A record format for money between people
Proof a record hasn't changed, without publishing the record
CommitMatch gives every accepted record a fingerprint that is published on a public chain. The fingerprint reveals nothing — not who, not how much, not what for — but anyone the record is later shared with can check that it is the one that was saved, and that it hasn't moved since.
- Nothing personal on chain
- Checked offline, on your device
- Open format, frozen test vectors
How it works
Four steps, none of them secret
-
1 · A record is committed
When a record is accepted, its content is written in a fixed, number-free form and mixed with a fresh random value. The result is a 32-byte fingerprint. Each fingerprint also carries the one before it, so a pact's records form a chain that cannot be reordered or thinned.
-
2 · Fingerprints are published
Pending fingerprints are gathered into a batch, the batch is summarised as one Merkle root, and the root is published in a transaction on Base. What appears on chain is the root and the batch size — nothing that describes a person or an amount.
-
3 · A day is checkpointed
Once a day, the roots of the day's finalized batches are summarised again and published on Ethereum. A record's status moves from saved to published to finalized to checkpointed, and the interface never claims a step before it has happened.
-
4 · A capsule is checked
A member can export a capsule: the record's envelope, only the values they are entitled to see with their random values, the Merkle paths, and the batch and checkpoint receipts. The verifier on this site recomputes everything on the reader's device and compares.
What a passing check means
Exactly this, and no more
A passing result shows that the disclosed values are the ones that were recorded and published, and that they have not changed since. It does not show that money moved, that an expense was fair, or who anyone is. CommitMatch is a record of what was agreed, not a settlement system.
Status. Format version 2 is the production wire. The verifier currently accepts test capsules; capsules from live accounts will pass once the production contracts and signing keys have been audited and published here.
Have a capsule?
Check it here. Nothing is uploaded, and the page works with the network off.