The problem: a NEAR contract can publish a link to its source code, and people treat that as proof you can check it. But a link isn’t the code. It can be a template placeholder, point to a repo that doesn’t exist, or not say which version is running.
What I built: Shelflife checks whether that link actually works and points to one exact version. Of 168 token contracts I checked, 53 publish source info, 34 carry a link, 28 point to a repo that exists, and only 6 are pinned to a specific version, the minimum needed to rebuild the code. It gives any contract a plain verdict and exits with an error when there’s no readable source, so it can fail a build.
How NEAR fits: NEAR’s on-chain source standard (NEP-330) and SourceScan’s on-chain records mean all of it is readable with free public calls, no keys and no scraping. It also handles NEAR’s global contracts, which my first version got wrong. I fixed that and listed every correction in the README, and the data and tests are in the repo.
Loops House