{
  "tool_id": "art-612-erc2612-permit-binding-verifier",
  "note": "golden_hash filled by `node golden-parity.test.mjs --update`. domain_separator/struct_hash/digest for every signed vector below are cross-checked against an independent re-implementation of the EIP-712 domain-separator + Permit struct-hash + digest encoding (a separate ABI-encoding path sharing only the vendored keccak_256 primitive, same discipline as art-590/591's fixtures), and each signature is a REAL secp256k1 signature generated against that independently-recomputed digest with a known test private key, then recovered back through the kernel's own signature-recovery path -- not a round-trip self-test of this kernel's digest math alone.",
  "vectors": [
    {
      "name": "usdc-mainnet-binds",
      "policy_parameters": {
        "name": "USD Coin",
        "version": "2",
        "chainId": 1,
        "verifyingContract": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
        "owner": "0xe05fcc23807536bee418f142d19fa0d21bb0cff7",
        "spender": "0x1111111111111111111111111111111111111111",
        "value": 1000000,
        "nonce": 0,
        "deadline": 2000000000,
        "r": "0x70bb0933677f1bd68df1604ed9dcdfab90cb39809ff6b370e3676fb81baa6081",
        "s": "0x25f5a16ced7deac7fd852ea8501a09b720578aeec619db7ffd7022fea1ab7565",
        "yParity": 0
      },
      "output_payload": {
        "verdict": "BINDS",
        "reasons": [],
        "diverging_field": null,
        "domain": {
          "name": "USD Coin",
          "version": "2",
          "chain_id": "1",
          "verifying_contract": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"
        },
        "permit": {
          "owner": "0xe05fcc23807536bee418f142d19fa0d21bb0cff7",
          "spender": "0x1111111111111111111111111111111111111111",
          "value": "1000000",
          "nonce": "0",
          "deadline": "2000000000"
        },
        "domain_separator": "0x06c37168a7db5138defc7866392bb87a741f9b3d104deb5094588ce041cae335",
        "struct_hash": "0x924df832d760f52b6cd12584184ee60e30c32a7434067a195786bb99f2e29f64",
        "digest": "0x7bcf990683d7121eb9859f15cc7590f181ff9626f4e0cb56a8c6289a75393afd",
        "recovered_signer": "0xe05fcc23807536bee418f142d19fa0d21bb0cff7",
        "recovered_signer_matches_owner": true,
        "recovery_id": 0,
        "recovery_id_source": "yParity",
        "domain_typehash": "0x8b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f",
        "permit_typehash": "0x6e71edae12b1b97f4d1f60370fef10105fa2faae0126114a169c64845d6126c9",
        "scope_note": "Recomputes the EIP-712 digest for an ERC-2612 Permit struct from caller-supplied domain and message fields, then recovers the ECDSA signer from a caller-supplied signature and reports whether that signer binds to the caller-claimed owner. Proves a given address's private key produced a valid signature over the exact Permit digest supplied -- it does not prove the nonce used is still current on chain, that the allowance has not already been consumed, that `deadline` has not passed relative to now, or that the permit was ever submitted on-chain. Zero network calls; every field is caller-supplied and echoed, never independently resolved. Never a facilitator, proxy, or settlement relay."
      },
      "golden_hash": "69dd10ebd58d6237f5d7ee3e1c87c6866393111a43afe30e0f78b6c7a8bbbb04"
    },
    {
      "name": "dai-mainnet-binds-yparity",
      "policy_parameters": {
        "name": "Dai Stablecoin",
        "version": "1",
        "chainId": 1,
        "verifyingContract": "0x6B175474E89094C44Da98b954EedeAC495271d0F",
        "owner": "0x0376aac07ad725e01357b1725b5cec61ae10473c",
        "spender": "0x2222222222222222222222222222222222222222",
        "value": "5000000000000000000",
        "nonce": 3,
        "deadline": 1900000000,
        "r": "0xa7c94ed6eb916d3b1a82e32602b9275e816172efc37956fb006ac4a4defbc514",
        "s": "0x44f4763f1c5c450d4cd95c09c6234e4108b64a0920b7648d0b8a0864e74b8453",
        "yParity": 1
      },
      "output_payload": {
        "verdict": "BINDS",
        "reasons": [],
        "diverging_field": null,
        "domain": {
          "name": "Dai Stablecoin",
          "version": "1",
          "chain_id": "1",
          "verifying_contract": "0x6b175474e89094c44da98b954eedeac495271d0f"
        },
        "permit": {
          "owner": "0x0376aac07ad725e01357b1725b5cec61ae10473c",
          "spender": "0x2222222222222222222222222222222222222222",
          "value": "5000000000000000000",
          "nonce": "3",
          "deadline": "1900000000"
        },
        "domain_separator": "0xdbb8cf42e1ecb028be3f3dbc922e1d878b963f411dc388ced501601c60f7c6f7",
        "struct_hash": "0xe245aed18a2d2c657abef6aab20e4eb1641a4d13e9bac27019193e776dbb2915",
        "digest": "0xcc27bb29d9a7eab36f614b79cedda31ada6caed21aa433a7ff436d1ed2afe1aa",
        "recovered_signer": "0x0376aac07ad725e01357b1725b5cec61ae10473c",
        "recovered_signer_matches_owner": true,
        "recovery_id": 1,
        "recovery_id_source": "yParity",
        "domain_typehash": "0x8b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f",
        "permit_typehash": "0x6e71edae12b1b97f4d1f60370fef10105fa2faae0126114a169c64845d6126c9",
        "scope_note": "Recomputes the EIP-712 digest for an ERC-2612 Permit struct from caller-supplied domain and message fields, then recovers the ECDSA signer from a caller-supplied signature and reports whether that signer binds to the caller-claimed owner. Proves a given address's private key produced a valid signature over the exact Permit digest supplied -- it does not prove the nonce used is still current on chain, that the allowance has not already been consumed, that `deadline` has not passed relative to now, or that the permit was ever submitted on-chain. Zero network calls; every field is caller-supplied and echoed, never independently resolved. Never a facilitator, proxy, or settlement relay."
      },
      "golden_hash": "5b7d129627eaf47f63340246d05ce0e174b9e41f8cb6710e6b7be0452b85935c"
    },
    {
      "name": "usdc-mainnet-owner-mismatch-does-not-bind",
      "policy_parameters": {
        "name": "USD Coin",
        "version": "2",
        "chainId": 1,
        "verifyingContract": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
        "owner": "0xf5a5e415061470a8b9137959180901aea72450a4",
        "spender": "0x1111111111111111111111111111111111111111",
        "value": 1000000,
        "nonce": 0,
        "deadline": 2000000000,
        "r": "0x1799827f7a6add91a8a0b21cf3baff1c61768ae33a22a18257b13bd1228645bd",
        "s": "0x17e9d0213bf5cc005c4b36d4cd182c3602eb54012c20633f21b55898cf685dbc",
        "yParity": 1
      },
      "output_payload": {
        "verdict": "DOES_NOT_BIND",
        "reasons": [],
        "diverging_field": "owner",
        "domain": {
          "name": "USD Coin",
          "version": "2",
          "chain_id": "1",
          "verifying_contract": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48"
        },
        "permit": {
          "owner": "0xf5a5e415061470a8b9137959180901aea72450a4",
          "spender": "0x1111111111111111111111111111111111111111",
          "value": "1000000",
          "nonce": "0",
          "deadline": "2000000000"
        },
        "domain_separator": "0x06c37168a7db5138defc7866392bb87a741f9b3d104deb5094588ce041cae335",
        "struct_hash": "0xcbeeae14bec1f2c9f42900044964a5b4a47ba0db40406e6fe94a42133d0b3363",
        "digest": "0x5d77663216fd7cebc4027d696711f225b05089a4143c608cf6a9935208c2c540",
        "recovered_signer": "0xe05fcc23807536bee418f142d19fa0d21bb0cff7",
        "recovered_signer_matches_owner": false,
        "recovery_id": 1,
        "recovery_id_source": "yParity",
        "domain_typehash": "0x8b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f",
        "permit_typehash": "0x6e71edae12b1b97f4d1f60370fef10105fa2faae0126114a169c64845d6126c9",
        "scope_note": "Recomputes the EIP-712 digest for an ERC-2612 Permit struct from caller-supplied domain and message fields, then recovers the ECDSA signer from a caller-supplied signature and reports whether that signer binds to the caller-claimed owner. Proves a given address's private key produced a valid signature over the exact Permit digest supplied -- it does not prove the nonce used is still current on chain, that the allowance has not already been consumed, that `deadline` has not passed relative to now, or that the permit was ever submitted on-chain. Zero network calls; every field is caller-supplied and echoed, never independently resolved. Never a facilitator, proxy, or settlement relay."
      },
      "golden_hash": "63956026c049e38c1d537a64b24260ca609d5f84bc15115540f1c82e667445ce"
    },
    {
      "name": "base-legacy-v-binds",
      "policy_parameters": {
        "name": "USD Coin",
        "version": "2",
        "chainId": 8453,
        "verifyingContract": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "owner": "0x813e03853bd563bd6136c1a2362f2cb50ab9005b",
        "spender": "0x3333333333333333333333333333333333333333",
        "value": 42,
        "nonce": 7,
        "deadline": 1800000000,
        "r": "0xdd2d7ff3da6baeeceead4e2cb4399fd79f3f4917641b53f50205a2d9f37b64bb",
        "s": "0x410505835cf6e8d67d8dfe63da97dc152d29e9c3b862bf8d2e31e62c67b47888",
        "v": 27
      },
      "output_payload": {
        "verdict": "BINDS",
        "reasons": [],
        "diverging_field": null,
        "domain": {
          "name": "USD Coin",
          "version": "2",
          "chain_id": "8453",
          "verifying_contract": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913"
        },
        "permit": {
          "owner": "0x813e03853bd563bd6136c1a2362f2cb50ab9005b",
          "spender": "0x3333333333333333333333333333333333333333",
          "value": "42",
          "nonce": "7",
          "deadline": "1800000000"
        },
        "domain_separator": "0x02fa7265e7c5d81118673727957699e4d68f74cd74b7db77da710fe8a2c7834f",
        "struct_hash": "0xd05646a9948faf3a79e263f35335c7c72c1124eb40feb886445a3a4f10d499c9",
        "digest": "0x2aee0bcfddc94846f3b4ebf2dcfe36c1525a53620e043f8cbefd46e05009c3cc",
        "recovered_signer": "0x813e03853bd563bd6136c1a2362f2cb50ab9005b",
        "recovered_signer_matches_owner": true,
        "recovery_id": 0,
        "recovery_id_source": "v:v27_28",
        "domain_typehash": "0x8b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f",
        "permit_typehash": "0x6e71edae12b1b97f4d1f60370fef10105fa2faae0126114a169c64845d6126c9",
        "scope_note": "Recomputes the EIP-712 digest for an ERC-2612 Permit struct from caller-supplied domain and message fields, then recovers the ECDSA signer from a caller-supplied signature and reports whether that signer binds to the caller-claimed owner. Proves a given address's private key produced a valid signature over the exact Permit digest supplied -- it does not prove the nonce used is still current on chain, that the allowance has not already been consumed, that `deadline` has not passed relative to now, or that the permit was ever submitted on-chain. Zero network calls; every field is caller-supplied and echoed, never independently resolved. Never a facilitator, proxy, or settlement relay."
      },
      "golden_hash": "f4cea0aaf98a664c76f4c13cfb4d9cea1c112eb4150ae7feecc88c1c91e555c3"
    },
    {
      "name": "missing-domain-and-message-fields-indeterminate",
      "policy_parameters": {},
      "output_payload": {
        "verdict": "INDETERMINATE",
        "reasons": [
          "name is required (EIP-712 domain field, never defaulted)",
          "version is required (EIP-712 domain field, never defaulted)",
          "chainId is required and must be a non-negative uint256 (EIP-712 domain field, never defaulted)",
          "verifyingContract is required and must be a 20-byte hex address (EIP-712 domain field, never defaulted -- a guessed value defeats domain separation)",
          "owner is required and must be a 20-byte hex address",
          "spender is required and must be a 20-byte hex address",
          "value is required and must be a non-negative uint256",
          "nonce is required and must be a non-negative uint256 (ERC-2612 nonce is a counter, not bytes32)",
          "deadline is required and must be a non-negative uint256 (unix timestamp)",
          "r is required and must be a 32-byte hex value when signature is not supplied",
          "s is required and must be a 32-byte hex value when signature is not supplied"
        ],
        "diverging_field": null,
        "domain": {
          "name": null,
          "version": null,
          "chain_id": null,
          "verifying_contract": null
        },
        "permit": {
          "owner": null,
          "spender": null,
          "value": null,
          "nonce": null,
          "deadline": null
        },
        "domain_separator": null,
        "struct_hash": null,
        "digest": null,
        "recovered_signer": null,
        "recovered_signer_matches_owner": null,
        "recovery_id": null,
        "recovery_id_source": null,
        "domain_typehash": "0x8b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f",
        "permit_typehash": "0x6e71edae12b1b97f4d1f60370fef10105fa2faae0126114a169c64845d6126c9",
        "scope_note": "Recomputes the EIP-712 digest for an ERC-2612 Permit struct from caller-supplied domain and message fields, then recovers the ECDSA signer from a caller-supplied signature and reports whether that signer binds to the caller-claimed owner. Proves a given address's private key produced a valid signature over the exact Permit digest supplied -- it does not prove the nonce used is still current on chain, that the allowance has not already been consumed, that `deadline` has not passed relative to now, or that the permit was ever submitted on-chain. Zero network calls; every field is caller-supplied and echoed, never independently resolved. Never a facilitator, proxy, or settlement relay."
      },
      "golden_hash": "9211cb476eff71372b34b4ab12d0c82c7697ee0aa2e648fa21a2ba8b9d0a8c4b"
    }
  ]
}