Hash Chain — Definition, How It Detects Tampering

A hash chain links each record to its predecessor via a cryptographic digest, so any retroactive edit changes every later hash and is detected.

Definition

A hash chain is an append-only data structure in which each entry stores a cryptographic digest of its content together with the digest of the entry that came before it. The link is computed as `chainHash[i] = SHA-256(chainHash[i-1] || contentHash[i])`. Because SHA-256 is collision-resistant, an attacker cannot edit an old entry and recompute later hashes to match the original sequence without detection. The first record (the genesis entry) uses a fixed seed value in place of a previous hash so the chain has a well-defined starting point.

How NakedPnL uses it

Every trader on NakedPnL has their own per-account hash chain. When a daily NAV snapshot is fetched from a venue (Binance, Bybit, OKX, IBKR, Kalshi, or Polymarket), the raw exchange response is canonicalized to RFC 8785 byte-stable JSON, hashed to a contentHash, and then chained: `chainHash = SHA-256(previousChainHash + contentHash)`. The very first entry uses the literal string `"genesis"` as the previous hash. Each chain head is also fed into the daily Merkle root that is anchored to Bitcoin via OpenTimestamps, so the chain is independently re-verifiable against an external clock.

Worked example

import { createHash } from "node:crypto";

const sha256 = (input: string) =>
  createHash("sha256").update(input).digest("hex");

// Day 1: genesis entry
const content1 = sha256('{"nav":10000,"date":"2026-05-05"}');
const chain1 = sha256("genesis" + content1);

// Day 2: links to Day 1
const content2 = sha256('{"nav":10250,"date":"2026-05-06"}');
const chain2 = sha256(chain1 + content2);

// Day 3: links to Day 2
const content3 = sha256('{"nav":10180,"date":"2026-05-07"}');
const chain3 = sha256(chain2 + content3);

// Editing Day 1 changes content1 -> chain1 -> chain2 -> chain3.
// The break is detectable by anyone who saved an earlier chain head.

Why it is tamper-evident, not tamper-proof

A hash chain does not physically prevent edits. The publisher of the chain can always rewrite the entire history if it has full control of the storage. What a hash chain provides is detection: anyone who recorded an earlier chain head can recompute later hashes from the published records and check that the head still matches. NakedPnL combines per-trader chains with a daily Merkle root anchored to Bitcoin so the chain heads are committed to an external timestamp that the publisher cannot rewrite.

Related terms

• SHA-256 — the cryptographic hash function used at every link.
• Merkle tree — combines many chain heads into a single root for batch attestation.
• OpenTimestamps — anchors NakedPnL's daily Merkle root to Bitcoin.
• Canonical JSON — RFC 8785 serialization that makes contentHash deterministic.