Certified Variables

Query calls on the Internet Computer are fast because they skip consensus, but that means a malicious replica could lie to you. This skill shows you how to build cryptographically verified responses using Merkle trees and subnet BLS signatures. You hash your data structure, certify the root during updates, then attach certificates and witnesses to query responses so clients can verify authenticity against the IC root key. The examples cover both Rust (ic-certified-map, RbTree) and Motoko (CertifiedData module), plus the critical gotchas like forgetting to re-certify after upgrades or not checking certificate timestamps on the client. Use this when you need tamper-proof query responses without sacrificing speed.

skills.sh installs: 302
GitHub stars: 39
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add dfinity/icskills --skill certified-variables --agent claude-code

Installs into .claude/skills of the current project.

Files

Certified Variables

A query call is answered by a single replica, without consensus, so a faulty or malicious replica can return fabricated data. Certification closes that gap: during update calls the canister stores a 32-byte hash (usually the root of a Merkle tree over its data) in the subnet's certified state, and query responses carry a certificate signed by the subnet's threshold BLS key. Clients verify the certificate and a Merkle witness, and get a fast query response that is as trustworthy as an update call.