> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ix.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Proof of Reserve

> How IX RWA gates every NAV move behind a recorded attestation — and how to verify reserves and hardware identity yourself.

A tokenized asset is only as trustworthy as your ability to check it. IX RWA is built so the value backing IX-CORE is **not** something you take on faith: every change to NAV passes through a recorded, on-chain attestation, and the hardware behind each asset is anchored to a hash you can recompute.

## The gate: no NAV move without an attestation

The NAV oracle's `ORACLE_UPDATER_ROLE` is assigned to the [**Attestor Registry**](/protocol/smart-contracts). Once the direct-EOA write is revoked — a pre-mainnet lockdown step — there is exactly one path to move NAV:

```mermaid theme={null}
sequenceDiagram
    participant AT as Attestor (ATTESTOR_ROLE)
    participant AR as AttestorRegistry
    participant O as NAV Oracle
    participant V as IX-CORE vault
    AT->>AR: attestReserve(cohortId, valueUSD, evidenceHash)
    AR->>AR: record (attestor, value, evidenceHash, timestamp)
    AR->>O: setCohortValue(cohortId, valueUSD)
    O->>O: enforce bounds (maxBps) + staleness (maxAge)
    V->>O: hardwareValueUSD() when pricing
    Note over AR,O: A bad value still reverts at the oracle
```

Because the registry is the writer, every reserve value on record carries **who** attested it, **what** evidence backs it (`evidenceHash`), and **when**.

<Note>
  On testnet the direct-EOA oracle write has not yet been revoked, so treat the gate as the target end-state; on mainnet real attestors are added and every EOA path is revoked. See [Security model](/security/security-model#proof-of-reserve).
</Note>

## What an attestation contains

| Field          | Meaning                                                                           |
| -------------- | --------------------------------------------------------------------------------- |
| `cohortId`     | The sleeve (SPV/batch) being attested                                             |
| `valueUSD`     | Attested reserve value, USDC 6-dec                                                |
| `evidenceHash` | `keccak256` of the off-chain evidence bundle — invoices, serials, site, telemetry |
| `attestor`     | The address that signed the attestation                                           |
| `at`           | Block timestamp of the attestation                                                |

Read the latest attestation for any cohort with `latest(cohortId)`, and check recency with `isFresh(cohortId, maxAge)`.

## Verify reserves yourself

<Steps>
  <Step title="Read the attestation">
    Call `latest(cohortId)` on the Attestor Registry to get `valueUSD`, `evidenceHash`, `attestor`, and `at`.
  </Step>

  <Step title="Check it's fresh">
    Confirm `isFresh(cohortId, maxAge)` is true — a stale feed also trips the vault's own staleness guard and blocks pricing.
  </Step>

  <Step title="Match the evidence">
    Retrieve the off-chain evidence bundle and recompute its `keccak256`; it must equal the on-chain `evidenceHash`.
  </Step>

  <Step title="Recompute NAV">
    Cross-check the attested cohort values against `hardwareValueUSD()` and rebuild NAV-per-share as `totalAssets ÷ totalSupply`. See [Transparency & NAV](/protocol/transparency-and-nav).
  </Step>
</Steps>

## Verify hardware identity

Each asset can anchor a **hardware identity**: `identityHash = keccak256` of the canonical bundle (machine id, host id, motherboard, geolocation, and per-GPU serials), plus GPU model and serial count. Call `identityOf(assetId)` on the Asset Registry, re-hash the off-chain bundle, and confirm the two match — proof that the anchored machine is the one backing the asset.

## Honest boundary

<Warning>
  The Attestor Registry enforces the **process**, not the **truth** of the evidence. On-chain, it guarantees that NAV only moved through a recorded attestation with an evidence hash and bounded, staleness-checked values. Genuinely independent proof-of-reserve additionally requires a real third-party attestor holding `ATTESTOR_ROLE` and a real evidence pack behind each hash. On testnet the attestor is the EconomicsFeeder key; at mainnet, real attestors are added and the direct-EOA write is revoked — the **same code**, a different signer. See the [roadmap](/why-ix-rwa#roadmap).
</Warning>