verify ][
The downloads are meant to be copied and passed around, and the app connects a wallet. Everything you need to check a copy is on this page.
The downloads
SHA-256 of the files served from immutables.art. If a copy you were given does not match one of these, do not connect a wallet to it.
ae8d738b15c3a69fa802b197643056577834681016b0468f18eaac6abf7e7c64
57f9703f0dc3124c69deaf818566c702dd4ad8dedc9a00b3cf0ff7832ca7755b
e1a8759688fd02f539bada920055deffcd2790fac2babc6e160d29d2b094627d
shasum -a 256 immutablesArtApp.html # mac, linux certutil -hashfile immutablesArtApp.html SHA256 # windows
Every contract the app can send you to
Your wallet shows the destination of every transaction before you sign it. These are the only addresses it should ever be. The Zora contracts are public marketplace infrastructure — not ours, and verifiable independently.
The art
| ImmutablesArt Every project and every edition. The art scripts themselves are stored here. |
0xA8A6CB3978e2c4EdcF5A3d0cB3400E1E5D031479 | asks you to sign Minting an edition, and approving Zora to move one you own. |
| Immutables An earlier contract the app reads from. It never asks you to sign anything for it. |
0x499f4943fB86717adcE584927E6AB5a172f03001 | never asks you to sign |
Currency
| Dollars The ERC-20 used for some Zora bids and offers. |
0x02aC5Aa7571B05702F5537348a0201DCe832E7Ce | asks you to sign Approving Zora to spend DOLLARS when you bid. |
Zora marketplace
| ZoraModuleManager Zora’s registry of marketplace modules. |
0x850A7c6fE2CF48eea1393554C8A3bA23f20CC401 | asks you to sign Enabling a Zora module on your account before first use. |
| AsksV1_1 Zora’s fixed-price listings. |
0x6170B3C3A54C3d8c854934cBC314eD479b2B29A3 | asks you to sign Listing an edition for sale, cancelling a listing, buying one. |
| OffersV1 Zora’s offers. |
0x76744367ae5a056381868f716bdf0b13ae1aeaa3 | asks you to sign Making, cancelling or accepting an offer. |
| ReserveAuctionCoreErc20 Zora’s reserve auctions, settled in an ERC-20. |
0x53172d999a299198a935f9E424f9f8544e3d4292 | asks you to sign Creating, bidding in, or settling an auction. |
| ERC721TransferHelper The operator you approve so Zora can move an edition when it sells. You approve it — the app never sends a transaction to it. |
0x909e9efE4D87d1a6018C2065aE642b6D0447bc91 | never asks you to sign |
| ERC20TransferHelper The spender you approve for bid currency. You approve it — the app never sends a transaction to it. |
0xCCA379FDF4Beda63c4bB0e2A3179Ae62c8716794 | never asks you to sign |
Worth knowing
- Minting always goes to ImmutablesArt. Nothing else mints.
- Bidding asks for an unlimited DOLLARS allowance. Zora’s transfer helper is approved for the maximum amount. That is how the marketplace integration works today — it is listed here so it does not surprise you, not because we think it is ideal.
- We never ask you to sign a message to “verify” or “claim” anything. There is no airdrop, no allowlist signature, no wallet check.
- A wallet that simulates transactions will show you what leaves your account before you sign. That protects you whether or not you checked a hash.
Or rebuild it yourself
The build is deterministic: the same source produces the same bytes, so the hashes above are something you can derive rather than something you have to trust.
git checkout b24a43d npm ci && cd client && npm ci npm run build && npm run bundle npm run verify
Verified with node 22.12.0. A different major version of node may produce different bytes.