Verify a Base USDC payout

Use this when a counterparty reports a transaction hash as proof of paying USDC on Base. Obtain the expected receiving address and amount from your own invoice or payout binding. Treat a hash in a marketplace message as a claim until the chain check passes.

Run the Node.js 20+ script below with the transaction hash, recipient, and exact decimal USDC amount. It uses only built-in APIs and the public Base RPC. Save the code as verify-base-usdc.mjs before running it.

node verify-base-usdc.mjs 0xTRANSACTION_HASH 0xRECEIVING_ADDRESS 12.000000

The script checks Base chain ID 8453, transaction success, at least 12 confirmations, and one ERC-20 Transfer log emitted by the official Base USDC contract for exactly the expected amount to the expected recipient. A verified result proves that transfer was recorded in that transaction. It does not prove that a task was accepted, the payer intended the transfer for a particular invoice, or the recipient can spend the token.

#!/usr/bin/env node
const [txHash, recipient, amount] = process.argv.slice(2);
const rpc = process.env.BASE_RPC_URL || 'https://mainnet.base.org';
const usdc = '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913';
const transfer = '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef';
const minConfirmations = 12n;

function fail(message) {
  console.error(JSON.stringify({ verified: false, reason: message }));
  process.exit(1);
}

if (!/^0x[0-9a-fA-F]{64}$/.test(txHash || '')) fail('Invalid transaction hash');
if (!/^0x[0-9a-fA-F]{40}$/.test(recipient || '')) fail('Invalid recipient');
if (!/^(0|[1-9]\d*)(\.\d{1,6})?$/.test(amount || '')) fail('Invalid USDC amount');
const [whole, fraction = ''] = amount.split('.');
const expected = BigInt(whole) * 1000000n + BigInt(fraction.padEnd(6, '0'));
if (expected <= 0n) fail('Amount must be positive');

let requestId = 0;
async function call(method, params = []) {
  const response = await fetch(rpc, {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ jsonrpc: '2.0', id: ++requestId, method, params }),
    signal: AbortSignal.timeout(15000),
  });
  if (!response.ok) throw new Error(`RPC HTTP ${response.status}`);
  const body = await response.json();
  if (body.error) throw new Error(`RPC ${body.error.code}: ${body.error.message}`);
  if (body.id !== requestId) throw new Error('RPC response ID mismatch');
  return body.result;
}

try {
  const chainId = await call('eth_chainId');
  if (BigInt(chainId) !== 8453n) fail('RPC is not Base mainnet');
  const receipt = await call('eth_getTransactionReceipt', [txHash]);
  if (!receipt) fail('Transaction is not mined');
  if (receipt.transactionHash?.toLowerCase() !== txHash.toLowerCase()) fail('Transaction hash mismatch');
  if (BigInt(receipt.status) !== 1n) fail('Transaction reverted');
  const latest = BigInt(await call('eth_blockNumber'));
  const mined = BigInt(receipt.blockNumber);
  if (latest < mined) fail('RPC block number is inconsistent');
  const confirmations = latest - mined + 1n;
  if (confirmations < minConfirmations) fail(`Only ${confirmations} confirmations`);

  const match = (receipt.logs || []).find(log =>
    log.address?.toLowerCase() === usdc &&
    log.topics?.length === 3 &&
    log.topics[0]?.toLowerCase() === transfer &&
    /^0x[0-9a-fA-F]{64}$/.test(log.topics[2] || '') &&
    ('0x' + log.topics[2].slice(-40)).toLowerCase() === recipient.toLowerCase() &&
    /^0x[0-9a-fA-F]{64}$/.test(log.data || '') &&
    BigInt(log.data) === expected
  );
  if (!match) fail('No exact USDC Transfer to the recipient for the expected amount');
  console.log(JSON.stringify({
    verified: true,
    chainId: 8453,
    token: usdc,
    transactionHash: receipt.transactionHash,
    recipient,
    amountAtomic: expected.toString(),
    confirmations: confirmations.toString(),
    blockNumber: mined.toString(),
    logIndex: match.logIndex,
  }));
} catch (error) {
  fail(error.message || String(error));
}

If the result is unverified because the receipt is missing or lacks 12 confirmations, retry the same hash later. A mismatch in token, recipient, or amount is a different payment from the one expected; reconcile it with the counterparty's authoritative payout record before crediting earnings. For larger payments, repeat the read through a second independent Base RPC provider to reduce dependence on one provider.