BUILD ON BASE.KNOW WHATSHIPPED.

One toolkit for attribution, code audits, and native token evidence.

One toolkit for attribution,
code audits, and native
token evidence.

Reproduce transaction checks.
Keep your policy from source
code to onchain evidence.

Open source. Runs in your app, locally, and in CI.

From your app.
To the evidence.

Bao Toolkit is the developer toolkit for building, auditing, and verifying transaction paths on Base.

Add Builder Code attribution to your client. Catch gaps in source code. Inspect native token evidence. Keep a report you can reproduce.

IntegrateAdd the code where your app builds a transaction.
Audit and enforceKeep the same attribution policy in your app and CI.
Verify and retainCheck submitted hashes and save the evidence.

Meet your new toolkit

Attribution that
travels with your app.

Builder Code attribution can disappear in a refactor without breaking the transaction. Bao Toolkit gives your team a repeatable control over that path.

Use typed helpers with viem, wagmi, or ethers. For smart wallets, negotiate capabilities before sending a batch and apply attribution to the final UserOperation calldata.

viem wagmi ethers Smart wallets Privy · x402 · agents

Choose your integration

await walletClient.sendTransaction({
  account,
  to,
  value,
  data: "0x",
});

Builder Code suffix missing

A valid transaction request can omit attribution. The transaction alone does not protect your code.

Try the source audit

Illustrative Doctor output · local source analysis

$ bao doctor

Frameworks: smart-wallet, wagmi, x402
Coverage: 2/3 paths protected (67%)

+ wagmi   app/mint.tsx:18  protected
+ x402    src/pay.ts:9    protected
! wallet  src/batch.ts:22 missing BAO005

  Negotiate wallet_getCapabilities
  before wallet_sendCalls.

Find the path. Read the finding. Fix the request.

Catch the gap.
Before the merge.

Attribution Doctor connects supported TypeScript call sites to Builder Code evidence. Read findings in your terminal, inspect JSON, or send SARIF into Code Scanning.

Keep a project policy in bao.config.json and run it in CI. Static analysis reports unresolved configuration explicitly; it does not execute your app.

Open Attribution Doctor Set up your first audit

Native tokens.
Evidence attached.

B20 · Unreleased candidate

A successful token call can still omit your Builder Code.

Bao Toolkit inspects B20 initialization, canonical creation events, direct calldata attribution, and receipt comparisons as separate evidence. A router event does not establish attribution for the nested app.

See the transfer before and after

Candidate tooling. The transfer example uses synthetic receipts. Native runtime qualification and application readiness remain untested.

Before · synthetic transferCode missingInspect the missing-code report

After · corrected requestCode foundInspect the corrected report

Same token, recipient, and raw amount. One attribution fix.

Proof you can
open and reproduce.

Follow a selected transaction sample from calldata to a replay report and a Proof Set. Check the hashes, networks, acquisition context, and limits yourself.

Explore the Observatory

Inside the Bao Toolkit snapshot

Published transaction evidence · Base mainnet. This snapshot is separate from the illustrative source examples above.

Transaction: 0x6573344c…f8fe4926
Decoded Builder Code: bc_vwmzy653
What was checked: Calldata acquired over RPC; expected code decoded.
What you can retain: The replay input and the published manifest. Neither proves complete project coverage.

Open and reproduce this snapshot