A-5 immutable 実値 検証（追試・改ざん可）A-5 Immutable-values verification (re-runnable, tamperable)

immutable 実値の検証 — 改ざん可、ブラウザ内で完結Immutable-values verification — tamperable, in your browser  v3

A-5Sepolia · Base · Arbitrumeth_call

A-1 が伏せた immutable の実値を読み、正規アドレス（LZ エンドポイント＝信頼の根、内部配線）を指すか eth_call で照合します。
「わざと壊す」で全期待値を改変すると実際に赤くなります＝always-pass ではありません。Reads the actual immutable values that A-1 zeroed out and checks via eth_call whether they point to the canonical addresses (the LZ endpoint = trust root, and internal wiring).
Sanity-break tampers all expected values and actually turns it red — it is not always-pass.

方法A（おすすめ）：下の「検証する」を押すだけ。3チェーンの全 7 OApp の endpoint と内部配線（cawProfile／externalSelf）を自動取得し、正準値との照合まで完結します。「わざと壊す」で実際に赤くなることも確認できます。Method A (recommended): just press Verify. It fetches the endpoint of all 7 OApps across 3 chains plus the internal wiring (cawProfile／externalSelf) and checks them against the canonical values in one step. Sanity-break confirms it really goes red.

方法B：コマンドで確認（自分のノードで完結・貼り付け不要）Method B: confirm via command (all on your own node, no paste)

自動取得（方法A）が拡張機能などで塞がれても、ノードで実行して出力を期待値と見比べるだけで確認できます。下の ethers と curl は同じことを別ツールでやる代替です（順番ではありません・どちらか一方で OK）。Even if auto-fetch (Method A) is blocked by an extension, you can run it on your node and compare the output against the expected values. The ethers and curl commands below are two alternative ways to do the same thing (not sequential — either one is fine).

自動取得が弾かれる場合は、下のコマンドで直接確認できます（返り値が期待アドレスと一致すれば OK）。If auto-fetch is blocked, confirm directly with the commands below (each return must match the expected address).

ethers v6（自分のノードの client ディレクトリで実行・先頭の cd は自分のパスに置き換え）ethers v6 (run in your node’s client dir — replace the leading cd with your own path)：

cd /var/www/あなたのドメインyour-domain/client
node -e 'const {ethers}=require("ethers");const ep=["function endpoint() view returns (address)"];const ca=["function cawProfile() view returns (address)","function externalSelf() view returns (address)"];const CAW="0x5674e4658b988Ed9337DD0CAa493C6aA908006af";const G=[["https://ethereum-sepolia-rpc.publicnode.com",[["CawProfileL2_L1mirror","0x9fcbb3d6880cD3293F1a731Fe6c958a6621a74bF"]]],["https://base-sepolia-rpc.publicnode.com",[["CawProfileL2_L2","0x0c3e245f3939B4D9f30e088988dD9D7C8F86b11d"],["CawChallengeRelay_L2","0x8195A9a8a97658672d5384e19a763804D6E16639"],["CawActionsArchive_L2","0x3b2A9ac4f274eE6E73CbAD198F80f455e70C3C05"]]],["https://arbitrum-sepolia-rpc.publicnode.com",[["CawProfileL2_L2b","0xbB9c2A3e8222d13f9E8469BB71cE62c3c2E82941"],["CawChallengeRelay_L2b","0x5bCbB34f51156D605331f9d6F76a44DEa1d279E5"],["CawActionsArchive_L2b","0x454450aA713A99B06EE4aA05Ede5d80ca1bd3075"]]]];(async()=>{for(const [rpc,items] of G){const p=new ethers.JsonRpcProvider(rpc);for(const [n,a] of items){console.log("endpoint",n.padEnd(24),await new ethers.Contract(a,ep,p).endpoint());}}const bp=new ethers.JsonRpcProvider("https://base-sepolia-rpc.publicnode.com");const c=new ethers.Contract(CAW,ca,bp);console.log("cawProfile  ",await c.cawProfile());console.log("externalSelf",await c.externalSelf());})();'
curl -s https://base-sepolia-rpc.publicnode.com -X POST -H 'content-type: application/json' --data '{"jsonrpc":"2.0","id":1,"method":"eth_call","params":[{"to":"0x0c3e245f3939B4D9f30e088988dD9D7C8F86b11d","data":"0x5e280f11"},"latest"]}'
🔎 開発者ツールで実通信を自分の目で見るsee the real traffic yourself in DevTools
  1. F12 で開発者ツールを開き「Network」タブを選ぶOpen DevTools (F12) → Network tab.
  2. 「検証する」を押すClick Verify.
  3. 各 getter への eth_call リクエストが出ます。クリックで送信内容と返ってきた生の 32 バイトが見えます。An eth_call request appears for each getter. Click to see what was sent and the raw 32 bytes returned.
  4. 上の「叩いたリクエスト」「生返り値」と一致するか確認。ブラウザの記録なので細工できません。Check it matches the “request made” / raw value above. It is the browser’s own log — it cannot be faked.
この検証の中身と独立性what it does & independence

・信頼の根（LZ EndpointV2）期待値：0x6EDCE65403992e310A62460808c4b910D972f10f。本ツールは endpoint を持つ 7 OApp（CawProfileL2×3〔L1ミラー・L2・L2b〕・CawActionsArchive×2・CawChallengeRelay×2）を3チェーンで全数読みます。

・内部配線（cawProfile／externalSelf）は CawActions の代表インスタンスで確認します。各インスタンスは同じ実装のため、同じ getter を読めば同じ結果が再現でき、全インスタンスを追試可能です（下のコマンド参照）。

・セレクタ：endpoint()=0x5e280f11, cawProfile()=0xbe52a75c, externalSelf()=0x32824b54

・各チェーンとも Blockscout (GET) → publicnode → drpc を自動で試します。RPC は下のコマンドで自分のノードに差し替え可。

・独立性：ソース可読・RPC 差し替え可・判定はアドレス一致比較のみ。「わざと壊す」で実際に赤くなります。Trust root (LZ EndpointV2) expected: 0x6EDCE65403992e310A62460808c4b910D972f10f. This tool reads all 7 OApps that carry an endpoint (CawProfileL2×3 [L1 mirror, L2, L2b], CawActionsArchive×2, CawChallengeRelay×2) across 3 chains.

Internal wiring (cawProfile／externalSelf) is checked on a representative CawActions instance; since every instance shares the same implementation, reading the same getters on each reproduces the same result, so all instances can be re-checked (see the command below).

Selectors: endpoint()=0x5e280f11, cawProfile()=0xbe52a75c, externalSelf()=0x32824b54.

Each chain tries Blockscout (GET) → publicnode → drpc in order. Swap in your own node via the command below.

Independence: readable source, swappable RPC, plain address-equality only. Sanity-break actually turns it red.