Zero Indexer attestations

Independent observations of the experimental shims and hubs serving Zcash wallets. Check their enclave evidence, connection certificates and software release status.

MAINNET · EXPERIMENTAL

Registered endpoints: 2
Evidence + TLS verified: 2
Software releases matched: 1

Valid enclave evidence and a matching connection do not confirm the software release. Each check is reported separately.

ENDPOINT_OBSERVATIONS

Primary · 5 min / Canary · 1 min

Zec.rocks

shim

tee.unsafe.zec.rocks:443

Evidence verified

Enclave evidence: Verified
TLS certificate: Matched
Software release: Reproduced build matches

Canary observerSigned checks verified

Observed 2026-11-15 16:54:37 UTC · expires 2026-11-15 16:57:37 UTC

Last attempt 2026-11-15 16:53:39 UTC

Build, configuration & evidence

Running build: deploy-fdb613db-e0c834cReproduced matchCommit e0c834cc9f15
Configured hub: hub.zcash.caution.coConfirmed by reproduced buildConfigured address 54.151.176.23:443:Endpoint unreachableDeployment at this hub’s DNS name:Evidence verified Evidence at the configured address does not prove live routing.

Measurements below describe the last attempt. Unsigned source claims are separate from the reviewed build and configuration evidence above.

Deployment source tag; pinned to the reviewed commit. Running build · reproduced match.

Reviewed source commit: e0c834cc9f1554f04c489639ce377ea0408d417e

Confirmed by matching reproduced build. Configuration evidence ↗

PCR0: 0dc77beee945df52dc872218f89edd51eb3f437275c97be0fc5ed921e87f30826f2823ca6702e0a92a867aec2b1f1f02
PCR1: 0dc77beee945df52dc872218f89edd51eb3f437275c97be0fc5ed921e87f30826f2823ca6702e0a92a867aec2b1f1f02
PCR2: 21b9efbc184807662e966d34f390821309eeac6802309798826296bf3e8bec7c10edb30948c90ba67310f7b964fc500a
TLS certificate SHA-256: 0c851ce60d2f21f181d0c2e69051def2ec6715c5b6c59c5f3f883f0378a5d244
Configured hub address TLS certificate SHA-256: Not available
Attestation document SHA-256: abcb9df93950d431eed3b493300ec4a3e202ac01af00e7f607e7de98519db4a9
Claimed source commit · unverified metadata: e0c834cc9f1554f04c489639ce377ea0408d417e
Signed timestamp: 2026-11-15 16:53:39 UTC
Last successful evidence and TLS check: 2026-11-15 16:53:39 UTC
Verifier: cipherscan-nitro-v1:ba0d0c57de673c8576c91a8730775a87575f5c10

Canary runs on ZecBlock’s server. Its signing keys are pinned by ZecBlock; the monitor itself is not enclave-attested. Both signatures, target evidence, reproduced measurements and TLS binding are checked separately.

Signed statement ↗Evidence ↗Public signing keys ↗Canary policy ↗Source & verification guide ↗

Registered source ↗Release baseline ↗Endpoint reference ↗Observation JSON ↗

Caution

hub

hub.zcash.caution.co:443

Evidence verified

Enclave evidence: Verified
TLS certificate: Matched
Software release: Unconfirmed

Canary observerAwaiting trusted build measurements

Last attempt 2026-11-15 16:53:39 UTC

Build, configuration & evidence

Build version: Source/build version not confirmed

Measurements below describe the last attempt. Unsigned source claims are separate from the reviewed build and configuration evidence above.

PCR0: e868aa04f0275bde2253c1116a4abb6c7a612ca617c7422f34388aea1d695eb1efb0e17d890e1008b46bef930915c359
PCR1: e868aa04f0275bde2253c1116a4abb6c7a612ca617c7422f34388aea1d695eb1efb0e17d890e1008b46bef930915c359
PCR2: 21b9efbc184807662e966d34f390821309eeac6802309798826296bf3e8bec7c10edb30948c90ba67310f7b964fc500a
TLS certificate SHA-256: 50b65b23a22c516aab53388e64cb279e0bfcccebbfda66ea28d78b60a14dd5c8
Attestation document SHA-256: 6c303a254913cce3fcaf1014e48ba5dd3d0c0fdf48b5b441b90b9a3d3b55cc9e
Claimed source commit · unverified metadata: Not provided for the registered source
Signed timestamp: 2026-11-15 16:53:39 UTC
Last successful evidence and TLS check: 2026-11-15 16:53:39 UTC
Verifier: cipherscan-nitro-v1:ba0d0c57de673c8576c91a8730775a87575f5c10

Endpoint reference ↗Observation JSON ↗

Methodology & limitationsEvidence, software measurements and observer trust.

01 · Fresh enclave evidence

Each check sends a new random challenge. We validate the signed response against the AWS Nitro trust root, check its timestamp and reject debug measurements.

02 · A matching connection

The domain and certificate fingerprint inside the signed evidence must match the HTTPS connection used by our observer.

03 · A separate software check

Release verification needs independently established build measurements. Valid evidence alone does not confirm the expected software or prove that the software is safe.

Canary adds signed observations for endpoints with reproduced build measurements, checked every minute and expiring after three minutes. It runs on ZecBlock’s server with operator-pinned signing keys; Canary’s own runtime is not enclave-attested. Connection warnings remain visible even when a recent signed check passed.

These are periodic observations from ZecBlock, not verification of your wallet’s connection. A passing shim does not establish its hub’s status. Build tags identify reviewed source commits. A matching reproduced configuration can confirm a shim’s configured hub, but does not prove live routing or hub availability. The monitor does not measure transaction privacy, batching or wallet service uptime.

Attestation methodology ↗Verify a build yourself ↗Public JSON API ↗