blocktools CLI
Claims
Every blocktools number and security claim, the command that measured it, and where it was measured.
Generated from docs/claims.toml by python3 scripts/claims-check.py --render; do not edit by hand.
docs-check fails on any quantitative doc claim not registered there, on a stale or failing measurement,
and on a macOS claim marked measured without a successful macOS CI job.
Measured
| id | kind | platform | status | statement | command | commit | date |
|---|---|---|---|---|---|---|---|
| fee-cap-evm-default | security | linux | measured | With no --max-fee, every signing route caps EVM total fee at 0.01 ETH-equivalent | cargo test -q --release -p blocktools --test fee_cap_paths |
1f1fa71 | 2026-10-26 |
| fee-cap-utxo-default | security | linux | measured | With no --max-fee, every signing route caps UTXO fee at max(100,000 base units, chain rate limit x vsize); 35 of 35 corpus sweeps pass (flat cap refused 9 of 35); cap+1 refused on each of 27 buildable chains; 240,000 sat on a 1-input BTC tx refused; fee over 10% of inputs refused without explicit --max-fee, 0 of 35 corpus sweeps trip it | cargo test -q --release -p blocktools-tx --test fee_cap_chains |
1f1fa71 | 2026-10-26 |
| scrypt-bounds | security | linux | measured | Keystore scrypt is bounded by 128Nr <= 256 MiB and Nrp <= 2^24; a hostile 8 GiB request is refused | cargo test -q --release -p blocktools-secrets --all-features -- scrypt_bounds hostile_kdf |
1f1fa71 | 2026-10-26 |
| prepush-2mb | security | linux | measured | prepush-check refuses any tracked file over 2 MB | sh scripts/gate-negatives.sh P-large |
1f1fa71 | 2026-10-25 |
| image-size-readme | number | linux | measured | Sealed runtime image (Dockerfile build, blocktools:local, 38 binaries: the 37 allowlisted tools plus sealed-run) is 46.1 MB = 46134784 bytes, measured on the image built from 727537d. Instrument: sum of the uncompressed layer tar sizes from docker save. Store: docker 29.8.2, containerd image store (Battleaxe daemon). On the same image, docker image inspect .Size is 77726450 bytes (store-dependent, reference only). Earlier measurements: 45328896 bytes at 8513317 (37 binaries, docker 26.1.5, overlay2 store) and 45451776 bytes at 4431115 (37 binaries, this containerd store); the step to 38 binaries is phrase-to-key (PR 1). Compare sizes only with the same instrument and store. | BLOCKTOOLS_DOCKER='sudo docker' sh scripts/image-size.sh --build |
727537d | 2026-10-26 |
| sealed-run-linux | security | linux | measured | ./blocktools run creates a container with network none, read-only rootfs, all capabilities dropped, read-only /in, and its agent output carries addresses and no secret material (Linux docker on Battleaxe, docker 29.8.2) | BLOCKTOOLS_DOCKER='sudo docker' sh scripts/sealed-check.sh |
727537d | 2026-10-26 |
| exports-reference-executed | security | linux | measured | docs/EXPORTS-reference.md is generated from executed wasm calls; its input limits (blake2b personalization <= 16 bytes, memo 1..80 bytes, AccountInfo 80 bytes, PDA seeds <= 32 bytes) are boundary-tested in test.mjs, and its example outputs (1.0 ETH value, 9.99 ETH fee at 475714.285714286 gwei) are the recorded outputs | sh scripts/wasm-check.sh |
1f1fa71 | 2026-10-25 |
| rpc-response-size-cap | security | linux | measured | rpc reads at most 8 MiB of any response and refuses a 3xx instead of following it (in-process mock, Linux box) | cargo test -q -p rpc --test cli redirect_not_followed_and_size_capped |
1f1fa71 | 2026-10-26 |
| rpc-wallet-sign-summary | number | linux | measured | The --allow-wallet-sign summary in docs/RPC.md (ERC-20 transfer, selector 0xa9059cbb, 68 bytes) is the code's own output for that request | cargo test -q -p rpc --lib summary_capture |
1f1fa71 | 2026-10-25 |
| rpc-deny-list | security | linux | measured | Secret export/import/unlock and wallet-signing methods exit 3 with a stable code and no request reaches the server; auth never appears in output (in-process mock, Linux box); fail closed: methods and paths outside the per-protocol read allowlist are refused with zero connections to a recording mock (17 unlisted methods, 3 REST paths, a mixed batch) | cargo test -q -p rpc |
1f1fa71 | 2026-10-26 |
| rpc-publicnode-read-linux | platform | linux | measured | Read-only eth_blockNumber and rpc eth height against https://ethereum-rpc.publicnode.com returned a block number (Linux 6.12.94+ x86_64 box, 2026-10-25 20:39 and 20:56 PDT; re-run 2026-10-26 00:18 PDT at e85721e); no broadcast was made |
echo '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}' | ./target/release/rpc https://ethereum-rpc.publicnode.com |
9c9cae0 | 2026-10-26 |
| forkid-signing | security | linux | measured | Fork-id sighash matches all 495 SIGHASH_FORKID rows of Bitcoin ABC sighash.json; BCH and BSV mainnet and Trust Wallet Core BTG signatures verify under it and not under the BTC sighash | cargo test -q --release -p blocktools-tx --test forkid |
1f1fa71 | 2026-10-26 |
| twc-evm-vectors | security | linux | measured | All 13 Trust Wallet Core EVM signer vectors (7 legacy EIP-155, 6 EIP-1559) parse, recover to their key and re-sign byte for byte | cargo test -q --release -p blocktools-tx --features secrets --test twc_evm |
1f1fa71 | 2026-10-26 |
| twc-message-vectors | security | linux | measured | Trust Wallet Core message-signer vectors: 4 Ethereum personal_sign and 3 Bitcoin signmessage signatures reproduced byte for byte, 6 Bitcoin verify vectors recovered, TWC negatives refused | cargo test -q --release -p blocktools-tx --features secrets --test twc_message |
1f1fa71 | 2026-10-26 |
| twc-cosmos-vectors | security | linux | measured | Trust Wallet Core Cosmos SDK MsgSend vectors (Cosmos Hub, Osmosis, Juno, Stargaze, Secret, Terra 2, Crypto.org, Injective x2, ZetaChain, Evmos and 20 address-only Cosmos hrps [TWC-signer-generated]) decoded, verified and re-signed byte for byte; TWC IBC, MsgVote and CosmWasm vectors refused | cargo test -q --release -p blocktools-acct --test twc_cosmos |
e8e9a1f | 2026-10-26 |
| twc-cosmos-addresses | security | linux | measured | 24 Cosmos SDK chain rows and 4 Ethermint rows (inj, evmos, canto, zeta) derive Trust Wallet Core's 0x46-key addresses, auto-detect uniquely, and match 23 TWC pubkey-to-address vectors | cargo test -q --release -p blocktools --test twc_cosmos_addr |
1f1fa71 | 2026-10-26 |
| exchange-staking-addresses | security | linux | measured | Firo EXX (Firo wiki published pair) and PIVX EXM / S staking addresses (chainparams versions) validate and auto-detect; no script is built for them | cargo test -q --release -p blocktools --test exchange_addr |
1f1fa71 | 2026-10-26 |
| bch-cashaddr-destinations | security | linux | measured | bch CashAddr (prefixed, bare, upper case) maps to the same output script as its legacy address; bad checksum, mixed case and bchtest are refused | cargo test -q --release -p blocktools-core --test cashaddr_script |
1f1fa71 | 2026-10-26 |
| evm-encode-packed | security | linux | measured | evmAbiEncodePacked / abi::encode_packed reproduce the Solidity ABI spec Non-standard Packed Mode examples and refuse tuples, nested arrays and arrays of dynamic types | cargo test -q --release -p blocktools-evm --test kat_packed |
1f1fa71 | 2026-10-26 |
| twc-ed25519-aptos-sui-near | security | linux | measured | aptos, sui, near, xtz and egld rows derive Trust Wallet Core's 0x46-key addresses, reproduce TWC's AptosKey/NearKey/DeriveMultiversX HD keys at the registry paths, and accept/refuse TWC's Aptos, Sui, Tezos and MultiversX address lists | cargo test -q --release -p blocktools --features secrets,ed25519 --test twc_ed25519 |
1f1fa71 | 2026-10-26 |
| tarball-glibc-floor | platform | linux | measured | The v0.1.0 linux-x86_64 tarball (SHA256SUMS ok) has 41 binaries in bin/; per binary, the newest GLIBC_ symbol version (objdump -T | grep -o GLIBC_ | sort -uV | tail -1) is GLIBC_2.34 for 40 tools and GLIBC_2.39 for sealed-run. Re-measured from the downloaded binaries, not from text. Not run on an older glibc |
Untested
| id | kind | platform | status | statement | command | commit | date |
|---|---|---|---|---|---|---|---|
| image-sealed-battleaxe | platform | docker | untested | Sealed run on Battleaxe at a15504d: build OK, 218 builder-stage tests pass, agent mode under --network none --read-only --cap-drop ALL prints seed and xprv as [REDACTED]; image inspect 56.2 MB (containerd image store). Reviewer report pasted by T, not reproduced by us | - |
- | - |
| image-size-battleaxe-reviewer | number | docker | untested | docker image inspect 56.2 MB on Battleaxe (containerd image store) at a15504d; reviewer report, not reproduced by us | - |
- | - |
| image-size-history | number | docker | untested | Historic image sizes in DESIGN (18.2, 40.4, 33.3 MB) | - |
- | - |
| redact-512 | number | linux | untested | Redacted JSON lines are at most 512 bytes | - |
- | - |
| read-file-64mib | number | linux | untested | read-file caps input at 64 MiB | - |
- | - |
| net-8mib | number | linux | untested | Network body cap 8 MiB, 30 s timeout | - |
- | - |
| tx-input-4mib | number | linux | untested | Transaction input limited to 4 MiB | - |
- | - |
| wasm-size | number | linux | untested | wasm module size and crate count | - |
- | - |
| armory-2mib | number | linux | untested | Armory reader limits | - |
- | - |
| wheels-23mb | number | linux | untested | Historic Python wheels size | - |
- | - |
| e2e-macos | platform | macos | untested | scripts/e2e-local.sh runs on Linux and macOS (macOS: last manual SwapChan run failed at tx-sign; no CI macOS job yet) | - |
- | - |
| chains-fee-figures | number | linux | untested | Per-chain fee figures quoted in CHAINS/ROADMAP (from mainnet samples; no re-run command) | - |
- | - |
| parity-1mb | number | linux | untested | ROADMAP-PARITY size figure | - |
- | - |
| format-constants | number | any | unmeasurable | Protocol/format sizes (hash and key lengths, OP_RETURN limits, dust, checksum bytes) | - |
- | - |
| prior-art | number | any | unmeasurable | Sizes quoted from third-party projects in a research note | - |
- | - |