{
  "status": "PASS_OFFICIAL_SOURCE_CAPTURE_AND_SELECTED_SEMANTICS",
  "capturedUTC": "2026-11-01T01:42:06.400198+00:00",
  "repositoryCommit": "1ef6a263ac6a0e476d063fcb269a9df65a1bd56a",
  "sources": [
    {
      "URL": "https://api.github.com/repos/tornadocash/tornado-core/commits/master",
      "HTTP": 200,
      "capturedUTC": "2026-11-01T01:42:05.570043+00:00",
      "localFile": "raw-local/github-master.json",
      "bytes": 64159,
      "SHA256": "1eb3becfb4009336a799986f0697c483524f2a01d7f3719bac591d556f62decc"
    },
    {
      "URL": "https://raw.githubusercontent.com/tornadocash/tornado-core/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/circuits/withdraw.circom",
      "HTTP": 200,
      "capturedUTC": "2026-11-01T01:42:05.836998+00:00",
      "localFile": "raw-local/withdraw.circom",
      "bytes": 2520,
      "SHA256": "f1ba401c9a20c284dfc4e8508158a35cad3ce2eb1177426cb97b41020b5a1c9a"
    },
    {
      "URL": "https://raw.githubusercontent.com/tornadocash/tornado-core/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/contracts/Tornado.sol",
      "HTTP": 200,
      "capturedUTC": "2026-11-01T01:42:06.025325+00:00",
      "localFile": "raw-local/Tornado.sol",
      "bytes": 4807,
      "SHA256": "64e0d454d6c077c0ae14f3e826378ad09bae57f1642e8dc1b0824a33a19c2014"
    },
    {
      "URL": "https://raw.githubusercontent.com/tornadocash/tornado-core/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/contracts/MerkleTreeWithHistory.sol",
      "HTTP": 200,
      "capturedUTC": "2026-11-01T01:42:06.219637+00:00",
      "localFile": "raw-local/MerkleTreeWithHistory.sol",
      "bytes": 7777,
      "SHA256": "7114bb7d6352bc005433fcddaa60ca454a204ab60b89f7265efc451524316cc9"
    },
    {
      "URL": "https://raw.githubusercontent.com/tornadocash/tornado-core/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/contracts/ETHTornado.sol",
      "HTTP": 200,
      "capturedUTC": "2026-11-01T01:42:06.399999+00:00",
      "localFile": "raw-local/ETHTornado.sol",
      "bytes": 1849,
      "SHA256": "1bfcc80fc7dd2ef2b4e03afb096770bcfbd51dd09b6ae40bcff53f82c57b6fc3"
    }
  ],
  "checks": {
    "withdraw.circom": {
      "sourcePath": "circuits/withdraw.circom",
      "permalink": "https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/circuits/withdraw.circom",
      "SHA256": "f1ba401c9a20c284dfc4e8508158a35cad3ce2eb1177426cb97b41020b5a1c9a"
    },
    "Tornado.sol": {
      "sourcePath": "contracts/Tornado.sol",
      "permalink": "https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/contracts/Tornado.sol",
      "SHA256": "64e0d454d6c077c0ae14f3e826378ad09bae57f1642e8dc1b0824a33a19c2014"
    },
    "MerkleTreeWithHistory.sol": {
      "sourcePath": "contracts/MerkleTreeWithHistory.sol",
      "permalink": "https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/contracts/MerkleTreeWithHistory.sol",
      "SHA256": "7114bb7d6352bc005433fcddaa60ca454a204ab60b89f7265efc451524316cc9"
    },
    "ETHTornado.sol": {
      "sourcePath": "contracts/ETHTornado.sol",
      "permalink": "https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/contracts/ETHTornado.sol",
      "SHA256": "1bfcc80fc7dd2ef2b4e03afb096770bcfbd51dd09b6ae40bcff53f82c57b6fc3"
    }
  },
  "interpretation": [
    "Deposit commitment and withdrawal nullifierHash are different public values derived from private note inputs.",
    "A public commitment lookup remains true after withdrawal; it does not identify whether that note is unspent.",
    "A withdrawal proves note membership at its supplied root. A root already present before a deposit cannot include that later deposit under the tree/hash assumptions.",
    "A later root does not identify which included note was spent.",
    "An ETH withdrawal pays denomination minus fee to the recipient; a fee can explain an amount below 0.1 ETH.",
    "Declared relayer and transaction sender need not identify the note holder."
  ],
  "limits": [
    "Repository reference semantics only; exact deployed contract/runtime/getters and transaction inputs must be checked separately.",
    "No note secret, deposit-to-withdrawal mapping, human identity or Car financial link recovered.",
    "Raw source bodies retained locally; public collection contains hashes, source URLs and own semantic summary."
  ]
}