Verify it yourself

Updated 6 October 2026. Worked example: Megapont Ape Club #3.

You are not just checking that an image appears in a wallet. You are checking that the helper is the one the registry lists, that its source is the code we tested, that its record matches the published manifest, and that a twin’s bytes hash to the fingerprint locked in the record. Everything below uses public data: the registry, the Stacks API and the chain.

The helpers today

Loading the registry…

1. Check the helper’s source

The table above lists the SHA-256 of each deployed helper’s source. Fetch the deployed source and hash it:

curl -s https://api.hiro.so/v2/contracts/source/SP3JNSEXAZP4BDSHV0DN3M8R3P0MY0EEBQQZX743X/forever-twin-megapont-ape-club \
  | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>console.log(require('crypto').createHash('sha256').update(JSON.parse(s).source).digest('hex')))"

It should print d092d883666f1da55664d856eef4ad7125d4d94eadc6b3a74a2578b799910e90, which is also the hash of the template-rendered file in the repository. (Checked 6 October 2026 for NYC Degens, Megapont Ape Club and Bitcoin Monkeys.)

2. Read the helper’s state

In the explorer’s contract-call sandbox, or any Stacks read-only call, use these on the helper:

`get-twin-interface`	Everything at once: group, whether the record is finalised, counts, fee, ceiling, payees, rescue settings, owner and the manifest hash.
`is-finalized`	Whether the record is locked.
`get-fee`, `get-payees`	The current fee and the two payee addresses (each gets half).
`get-inscribed-count`	How many twins exist.
`get-large-unbound`	Large files not yet bound (large-on-demand helpers).
`get-canonical (token-id)`	The locked record for one token: content hash, mime type, size, token URI.
`get-binding (token-id)`	The twin’s Xtrata inscription id, once it exists.
`get-custody-state (token-id)`	Which side of the pair is in the helper.
`is-source-listed (token-id)`	Whether the original is listed on its own market (G2 helpers).

The manifest-hash in get-twin-interface should equal the SHA-256 of the published manifest file listed above. For Megapont Ape Club: 0a3097e17ba545f7ebcd2961da8cdc83075e6a85ea5e01eb8697eb9cd68cc552.

3. Check a twin

For Megapont Ape Club #3, get-binding returns Xtrata inscription 3104. Fetch its bytes and compute the Xtrata rolling hash: start with 32 zero bytes, then for every 16,384-byte chunk, h = sha256(h || chunk).

const bytes = new Uint8Array(await (await fetch(
  'https://xtrata.xyz/inscription/mainnet/SP3JNSEXAZP4BDSHV0DN3M8R3P0MY0EEBQQZX743X/xtrata-v3-2-3/3104')).arrayBuffer());
let h = new Uint8Array(32);
for (let i = 0; i < bytes.length; i += 16384) {
  const c = bytes.subarray(i, i + 16384), m = new Uint8Array(32 + c.length);
  m.set(h); m.set(c, 32);
  h = new Uint8Array(await crypto.subtle.digest('SHA-256', m));
}
console.log('0x' + [...h].map(b => b.toString(16).padStart(2, '0')).join(''));

It should print 0x228d05485b14893163188d64f96260fe0d3b5bb614c2af0f74f0b65cf14af138, the content hash in the helper’s record for token 3 (get-canonical) and in the token’s metadata. The metadata also lists the original contract, token id and the original media URI so you can compare the twin with the original artwork.

You can read the same bytes straight from the Xtrata core contract (xtrata-v3-2-3): get-inscription-meta shows whether it is sealed, its size, mime type and final hash, and get-chunk / get-chunk-batch return the chunks.

4. Check the original

The metadata gives the original contract and token id. On that contract, get-owner shows who holds the original, and get-custody-state on the helper should agree with real ownership: if the original’s owner is the helper, the twin is with the holder, and the other way round.