Nurvo Ai documentation

Getting started

Open the app, paste a Robinhood Chain address into the bar at the top and press Scan for a contract you want checked, or Trace for a wallet you want followed. No account and no wallet connection are needed. An address's first scan takes a few seconds; the same address is served from a 90-second cache after that.

A wallet connection is only used for two optional actions: sealing a report and, once it exists, locking $NURVO for a pass. Each asks your wallet before anything is signed.

Token scan

The scan reads one head block and takes every chain fact at that block:

• Runtime code and its size; whether the code is an EIP-1167 minimal proxy.
• The EIP-1967 implementation, admin and beacon storage slots, plus the older legacy slot. For a beacon, the current implementation is read from the beacon.
• Every PUSH4 selector in the proxy and logic code, matched against known administrative functions: mint, pause, blocklist, fee and limit setters, trading switches, upgrade and seizure functions.
• owner(), and whether the owner address holds code.
• name, symbol, decimals and total supply (set by the deployer, so never treated as proof of identity).
• Transfer logs read backwards from the head, up to a few thousand events or about a day of blocks.

Official stock tokens are recognised by the issuer beacon embedded in their proxy code together with the issuer's naming, never by ticker. Copies that reuse a stock ticker do not pass that check.

From outside the chain: Sourcify (then Blockscout) for source verification, Blockscout for the top holders and the deployment transaction, Dexscreener for pool depth and price. When the explorer cannot be reached, the holder rule falls back to the balances of the most active recent recipients and treats the result as a floor, and the age rule falls back to the first recorded transfer.

Rule reference

Each rule returns one of five outcomes: high, elevated, informational, passed, or not checked. Severity describes the strength of the signal, not the probability of loss. Rules are versioned; a change to any threshold changes the version.

Token rules

Wallet rules

Wallet trace

The trace reads the ETH balance, the sent-transaction count (nonce) and the code at the address. Token transfers come from the explorer's history when it answers (up to the latest 100); otherwise from the last few thousand blocks of the RPC, because public nodes limit queries that span all contracts. Balances are read for every token seen.

Approvals: for every token seen, the current allowance towards Permit2 and the Uniswap SwapRouter02, UniversalRouter and PositionManager deployments on Robinhood Chain, plus every spender approved in recent blocks. An allowance at or above 2²⁵⁵ is reported as unlimited.

Reports and fingerprints

A report is a JSON object with v, kind, chainId, subject (lowercase), observedBlock, observedAt, engine and findings. The fingerprint covers everything except the long explanations: for each finding its id, version, outcome, measured and the label and value of each evidence item.

Encoding: objects with keys sorted by code point, no whitespace, arrays in order, strings and numbers as standard JSON. The fingerprint is keccak256(utf8(encoding)). The rule bits set bit n for every rule numbered n that fired (high, elevated or informational).

fingerprint = keccak256(utf8(canonical({
  v, kind, chainId, subject, observedBlock, observedAt, engine,
  findings: [{ id, version, outcome, measured, evidence: [{ label, value }] }]
})))

The Reports page recomputes the fingerprint of any pasted report in your browser and, once NurvoDocket is live, looks up whether a given address sealed it.

Contracts

Both contracts are written in Solidity 0.8.28, have no owner, no admin, no fee, no pause and no upgrade path. They are tested with unit, fuzz, invariant and fork tests against Robinhood Chain state.

NurvoDocket

Append-only log of report fingerprints. It never holds funds and rejects ETH.

• file(subject, reportHash, ruleBits, observedBlock, supersedes): records a filing under the caller. Refuses an empty hash, a zero subject, a future block, a repeat by the same caller, and a supersedes that is not one of the caller's own earlier filings.
• filingOf(filer, reportHash), isFiled(filer, reportHash), filingCount(), subjectFilings(subject).
• Event Filed(serial, filer, subject, reportHash, ruleBits, observedBlock, supersedes).

Address: not deployed yet (the app seals in practice mode meanwhile).

NurvoTurnstile

Time-locked access pass for $NURVO. Constructor arguments are fixed forever: token, passAmount, lockSeconds (between one hour and 730 days; placeholder 30 days).

• lock(amount): pulls tokens (approve first), counts what actually arrived and refuses a short delivery, adds to the stake and restarts the waiting period.
• release(): after the waiting period, returns the caller's whole stake.
• hasPass(holder), stakeOf(holder), totalLocked(). Events Locked and Released.

Address: not deployed (it needs the $NURVO token first).

Anyone can check a deployment against this build with npm run verify-deployment from the source repository: it compares the on-chain runtime code byte for byte, decodes every immutable value and checks the creation transaction.

Read API

The app uses the same public JSON endpoints you can call yourself. No key is needed. Answers are cached for 90 seconds per address and limited per network.

GET https://nurvoai.xyz/api/scan/token?address=0x…
GET https://nurvoai.xyz/api/scan/wallet?address=0x…
GET https://nurvoai.xyz/api/chain

A scan answer has metrics (every input with its source, status and optional note), findings, tally, report, hash (the fingerprint), ruleBits and cached. A bad address answers 400, a busy network 429, and an unreachable chain 503.

Limits

• The function scan matches known names; a power under an unusual name is not recognised.
• The proxy rule covers the standard slots; custom upgrade designs can be missed.
• Liquidity depth comes from one pool index and says nothing about whether liquidity is locked.
• Transfer windows are limited; very busy tokens are judged on the latest minutes of activity.
• No rule simulates a sale, so transfer restrictions are never marked as passed.
• Nothing here is a guarantee or investment advice.