Verify a stablecoin attestation report

1. Read totalSupply() on the token contract at a block on the report's as-of date, on every chain the issuer counts. Each result is in base units; divide it by ten to the power of the contract's decimals.
2. Download the issuer's attestation report from the issuer's own site, drop it into the check below, and confirm MATCH against the SHA-256 ReserveBeat stored when it captured the report.
3. Add up the supply across those chains and set it beside the tokens outstanding the report states, then beside the reserves it states. Differences in date, scope and chain list explain most gaps; the report's own notes name its scope.

What each check needs

• The chain, the anchors, the Merkle roots, the carried payloads and the storage proofs need only Python 3.10 or later, its standard library and the one pinned package in requirements.txt. Keccak-256 is built in.
• RFC 3161 timestamps need openssl on your PATH. Without it, every timestamp leg that holds a token counts as NOT VERIFIED and the run fails. A leg whose bundle stores no CA chain also counts as NOT VERIFIED unless you pass --tsa-ca with trust roots you choose, such as your system's CA bundle. The bundle run line below passes the Debian and Ubuntu path; on another system, give the path of its own CA bundle.
• OpenTimestamps proofs are counted, not checked. Checking one needs the ots client and a Bitcoin node; the --ots-dir option writes each proof beside the bytes it timestamps, ready for ots verify.

Run it

python3 -m venv .venv && .venv/bin/pip install --require-hashes -r requirements.txt
.venv/bin/python rb_verify.py bundle <bundle.zip> --tsa-ca /etc/ssl/certs/ca-certificates.crt
.venv/bin/python rb_verify.py storage-proof <payload.json>
.venv/bin/python rb_verify.py pdf <report.pdf> --record <seq> --bundle <bundle.zip>

Exit status 0 means every check that applies verified, 1 means at least one failed (every failure is listed), and 2 means the input could not be read. The closing banner prints only on exit 0. Records newer than the last daily anchor read PENDING: the banner counts them and says they are not yet timestamped, and once the oldest is more than 30 hours older than the bundle they are OVERDUE and the run fails.

A bundle prepares evidence for examination. It is not an attestation. Verifying one shows that the records, anchors and self-made payloads are the ones committed, in the order and at the times claimed. It does not show that the figures in the underlying documents are true.