{
 "product": "Quorum-QaaS (4-region PBFT)",
 "slug": "quorum-qaas",
 "base": "https://cainstudio.online",
 "page": "https://cainstudio.online/top25-quorum-qaas.html",
 "claims": [
  {
   "id": "C01",
   "kind": "control",
   "claim": "Published receipt verifies -> Signed by a quorum of the pinned cluster.",
   "requests": [
    {
     "method": "GET",
     "url": "/verify-yourself-receipt.json"
    },
    {
     "method": "POST",
     "url": "/api/v1/quorum/verify",
     "body": {
      "receipt": "${0..}"
     }
    }
   ],
   "path": "verdict",
   "expect": [
    "NOTARIZED"
   ]
  },
  {
   "id": "C02",
   "kind": "attack",
   "claim": "Digest changed -> The quorum signed this digest, not yours.",
   "requests": [
    {
     "method": "GET",
     "url": "/verify-yourself-receipt.json"
    },
    {
     "method": "POST",
     "url": "/api/v1/quorum/verify",
     "body": {
      "receipt": "${0..}"
     },
     "set": {
      "receipt.digest": "0000000000000000000000000000000000000000000000000000000000000000"
     }
    }
   ],
   "path": "verdict",
   "expect": [
    "NOT_VERIFIED"
   ]
  },
  {
   "id": "C03",
   "kind": "attack",
   "claim": "Cluster renamed (unsigned top-level field) -> cluster_id must equal the signed membership's; the 2026-11-03 lab found the verifier echoing it. Fixed and deployed 2026-11-03.",
   "requests": [
    {
     "method": "GET",
     "url": "/verify-yourself-receipt.json"
    },
    {
     "method": "POST",
     "url": "/api/v1/quorum/verify",
     "body": {
      "receipt": "${0..}"
     },
     "set": {
      "receipt.cluster_id": "cain-forged-cluster"
     }
    }
   ],
   "path": "verdict",
   "expect": [
    "NOT_VERIFIED"
   ]
  },
  {
   "id": "C04",
   "kind": "attack",
   "claim": "Request id swapped -> The commit certificate names exactly one request.",
   "requests": [
    {
     "method": "GET",
     "url": "/verify-yourself-receipt.json"
    },
    {
     "method": "POST",
     "url": "/api/v1/quorum/verify",
     "body": {
      "receipt": "${0..}"
     },
     "set": {
      "receipt.request_id": "req-forged"
     }
    }
   ],
   "path": "verdict",
   "expect": [
    "NOT_VERIFIED"
   ]
  },
  {
   "id": "C05",
   "kind": "attack",
   "claim": "Sequence moved -> The certificate is for one slot in the log.",
   "requests": [
    {
     "method": "GET",
     "url": "/verify-yourself-receipt.json"
    },
    {
     "method": "POST",
     "url": "/api/v1/quorum/verify",
     "body": {
      "receipt": "${0..}"
     },
     "set": {
      "receipt.sequence": 1
     }
    }
   ],
   "path": "verdict",
   "expect": [
    "NOT_VERIFIED"
   ]
  },
  {
   "id": "C06",
   "kind": "attack",
   "claim": "Operation digest differs from the receipt digest -> The operation must notarize exactly the receipt's digest.",
   "requests": [
    {
     "method": "GET",
     "url": "/verify-yourself-receipt.json"
    },
    {
     "method": "POST",
     "url": "/api/v1/quorum/verify",
     "body": {
      "receipt": "${0..}"
     },
     "set": {
      "receipt.operation.data.digest": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
     }
    }
   ],
   "path": "verdict",
   "expect": [
    "NOT_VERIFIED"
   ]
  },
  {
   "id": "C07",
   "kind": "attack",
   "claim": "Commit signatures dropped to one -> One replica is not a quorum (needs 3 of 4).",
   "requests": [
    {
     "method": "GET",
     "url": "/verify-yourself-receipt.json"
    },
    {
     "method": "POST",
     "url": "/api/v1/quorum/verify",
     "body": {
      "receipt": "${0..}"
     },
     "set": {
      "receipt.commit_qc.bundle.individual_signatures": {
       "cain-mr2-node-1": "${0.commit_qc.bundle.individual_signatures.cain-mr2-node-1}"
      }
     }
    }
   ],
   "path": "verdict",
   "expect": [
    "NOT_VERIFIED"
   ]
  },
  {
   "id": "C08",
   "kind": "attack",
   "claim": "Wrong pin (another cluster's configuration) -> Pinned to a configuration this receipt was not signed by.",
   "requests": [
    {
     "method": "GET",
     "url": "/verify-yourself-receipt.json"
    },
    {
     "method": "POST",
     "url": "/api/v1/quorum/verify",
     "body": {
      "receipt": "${0..}",
      "pin": "0000000000000000000000000000000000000000000000000000000000000000"
     }
    }
   ],
   "path": "verdict",
   "expect": [
    "NOT_VERIFIED"
   ]
  },
  {
   "id": "C09",
   "kind": "attack",
   "claim": "Commit certificate removed -> No commit quorum, no notarization.",
   "requests": [
    {
     "method": "GET",
     "url": "/verify-yourself-receipt.json"
    },
    {
     "method": "POST",
     "url": "/api/v1/quorum/verify",
     "body": {
      "receipt": "${0..}"
     },
     "set": {
      "receipt.commit_qc": null
     }
    }
   ],
   "path": "verdict",
   "expect": [
    "NOT_VERIFIED"
   ]
  }
 ]
}