Verify the donation address

Vane publishes a donation address on every page. This page exists so you never have to take that on trust. Below is a message signed by the private key of that address, and three ways to check it that do not involve this website.

Why this page does not check the signature for you. It would be trivial to add a script here that prints a green tick. You would then be trusting this page to tell you whether to trust this page, which is not verification — it is decoration. The tools below are maintained by other people and can be run without our involvement. Use one of those.

The claim

Address: 0xE02Ea884f7C9948fc853d501a37a797F808383a8
Domain: vane.report
Lens: lens/vanedotreport
Signed: 5 August 2026

The signed message

Exactly these bytes, with no trailing newline. Any difference — a stray space, a changed line break — produces a different signature and the check below fails.

vane.report donation address attestation

I control this address. It receives donations for Vane and owns the Lens account
lens/vanedotreport.

Address: 0xE02Ea884f7C9948fc853d501a37a797F808383a8
Domain:  vane.report
Lens:    lens/vanedotreport
Date:    2026-08-05

SHA-256 of that message: ec272ba9a715cd6276a48ab5e7702448eeef2e4356cca6a0d85776ea90de947b

The signature

Signed with personal_sign. Recovering the signer from this signature and the message above yields the donation address — that is the whole claim, and you can confirm it without us using any of the three methods below.

0xc8b5d7483d8d0dcee62b75ac63ab34eb9a87badc4e261315316ad0f9a3c6a0c00b3594ecf5ed5ec080febff3d82fc96422c7f9fc947ef8e3e004b24f768e08f21c

How to check it yourself

1 — Etherscan

Open etherscan.io/verifiedSignatures, choose Verify Signature, and paste the address, the message and the signature. It recovers the signer independently of us.

2 — Foundry

If you have cast:

cast wallet verify --address 0xE02Ea884f7C9948fc853d501a37a797F808383a8 \
  "$(cat message.txt)" 0x<signature>

3 — viem, in any Node shell

import { verifyMessage } from "viem";
await verifyMessage({
  address:   "0xE02Ea884f7C9948fc853d501a37a797F808383a8",
  message:   "<the exact text above>",
  signature: "0x<signature>",
});   // true or false

What this does and does not prove

It proves that whoever published this page holds the private key to that address, at the time of signing.

It does not prove that the key is still held today, that it has not since been copied, or that donations sent there will be spent on anything in particular. A signature is evidence of control, not a promise about conduct.

The other identities are verifiable separately and by different means. The Bluesky account is bound to this domain by a DNS record — run dig +short TXT _atproto.vane.report and compare the DID against the account at @vane.report. That one needs no signature because DNS control is the proof.

Address poisoning is real: before sending anything, compare the first and last four characters against a second source. Transfers cannot be reversed.