed.

These are periodic observations from CipherScan, not verification of your wallet’s connection. A passing shim does not establish its hub’s status. Build tags identify reviewed source commits. A matching reproduced configuration can confirm a shim’s configured hub, but does not prove live routing or hub availability. The monitor does not measure transaction privacy, batching or wallet service uptime.

Attestation methodology ↗Verify a build yourself ↗Public JSON API ↗