Account · NEAR testnet
Your account
NEAR testnet only
Connect a NEAR wallet
Your wallet tells this page your account id. The page then reads your credit, commits and payouts, and asks the wallet to sign only the transactions you review first.
What you see
- Your token credit and NEAR credit at near-antibody, and the wNEAR in your wallet
- Your commits and payouts, each linked to its record
- Your agent statement, or the agents you registered
What you can do
- Wrap NEAR and deposit wNEAR into your credit
- Withdraw token credit or NEAR credit
- Register an agent, or change its budget
What never happens
- No key is stored here or asked for: your wallet keeps its keys
- No message signature is asked for, ever
- Nothing is signed that you did not review here first
Nothing loads from a wallet until you pick one; then only that wallet's connector script, from the address listed under How the wallet connects.
Transparency
Every transaction this page can ask you to sign
| Action | Contract and method | Arguments | Attached | Gas |
|---|---|---|---|---|
Add NEAR credit | bounty.antibody.testnetstorage_deposit | {} | the NEAR you choose | 30 Tgas |
Wrap NEAR (in a deposit, when your wallet is short) | wrap.testnetstorage_deposit, then near_deposit | {"account_id": <you>, "registration_only": true}, then {} | wrap.testnet's registration once (read before you sign), then the NEAR you wrap | 30 Tgas each |
Deposit wNEAR into your credit | wrap.testnetft_transfer_call | {"receiver_id": "bounty.antibody.testnet", "amount": <raw>, "msg": "\"deposit\""} | 1 yoctoNEAR | 300 Tgas |
Withdraw wNEAR credit | bounty.antibody.testnetwithdraw | {"amount": <raw>} | 1 yoctoNEAR | 60 Tgas |
Withdraw NEAR credit | bounty.antibody.testnetstorage_withdraw | {"amount": <yoctoNEAR>} | 1 yoctoNEAR | 30 Tgas |
Register an agent, or change one | bounty.antibody.testnetregister_agent | {"agent": <name>.<you>, "bond_budget": <raw>, "per_commit_cap": <raw>, "programs": null | [ids]} | 1 yoctoNEAR | 30 Tgas |
One yoctoNEAR is attached wherever credit leaves near-antibody or an agent gets a budget. A function-call key cannot attach a deposit, so only a full-access key signs these: an agent's key never can (near-antibody ).
Never asked for: a message signature, a new access key, a plain transfer, or a call to any other contract. The NEAR and wNEAR you deposit are credited to your own account, at near-antibody or at wrap.testnet. Signing in only tells the page your account id.
Before you sign: the code at these contracts
| Contract | Code in the release record | On NEAR now |
|---|---|---|
bounty.antibody.testnetnear-antibody | C9LGvUpq9P5j…, bounty.antibody.testnet code hash: C9LGvUpq9P5j5zB8RyZdRaXHWf3tF4wRtb1PjBYKysaY | not checked yet |
wrap.testnetpayout token (wNEAR) | DsbyUrKaSJAT…, wrap.testnet code hash: DsbyUrKaSJAT91Pewfi71QExPLBooDp1z4sL9GUDhNHa | not checked yet |
What loads, and from where
How the wallet connects
The connector
A NEAR wallet connector library, version 0.12.0, pinned in package.json . It is part of this site's code and loads on this page only, when you connect or a saved session is restored. This page draws its own wallet list instead of the connector's.
A sandbox per wallet
The wallet you pick runs its connector script in a sandboxed iframe: an opaque origin with no access to this page, its cookies or its storage. It reaches the page only through the calls its manifest permits: open its own window, keep its session here under its name, talk to its extension.
Pinned, and fenced by the CSP
Three of the four scripts are fixed to a commit; one wallet serves its own, marked in the table. The Content-Security-Policy allows each script by its exact path, and the iframe inherits that policy, so its requests are held to the same list.
| Wallet | Connector script | Also contacts | May open |
|---|---|---|---|
Meteor WalletBrowser extension or web wallet | raw.githubusercontent.com/Meteor-Wallet/meteor_wallet_sdk/ef1be35fc3712f2de60a7563aed543d78e73f763/storage/meteor-near-connect-latest.jsfixed at commit ef1be35 · 2.0 MB | test.rpc.fastnear.comreads NEAR testnetmc.meteorwallet.appits bridge to the mobile app | wallet.meteorwallet.app, meteorwallet.app, chromewebstore.google.com |
Intear WalletWeb wallet or desktop app | wallet.intear.tech/near-selector.jsserved by the wallet; not pinned · 14 KB | wss://logout-bridge-service.intear.techits bridge to the desktop app | wallet.intear.tech |
NightlyDesktop browser extension | raw.githubusercontent.com/hot-dao/near-selector/9cee11c04cfd42f5a420688f808d4aca612b5fde/repository/nightly.jsfixed at commit 9cee11c · 1.2 MB | test.rpc.fastnear.comreads NEAR testnet | nightly.app, chromewebstore.google.com |
NEAR CLIYour terminal: you run the command it shows and paste the result | raw.githubusercontent.com/near/near-cli-connect/2b8c4fdc5da03d7e6688a7f84ebce99e480c9c26/dist/near-cli.jsfixed at commit 2b8c4fd · 56 KB | this site's NEAR RPClooks up the transaction you sent | — |
Not offered here: wallets that support only mainnet, wallets that need a relay service, EVM wallets, and USB hardware wallets (this site's Permissions-Policy turns USB off). Wallet windows open outside this page. A browser extension that announces a testnet wallet is listed as well: its code already runs in your browser.
The connect-src entries the wallet connection adds
https://raw.githubusercontent.com/Meteor-Wallet/meteor_wallet_sdk/ef1be35fc3712f2de60a7563aed543d78e73f763/storage/meteor-near-connect-latest.jshttps://raw.githubusercontent.com/hot-dao/near-selector/9cee11c04cfd42f5a420688f808d4aca612b5fde/repository/nightly.jshttps://raw.githubusercontent.com/near/near-cli-connect/2b8c4fdc5da03d7e6688a7f84ebce99e480c9c26/dist/near-cli.jshttps://wallet.intear.tech/near-selector.jshttps://mc.meteorwallet.appwss://logout-bridge-service.intear.techhttps://test.rpc.fastnear.comhttps://rpc.testnet.near.orgSource: the pinned wallet list , the CSP entries , the connection , the transactions .
For projects
Reading paid proofs stays in the CLI
A finding paid to a project is wrapped to the project's key. With keygen x25519 --nep413 that key is derived from the project wallet's NEP-413 signature over one fixed message naming near-antibody and the project (crypto spec §3.3 ). The signature is deterministic, so whoever obtains it holds the key.
That is a phishing-shaped request: a page that got the project's wallet to sign the message would read every paid finding (threat model, P13 ). So the key is derived, and paid proofs are read, only on the project's own machine.
If any website asks your wallet to sign a message that begins “Antibody project key v2”, reject it. This site never shows that request.
A random key (keygen x25519 without --nep413) has no message to phish; keep its file safe instead.
antibody --account <project>.testnet keygen x25519 --nep413 --out project-key.jsonantibody --account <project>.testnet program read --commit <id> --project-key project-key.json --out ./finding --api https://antibody-near.vercel.appprogram read asks for the finding's release wrap the first time (the requester pays), unwraps the content key with the project key, opens the sealed proof and re-runs it locally; the local receipt must equal the enclave's. In the recorded run the project read A's paid proof this way, and near-antibody refused to wrap D's duplicate (JUDGES.md, row 16).