1. Control
The signer proved on-chain that they own, administer or deployed the contract. The registry checks this itself when the record is written, and clients re-check it whenever someone looks.
Contract provenance
Know the code
before you sign.
Tally links a deployed contract to its public source and makes the link checkable. A contract only shows as verified when the on-chain proof, the live code and the source repository all agree. Anything less is labelled for what it is.
Verified means three things agree.
Registering a source link is easy to fake. So Tally checks the claim from three independent directions and only turns green when all of them hold.
2. Code
The registry stores the code hash at registration. If the bytecode at the address ever changes, the record goes stale instead of vouching for code nobody looked at.
3. Source
The repository publishes a tally.json that lists the contract, its network and the wallet that registered it. A claim about a repository that does not agree is never shown as verified.
Six states. One of them is green.
Every badge, extension tag and record page uses the same rule, so what you see is what the chain supports.
Tally Verified
All three agree
Control proven on-chain and still held, the code unchanged since registration, and the repository's tally.json lists this contract and names the signer's wallet. Never an upgradeable proxy. Checked live, every time.
Control proven
Control, no full match
The signer proved control and still holds it, but the repository does not confirm the contract and its wallet yet, or the contract is an upgradeable proxy. Legacy v1 records stop here because v1 cannot watch the code.
Stale record
The proof expired
Control moved to someone else (a deployer stops counting once the contract has another owner), or the code at the address changed after it was registered. The record is treated as void.
Self-attested
A claim, labelled as one
A repository was claimed with no on-chain proof. Only possible for contracts that have no owner, and it can never be shown as verified.
Unverified
Nobody has vouched
No record exists. That is not the same as unsafe; it only means nobody has linked this code to a source.
Unavailable
Could not check
The network or the registry did not answer. Never shown as unverified, because failing to look is not the same as finding nothing.
Register, publish, check anywhere.
One signature from the wallet that controls the contract, one small file in the repository.
01
Register
Sign one EIP-712 message in the studio. The registry checks owner(), the admin role or the deployer address, and records the code hash.
02
Publish
Commit a tally.json to the repository root listing the contract and the registering wallet. It takes one minute and is what turns control proven into verified.
03
Check
The browser extension tags addresses on the explorer, the README badge stays current, and this site shows the evidence behind every level.
A live badge for your README.
The badge reads the chain on every request, so it cannot drift from the truth.
SVG · liveWhat Tally does not claim.
A provenance tool that overstates itself is worse than none. These are the limits, stated up front.
- It is not an audit.Verified says who vouches for a contract and where the source lives. It says nothing about whether that source is safe.
- It does not prove the repository builds to the deployed bytecode.That needs reproducible builds, which Tally does not do yet. The repository check proves the repo owner agrees, not that the code matches.
- Repositories can change hands.tally.json is read from the default branch at the moment you look. If a GitHub account is renamed or deleted, someone else can claim the old name and publish a file that names the same public wallet.
- Upgradeable proxies are never verified.A proxy's code hash does not change when its implementation does. Tally detects the standard EIP-1967 and beacon proxies and stops them at control proven. Other upgrade patterns, such as diamonds and hand-rolled proxies, are not detected.
- Control is an interface check.The proof is that owner(), the default admin role or the deployer address names the signer. A contract can be controlled in ways those checks do not see.
- Legacy v1 records are weaker.The first registry cannot see ownership changes or code changes, so Tally checks ownership itself and caps v1 records at control proven.