How to verify our trade log

Each seal is signed with Botsfolio's private key. The public key that checks those signatures is published in three places, and only whoever controls botsfolio.com can change the first two: on this site, in a DNS record, and in the log. The fingerprint 758189603fa8abd5 in every row is the first 16 hex characters of the SHA-256 of the raw key. It says which key to check, and the signature shows that key signed.

nslookup -type=TXT _botsfolio-records.botsfolio.com

Expected value: ed25519-public-key=EZm6GvnxrO8rqsmPlBymT5PXYZO45l55zoXurtpJAjs=

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAEZm6GvnxrO8rqsmPlBymT5PXYZO45l55zoXurtpJAjs=
-----END PUBLIC KEY-----

Each seal lists the SHA-256 of its files and of the seal before it, so editing or removing anything breaks every seal after it. A trade is never edited: a fix goes in as a new row that names the row it corrects.

Each seal has an OpenTimestamps proof that ties it to a Bitcoin block, which nobody can backdate. A proof completes a few hours after its seal. The first seal, on Oct 31, 2026, covers trades from before it and shows those rows existed by that date. Download the newest finished proof and check it at opentimestamps.org.

Paper trades use live Coinbase prices, so anyone can compare them with Coinbase's public candles. A buy happens at the daily close (00:00 UTC) and equals that day's close. A sell is inside that minute's candle.

Start with the newest paper trades (CSV), the newest real-money trades (CSV), or the newest seal (JSON). Results built from these trades: paper trading live markets and real money.

With Python, in a copy of the log, verify.py checks every seal, and with --prices 25 the newest 25 paper prices against Coinbase:

pip install cryptography
python verify.py --prices 25

To check the newest signature in a few lines, from anywhere:

import base64, json, urllib.request
from cryptography.hazmat.primitives.serialization import load_pem_public_key

get = lambda url: urllib.request.urlopen(url).read()
raw = "https://raw.githubusercontent.com/botsfolio/trading-records/main/"
key = json.loads(get("https://botsfolio.com/.well-known/botsfolio-records.json"))["publicKeyPem"]
latest = json.loads(get(raw + "latest.json"))
seal, signature = get(raw + latest["seal"]), base64.b64decode(get(raw + latest["signature"]))
load_pem_public_key(key.encode()).verify(signature, seal)  # raises if it doesn't match
print("signed by the key on botsfolio.com:", latest["seal"])

Without running code, compare what this site says with what the log says: the fingerprint and the newest seal's SHA-256 above should match latest.json, and the log links back to this page.

The data is licensed under CC BY 4.0. Use it freely and credit Botsfolio, with a link to this site. Past results don't predict future ones.