Trace

View the live project · View the repository

Trace is a file-integrity tool built with Avail DA.

It explores a practical question: How can someone confirm that a file still matches the version originally published without asking the application that published it to be the source of truth?

Trace creates a SHA-256 fingerprint of a file inside the browser, publishes that fingerprint to Avail, and returns a receipt that can be used for verification later.

What It Does

Trace has two main flows:

• Register: Choose a file, create its fingerprint locally, publish the fingerprint to Avail, and download a receipt.
• Verify: Provide the file and receipt. Trace retrieves the original record from Avail and compares the fingerprints.

The file stays private. Its contents, name, size, and MIME type never leave the browser.

A matching fingerprint confirms that the file has not changed. It does not prove that the contents are true, legal, or owned by a particular person.

Why Avail Instead of a Database?

A database could store the same fingerprint and make it easier to search, update, or delete records.

The problem is that Trace would control both the application and the evidence. Anyone verifying a file would still have to trust that Trace had not changed the stored fingerprint.

Avail moves the publication record outside the application database. The receipt points to an exact finalized transaction, and Trace checks that transaction before trusting the fingerprint.

This makes Trace useful when the publisher and verifier are different people, organizations, or systems.

Use Cases

• Registering the final version of a contract before sharing it
• Verifying certificates received from another organization
• Checking reports distributed through multiple websites
• Confirming that a software release matches the registered version
• Preserving a reference for policies, approvals, and public documents

Architecture

File
  ↓
Browser creates SHA-256 fingerprint
  ↓
Trace publishes fingerprint to Avail
  ↓
User receives receipt

Later:

Receipt + local file
  ↓
Trace retrieves and validates the Avail transaction
  ↓
Browser creates a new fingerprint
  ↓
Trace compares both fingerprints

Trace uses a receipt-first design, so it does not need a database or search index. The receipt identifies the exact network, block, and transaction to verify.

Technical Highlights

• Browser-local SHA-256 hashing
• File size limit of 50 MiB
• Minimal versioned record containing only the fingerprint
• Server-funded transactions on Avail Turing testnet
• Exact block and transaction verification
• Sender and App ID validation
• Finality and execution checks
• Downloadable receipts and shareable verification links
• No document storage or application database
• Clear handling of failed, unavailable, and uncertain results

Trust Model

Trace V1 retrieves records through a configured Avail RPC. It does not currently run an Avail light client in the browser.

If the RPC is unavailable or cannot retrieve an old transaction, Trace reports that it cannot verify the receipt. It does not report a mismatch.

The App ID separates Trace records from other application data. Trace also checks the signing wallet because an App ID alone does not prove who submitted a record.

Related Work

Trace uses Avail to publish a shared reference outside the application’s database.

My Cartesi + RISC Zero integration explores how to prove that a computation was performed correctly.

Avail handles data publication and availability. RISC Zero handles proofs of computation. They solve different parts of the trust problem.