Security & privacy
Privacy
- Nothing about the user is onchain until they choose to claim.
- The verification carries no provider, account name, or conditions — only a one-way
identityHash. identityHashcan't be reversed to the user's identity, and it's different per contract, so claims can't be correlated across apps.
What Base Verify enforces
- Eligibility is checked against the user's real credential, read from your contract's policy — users can't fake conditions.
- One identity, one claim, via the deterministic
identityHashyou dedupe on. - Verifications are bound to your contract and chain and expire quickly (~5 minutes).
- Only the signing wallet can submit a verification, so it can't be front-run out of the mempool (when you extend the provided base contract).
Testnet
Base Verify Onchain is in test and currently serves Base Sepolia only.
Your responsibilities
- Keep your policy (
provider/conditions) immutable. - Dedupe on
identityHashin your claim path. - Treat a claim as proof of a unique verified identity, not of any specific account or personal data.