Version 2 verification scope

TOKN 2 was reviewed by a separate AI security reviewer and tested locally before live deployment. This is not an independent professional audit or a guarantee that every defect has been found. Public contract addresses, deployment transactions, the 100 TOKN self-bond and the operator-controlled work example are available in /v2-receipts.json.

The production Solidity bytecode is compiled with pinned solc 0.8.36, optimizer 200 runs and Paris EVM target. Contract tests exercise exact escrow balances, refunds, timeout fallbacks, permission and replay rejection, signature domains, reentrant and rejecting recipients, staking reward caps, strict council quorum, penalty freezes, full-slash recovery and repeated evidence hashes. EVM time advancement exercises the full production seven-day and 28-day conditions.

An isolated Besu 26.8.1 network first staked 100 TOKN and completed the work example. Its future-height transition activated contract validator selection at block 362, retained its original genesis and historical block hashes, disabled header-voting RPC and survived restart. A separate stopped-state clone then exercised admission of a second distinct validator key, two-signature blocks, removal, a 25 TOKN manual penalty, rejection of early exit and withdrawal of the remaining 75 TOKN. Both keys were controlled by the test operator.

The clone used the unchanged production contract with libfaketime applied only to its two Docker containers. This validates transitions under accelerated wall clock and actual Besu membership changes. It does not prove seven-day real-time liveness, independent governance, sustained availability or Byzantine resistance. The original QA node was stopped throughout the clone run; the clone was stopped before the original resumed. No live key or live chain was used for this test.

Selected isolated Besu transaction receipts:

• register: 0xaddb4a30a0ec7763c17bd263f5661a04e1faa8830c90cbc6e99ecb3669de2390 at block 483.
• propose-admit: 0x7a255c5209eb95b2ad51569173ef268273a9d47f3c62a47b1d71a15dd1533759 at block 484.
• execute-admit: 0x37de32f32a23fc74efa4803ba216ea803e31c7af90af584565eb80a316f5a127 at block 546.
• propose-remove: 0x8429a23b9a46c9d93f68bdaafec947620f3c30edef3c5bb4fc0b8a081c79b261 at block 549.
• approve-remove: 0x83693e91564b539b011401fb8d0ba3b9e39ed91653b229b7fd46c79a1f8486cc at block 551.
• execute-remove: 0x448d5fca92ae4c5061691bd0148165ca1a9997281a7fac3e8a21106e950a7312 at block 636.
• propose-penalty: 0x1acaa50f0bb59b6835f7dc45bcb8117b05527f45bf7039ef46c33f970b75a185 at block 639.
• execute-penalty: 0x335642cc0fc77555485c0022b87d96ad2c10a73ab8cdfa12b23b964f22f94d7d at block 657.
• withdraw: 0x12c744e227ba6bd451b197d5dfe677bf251b070fee54273ebb898b80694277c4 at block 688.

A real Chromium browser then signed ten transactions on ordinary isolated Besu: funded creation, worker acceptance, local file hashing, delivery, approval, withdrawal, dispute and named-arbitrator resolution. A wrong-chain wallet was rejected. Desktop and 390-pixel mobile pages were checked. Signing checks bind both providers to chain/genesis and deployed code; browser and CLI journals retain exact transaction intent for safe retries. Native HTML form submission is blocked by CSP even if JavaScript fails to load.

The live gate separately verifies creation transaction input against compiled bytecode and constructor arguments, runtime hashes, the 100 TOKN self-bond, liabilities, unchanged fixed supply/reserves, actual QBFT selection, historical hashes, restart persistence and the administrative replica. A matching RPC set alone is not treated as proof of activation: header voting must also be disabled after the scheduled configuration transition.