HashPort
把 dApp 前端存进 BNB Chain：钱包逐字节比对哈希，管理权是电路容器 NFT，服务费为零。Storing a dApp frontend on BNB Chain: the wallet checks every byte, the admin is a circuit-container NFT, and the service fee is zero.
前端被换掉这件事
2025 年 2 月，Bybit 损失约 15 亿美元。合约本身没问题，是签名页面的 JavaScript 被注入——签名的人看到一笔交易，实际签的是另一笔。
同类事故的入口还有：DNS、CDN、npm 被劫持（域名对、合约对，页面是错的），以及 approve 钓鱼页（山寨域名骗你授权）。共同点是：合约代码可以被审计，用户眼前那个页面却没人能验证。
上链之后怎么验证
HashPort 把前端也搬到链上，让「页面」变成可以被核对的链上状态：
- 前端上链：把构建产物拖进控制台，每个文件写进 BNB Chain，同时把它的 SHA-256 登记在链上。
- 合约声明前端：合约所有者在无主的公开登记处记录「我的官方前端是这个容器」。
- 安全公司自助审计：审计公司可以审阅链上某个前端版本，登记一份「我审的就是这个哈希」的签名。
- 钱包逐字节核对：钱包把页面加载的每个文件都算一遍哈希，核对链上、核对声明，全部一致才显示 「On-chain frontend · verified」。
任一字节不符，钱包就把它标红。这套标准本身不发币、不收费、不绑定厂商：一个文件存储接口、一条 DNS 记录、一个无主声明登记处，集成几百行代码。
谁在管这个站
网站管理员不是账号加密码，而是 HashPort 建在 TapeOut 上的电路容器 NFT（ERC-6551）。持有这枚 NFT 的人才能改站；把 NFT 交出去，网站和它的域名付款一起走。
由此带来一件简单事：整个 dApp（前端 + 域名付款）可以在电路市场当一张 NFT 挂牌、买卖、结算，全程在链上。挂牌期间网站冻结，买家拿到的就是自己看到的版本。
怎么用，花多少
- 连接钱包：选一个已经开通容器的电路；没有就先在 TapeOut 开一个。
- 拖入文件夹：把 build 目录拖进去，钱包确认两次，几十笔上传交易由临时钱包代签。
- 在 DeWEB 打开：站点立刻在它的 DeWEB 地址上线；绑定自己的域名可选、免费。
服务费 0 BNB。上传只花链上 gas，约 0.01–0.03 BNB / MB，一次性，不经过平台。单文件上限 8.4MB。链上合约是 SiteRegistry 与 DomainBinding。
边界
适用对象是 dApp / DeFi 前端、静态站、配置和合约文档；不适合图片、视频等大文件。
定位上，TapeKit README 称它是商业服务；创始人 @Blonskr 称它是第一个基于 TapeOut 的商业化项目，并为其提供过技术指导。
Frontends get swapped out
In February 2025 Bybit lost about USD 1.5 billion. The contracts were fine; the signing page's JavaScript was injected — the signer saw one transaction and signed another.
Other entrances to the same class of attack: DNS, CDN and npm hijacks (right domain, right contract, wrong page) and approval-phishing pages (look-alike domains that trick you into approving). What they share: contract code can be audited, but the page in front of the user cannot be verified.
How it verifies once on chain
HashPort puts the frontend on chain too, turning "the page" into on-chain state you can check:
- Frontend goes on chain: drag the build output into the console; every file is written to BNB Chain with its SHA-256 registered on chain.
- The contract declares its frontend: the owner records in an ownerless public registry that "my official frontend is this container".
- Self-service audit by security firms: a firm can review an on-chain frontend version and register a signed hash of what it audited.
- Wallet checks byte by byte: the wallet hashes every file the page loaded, checks the chain and the declaration, and only then shows "On-chain frontend · verified".
One wrong byte turns it red. The standard itself has no token, no fee, no vendor lock-in: one file-store interface, one DNS record, one ownerless declaration registry, a few hundred lines to integrate.
Who runs the site
The site admin is not an account and a password but the HashPort circuit-container NFT built on TapeOut (ERC-6551). Whoever holds the NFT can change the site; hand over the NFT and the site and its domain payments go with it.
That makes one thing simple: a whole dApp (frontend plus domain payments) can be listed, sold and settled as a single NFT on the circuit market, entirely on chain. While listed, the site is frozen, so the buyer gets exactly the version they saw.
How to use it, and what it costs
- Connect a wallet: pick a circuit whose container is already opened; if you have none, open one on TapeOut first.
- Drag the folder: drop your build folder; the wallet confirms twice and dozens of upload transactions are signed by a temporary wallet.
- Open it on DeWEB: the site is live at its DeWEB address right away; binding your own domain is optional and free.
Service fee: 0 BNB. Uploads cost only chain gas, about 0.01–0.03 BNB per MB, one-off, and never pass through the platform. Max file size 8.4MB. Two on-chain contracts: SiteRegistry and DomainBinding.
The limits
It suits dApp / DeFi frontends, static sites, config and contract docs; it is not for images, video or other large files.
On positioning: the TapeKit README calls it a commercial service; founder @Blonskr calls it the first commercial project built on TapeOut and gave it technical guidance.