feat: auto verify contracts after deployment (#272)

# Automatic Smart Contract Verification Integration

**Resolves:**
[#214](#214)

This pull request implements **automatic smart contract verification**
across deployment scripts in the `service_contracts/tools` directory,
utilizing the `filfox-verifier` tool to verify contracts on the Filecoin
network.
The verification process is controlled via the `AUTO_VERIFY` environment
variable and enhances deployment reliability through **automated
post-deployment validation**.

# RESOLVES #214 

---

## 🧩 Changes Made

### ✅ `deploy-all-warm-storage-calibnet.sh`
- Added comprehensive verification for **all major contracts** and
**proxy contracts**.
- Added **automatic dependency installation** and **chain ID
detection**.
- Integrated end-to-end verification sequence for the full warm storage
deployment pipeline.

### ✅ `deploy-registry-calibnet.sh`
- Integrated verification for both **registry implementation** and
**proxy contracts**.
- Uses consistent logging and automatic chain identification.

### ✅ `deploy-session-key-registry.sh`
- Implemented **post-deployment verification** for the **Session Key
Registry** contract.

### ✅ `deploy-warm-storage-view.sh`
- Added verification steps for the **Warm Storage State View** contract.

### ✅ `deploy-warm-storage-implementation-only.sh`
- Included verification for the **Warm Storage Implementation** contract
after deployment.

---

Author: DarkLord017

service_contracts/tools/README.md

@@ -52,9 +52,11 @@ The following parameters are critical for proof generation and validation. They
 ## Environment Variables
 
 ### Required for all scripts:
-- `KEYSTORE` - Path to the Ethereum keystore file
+These scripts now follow forge/cast's environment variable conventions. Set the following environment variables instead of passing flags:
+- `ETH_KEYSTORE` - Path to the Ethereum keystore file (or keep using `KEYSTORE` and it will be mapped)
 - `PASSWORD` - Password for the keystore (can be empty string if no password)
-- `RPC_URL` - RPC endpoint for Calibration testnet
+- `ETH_RPC_URL` - RPC endpoint for Calibration testnet (e.g. `https://api.calibration.node.glif.io/rpc/v1`)
+- `ETH_FROM` - Optional: address to use as deployer (forge/cast default is taken from the keystore)
 
 ### Required for specific scripts:
 - `deploy-warm-storage-calibnet.sh` requires:
@@ -72,11 +74,13 @@ The following parameters are critical for proof generation and validation. They
 ### Fresh Deployment (All Contracts)
 
 ```bash
-export KEYSTORE="/path/to/keystore.json"
+
+export ETH_KEYSTORE="/path/to/keystore.json"
 export PASSWORD="your-password"
-export RPC_URL="https://api.calibration.node.glif.io/rpc/v1"
+export ETH_RPC_URL="https://api.calibration.node.glif.io/rpc/v1"
 export CHALLENGE_FINALITY="10"  # Use "150" for mainnet
 
+
 # Optional: Custom proving periods
 export MAX_PROVING_PERIOD="240"        # 240 epochs for calibnet, 2880 for mainnet
 export CHALLENGE_WINDOW_SIZE="30"      # 30 epochs for calibnet, 60 for mainnet

service_contracts/tools/deploy-all-warm-storage.sh

@@ -26,21 +26,24 @@ SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
 
 echo "Deploying all Warm Storage contracts"
 
-if [ -z "$RPC_URL" ]; then
-  echo "Error: RPC_URL is not set"
+if [ -z "$ETH_RPC_URL" ]; then
+  echo "Error: ETH_RPC_URL is not set"
   exit 1
 fi
 
 # Auto-detect chain ID from RPC
-CHAIN_ID=$(cast chain-id --rpc-url "$RPC_URL")
-if [ -z "$CHAIN_ID" ]; then
-  echo "Error: Failed to detect chain ID from RPC"
-  exit 1
+if [ -z "$CHAIN" ]; then
+  export CHAIN=$(cast chain-id)
+  if [ -z "$CHAIN" ]; then
+    echo "Error: Failed to detect chain ID from RPC"
+    exit 1
+  fi
 fi
 
 # Set network-specific configuration based on chain ID
-# See service_contracts/tools/README.md for deployment parameter documentation
-case "$CHAIN_ID" in
+# NOTE: CHALLENGE_FINALITY should always be 150 in production for security.
+# Calibnet uses lower values for faster testing and development.
+case "$CHAIN" in
   "314159")
     NETWORK_NAME="calibnet"
     # Network-specific addresses for calibnet
@@ -64,12 +67,12 @@ case "$CHAIN_ID" in
     echo "  Supported networks:"
     echo "    314159 - Filecoin Calibration testnet"
     echo "    314    - Filecoin mainnet"
-    echo "  Detected chain ID: $CHAIN_ID"
+    echo "  Detected chain ID: $CHAIN"
     exit 1
     ;;
 esac
 
-echo "Detected Chain ID: $CHAIN_ID ($NETWORK_NAME)"
+echo "Detected Chain ID: $CHAIN ($NETWORK_NAME)"
 
 if [ "$DRY_RUN" != "true" ] && [ -z "$KEYSTORE" ]; then
   echo "Error: KEYSTORE is not set (required for actual deployment)"
@@ -172,13 +175,13 @@ if [ "$DRY_RUN" = "true" ]; then
         echo "🧪 Using dummy SessionKeyRegistry address: $SESSION_KEY_REGISTRY_ADDRESS"
     fi
 else
-    if [ -z "$KEYSTORE" ]; then
-        echo "Error: KEYSTORE is not set (required for actual deployment)"
+    if [ -z "$ETH_KEYSTORE" ]; then
+        echo "Error: ETH_KEYSTORE is not set (required for actual deployment)"
         exit 1
     fi
 
-    ADDR=$(cast wallet address --keystore "$KEYSTORE" --password "$PASSWORD")
-    NONCE="$(cast nonce --rpc-url "$RPC_URL" "$ADDR")"
+    ADDR=$(cast wallet address  --password "$PASSWORD")
+    NONCE="$(cast nonce "$ADDR")"
     BROADCAST_FLAG="--broadcast"
     echo "Deploying contracts from address $ADDR"
     echo "🚀 Will deploy and broadcast all transactions"
@@ -203,7 +206,8 @@ if [ "$DRY_RUN" = "true" ]; then
         exit 1
     fi
 else
-    VERIFIER_IMPLEMENTATION_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE --chain-id $CHAIN_ID lib/pdp/src/PDPVerifier.sol:PDPVerifier | grep "Deployed to" | awk '{print $3}')
+    # forge and cast will read ETH_RPC_URL, ETH_KEYSTORE, PASSWORD, ETH_FROM from the environment
+    VERIFIER_IMPLEMENTATION_ADDRESS=$(forge create --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE lib/pdp/src/PDPVerifier.sol:PDPVerifier | grep "Deployed to" | awk '{print $3}')
     if [ -z "$VERIFIER_IMPLEMENTATION_ADDRESS" ]; then
         echo "Error: Failed to extract PDPVerifier contract address"
         exit 1
@@ -222,7 +226,7 @@ if [ "$DRY_RUN" = "true" ]; then
     PDP_VERIFIER_ADDRESS="0x2345678901234567890123456789012345678901"  # Dummy address for dry-run
     echo "✅ PDPVerifier proxy deployment planned"
 else
-    PDP_VERIFIER_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE --chain-id $CHAIN_ID lib/pdp/src/ERC1967Proxy.sol:MyERC1967Proxy --constructor-args $VERIFIER_IMPLEMENTATION_ADDRESS $INIT_DATA | grep "Deployed to" | awk '{print $3}')
+    PDP_VERIFIER_ADDRESS=$(forge create --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE lib/pdp/src/ERC1967Proxy.sol:MyERC1967Proxy --constructor-args $VERIFIER_IMPLEMENTATION_ADDRESS $INIT_DATA | grep "Deployed to" | awk '{print $3}')
     if [ -z "$PDP_VERIFIER_ADDRESS" ]; then
         echo "Error: Failed to extract PDPVerifier proxy address"
         exit 1
@@ -244,7 +248,7 @@ if [ "$DRY_RUN" = "true" ]; then
         exit 1
     fi
 else
-    PAYMENTS_CONTRACT_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE --chain-id $CHAIN_ID lib/fws-payments/src/Payments.sol:Payments | grep "Deployed to" | awk '{print $3}')
+    PAYMENTS_CONTRACT_ADDRESS=$(forge create --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE lib/fws-payments/src/Payments.sol:Payments | grep "Deployed to" | awk '{print $3}')
     if [ -z "$PAYMENTS_CONTRACT_ADDRESS" ]; then
         echo "Error: Failed to extract Payments contract address"
         exit 1
@@ -266,7 +270,7 @@ if [ "$DRY_RUN" = "true" ]; then
         exit 1
     fi
 else
-    REGISTRY_IMPLEMENTATION_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE --chain-id $CHAIN_ID src/ServiceProviderRegistry.sol:ServiceProviderRegistry | grep "Deployed to" | awk '{print $3}')
+    REGISTRY_IMPLEMENTATION_ADDRESS=$(forge create --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE src/ServiceProviderRegistry.sol:ServiceProviderRegistry | grep "Deployed to" | awk '{print $3}')
     if [ -z "$REGISTRY_IMPLEMENTATION_ADDRESS" ]; then
         echo "Error: Failed to extract ServiceProviderRegistry implementation address"
         exit 1
@@ -285,7 +289,7 @@ if [ "$DRY_RUN" = "true" ]; then
     SERVICE_PROVIDER_REGISTRY_PROXY_ADDRESS="0x5678901234567890123456789012345678901234"  # Dummy address for dry-run
     echo "✅ ServiceProviderRegistry proxy deployment planned"
 else
-    SERVICE_PROVIDER_REGISTRY_PROXY_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE --chain-id $CHAIN_ID lib/pdp/src/ERC1967Proxy.sol:MyERC1967Proxy --constructor-args $REGISTRY_IMPLEMENTATION_ADDRESS $REGISTRY_INIT_DATA | grep "Deployed to" | awk '{print $3}')
+    SERVICE_PROVIDER_REGISTRY_PROXY_ADDRESS=$(forge create --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE lib/pdp/src/ERC1967Proxy.sol:MyERC1967Proxy --constructor-args $REGISTRY_IMPLEMENTATION_ADDRESS $REGISTRY_INIT_DATA | grep "Deployed to" | awk '{print $3}')
     if [ -z "$SERVICE_PROVIDER_REGISTRY_PROXY_ADDRESS" ]; then
         echo "Error: Failed to extract ServiceProviderRegistry proxy address"
         exit 1
@@ -307,7 +311,7 @@ if [ "$DRY_RUN" = "true" ]; then
     SERVICE_PAYMENTS_IMPLEMENTATION_ADDRESS="0x6789012345678901234567890123456789012345"  # Dummy address for dry-run
     echo "✅ FilecoinWarmStorageService implementation deployment planned"
 else
-    SERVICE_PAYMENTS_IMPLEMENTATION_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE --chain-id $CHAIN_ID src/FilecoinWarmStorageService.sol:FilecoinWarmStorageService --constructor-args $PDP_VERIFIER_ADDRESS $PAYMENTS_CONTRACT_ADDRESS $USDFC_TOKEN_ADDRESS $FILBEAM_BENEFICIARY_ADDRESS $SERVICE_PROVIDER_REGISTRY_PROXY_ADDRESS $SESSION_KEY_REGISTRY_ADDRESS | grep "Deployed to" | awk '{print $3}')
+    SERVICE_PAYMENTS_IMPLEMENTATION_ADDRESS=$(forge create --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE src/FilecoinWarmStorageService.sol:FilecoinWarmStorageService --constructor-args $PDP_VERIFIER_ADDRESS $PAYMENTS_CONTRACT_ADDRESS $USDFC_TOKEN_ADDRESS $FILBEAM_BENEFICIARY_ADDRESS $SERVICE_PROVIDER_REGISTRY_PROXY_ADDRESS $SESSION_KEY_REGISTRY_ADDRESS | grep "Deployed to" | awk '{print $3}')
     if [ -z "$SERVICE_PAYMENTS_IMPLEMENTATION_ADDRESS" ]; then
         echo "Error: Failed to extract FilecoinWarmStorageService contract address"
         exit 1
@@ -331,7 +335,7 @@ if [ "$DRY_RUN" = "true" ]; then
     WARM_STORAGE_SERVICE_ADDRESS="0x7890123456789012345678901234567890123456"  # Dummy address for dry-run
     echo "✅ FilecoinWarmStorageService proxy deployment planned"
 else
-    WARM_STORAGE_SERVICE_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE --chain-id $CHAIN_ID lib/pdp/src/ERC1967Proxy.sol:MyERC1967Proxy --constructor-args $SERVICE_PAYMENTS_IMPLEMENTATION_ADDRESS $INIT_DATA | grep "Deployed to" | awk '{print $3}')
+    WARM_STORAGE_SERVICE_ADDRESS=$(forge create --password "$PASSWORD" $BROADCAST_FLAG --nonce $NONCE lib/pdp/src/ERC1967Proxy.sol:MyERC1967Proxy --constructor-args $SERVICE_PAYMENTS_IMPLEMENTATION_ADDRESS $INIT_DATA | grep "Deployed to" | awk '{print $3}')
     if [ -z "$WARM_STORAGE_SERVICE_ADDRESS" ]; then
         echo "Error: Failed to extract FilecoinWarmStorageService proxy address"
         exit 1
@@ -389,3 +393,24 @@ echo "FilBeam controller address: $FILBEAM_CONTROLLER_ADDRESS"
 echo "FilBeam beneficiary address: $FILBEAM_BENEFICIARY_ADDRESS"
 echo "Service name: $SERVICE_NAME"
 echo "Service description: $SERVICE_DESCRIPTION"
+
+# Contract verification
+if [ "$DRY_RUN" = "false" ] && [ "${AUTO_VERIFY:-true}" = "true" ]; then
+    echo
+    echo "🔍 Starting automatic contract verification..."
+    
+    pushd "$(dirname "$0")/.." >/dev/null
+    source tools/verify-contracts.sh
+    
+    verify_contracts_batch \
+        "$VERIFIER_IMPLEMENTATION_ADDRESS,lib/pdp/src/PDPVerifier.sol:PDPVerifier" \
+        "$PDP_VERIFIER_ADDRESS,lib/pdp/src/ERC1967Proxy.sol:MyERC1967Proxy" \
+        "$PAYMENTS_CONTRACT_ADDRESS,lib/fws-payments/src/Payments.sol:Payments" \
+        "$REGISTRY_IMPLEMENTATION_ADDRESS,src/ServiceProviderRegistry.sol:ServiceProviderRegistry" \
+        "$SERVICE_PROVIDER_REGISTRY_PROXY_ADDRESS,lib/openzeppelin-contracts/contracts/proxy/ERC1967/ERC1967Proxy.sol:ERC1967Proxy" \
+        "$SERVICE_PAYMENTS_IMPLEMENTATION_ADDRESS,src/FilecoinWarmStorageService.sol:FilecoinWarmStorageService" \
+        "$WARM_STORAGE_SERVICE_ADDRESS,lib/openzeppelin-contracts/contracts/proxy/ERC1967/ERC1967Proxy.sol:ERC1967Proxy" \
+        "$WARM_STORAGE_VIEW_ADDRESS,src/FilecoinWarmStorageServiceStateView.sol:FilecoinWarmStorageServiceStateView"
+    
+    popd >/dev/null
+fi

service_contracts/tools/deploy-registry-calibnet.sh

@@ -5,15 +5,18 @@
 # Assumption: forge, cast, jq are in the PATH
 # Assumption: called from contracts directory so forge paths work out
 #
+
 echo "Deploying Service Provider Registry Contract"
 
-if [ -z "$RPC_URL" ]; then
-  echo "Error: RPC_URL is not set"
+export CHAIN=314159
+
+if [ -z "$ETH_RPC_URL" ]; then
+  echo "Error: ETH_RPC_URL is not set"
   exit 1
 fi
 
-if [ -z "$KEYSTORE" ]; then
-  echo "Error: KEYSTORE is not set"
+if [ -z "$ETH_KEYSTORE" ]; then
+  echo "Error: ETH_KEYSTORE is not set"
   exit 1
 fi
 
@@ -22,23 +25,23 @@ if [ -z "$PASSWORD" ]; then
   echo "Warning: PASSWORD is not set, using empty password"
 fi
 
-ADDR=$(cast wallet address --keystore "$KEYSTORE" --password "$PASSWORD")
+ADDR=$(cast wallet address --password "$PASSWORD")
 echo "Deploying contracts from address $ADDR"
 
-# Get current balance
-BALANCE=$(cast balance --rpc-url "$RPC_URL" "$ADDR")
+# Get current balance and nonce (cast will use ETH_RPC_URL)
+BALANCE=$(cast balance "$ADDR")
 echo "Deployer balance: $BALANCE"
 
-NONCE="$(cast nonce --rpc-url "$RPC_URL" "$ADDR")"
+NONCE="$(cast nonce "$ADDR")"
 echo "Starting nonce: $NONCE"
 
 # Deploy ServiceProviderRegistry implementation
 echo ""
 echo "=== STEP 1: Deploying ServiceProviderRegistry Implementation ==="
-REGISTRY_IMPLEMENTATION_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" --broadcast --nonce $NONCE --chain-id 314159 src/ServiceProviderRegistry.sol:ServiceProviderRegistry --optimizer-runs 1 --via-ir | grep "Deployed to" | awk '{print $3}')
+REGISTRY_IMPLEMENTATION_ADDRESS=$(forge create --password "$PASSWORD" --broadcast --nonce $NONCE src/ServiceProviderRegistry.sol:ServiceProviderRegistry --optimizer-runs 1 --via-ir | grep "Deployed to" | awk '{print $3}')
 if [ -z "$REGISTRY_IMPLEMENTATION_ADDRESS" ]; then
-    echo "Error: Failed to extract ServiceProviderRegistry implementation address"
-    exit 1
+  echo "Error: Failed to extract ServiceProviderRegistry implementation address"
+  exit 1
 fi
 echo "✓ ServiceProviderRegistry implementation deployed at: $REGISTRY_IMPLEMENTATION_ADDRESS"
 NONCE=$(expr $NONCE + "1")
@@ -50,25 +53,25 @@ echo "=== STEP 2: Deploying ServiceProviderRegistry Proxy ==="
 INIT_DATA=$(cast calldata "initialize()")
 echo "Initialization calldata: $INIT_DATA"
 
-REGISTRY_PROXY_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" --broadcast --nonce $NONCE --chain-id 314159 lib/pdp/src/ERC1967Proxy.sol:MyERC1967Proxy --constructor-args $REGISTRY_IMPLEMENTATION_ADDRESS $INIT_DATA --optimizer-runs 1 --via-ir | grep "Deployed to" | awk '{print $3}')
+REGISTRY_PROXY_ADDRESS=$(forge create --password "$PASSWORD" --broadcast --nonce $NONCE lib/pdp/src/ERC1967Proxy.sol:MyERC1967Proxy --constructor-args $REGISTRY_IMPLEMENTATION_ADDRESS $INIT_DATA --optimizer-runs 1 --via-ir | grep "Deployed to" | awk '{print $3}')
 if [ -z "$REGISTRY_PROXY_ADDRESS" ]; then
-    echo "Error: Failed to extract ServiceProviderRegistry proxy address"
-    exit 1
+  echo "Error: Failed to extract ServiceProviderRegistry proxy address"
+  exit 1
 fi
 echo "✓ ServiceProviderRegistry proxy deployed at: $REGISTRY_PROXY_ADDRESS"
 
 # Verify deployment by calling version() on the proxy
 echo ""
 echo "=== STEP 3: Verifying Deployment ==="
-VERSION=$(cast call --rpc-url "$RPC_URL" $REGISTRY_PROXY_ADDRESS "VERSION()(string)")
+VERSION=$(cast call $REGISTRY_PROXY_ADDRESS "version()(string)")
 if [ -z "$VERSION" ]; then
-    echo "Warning: Could not verify contract version"
+  echo "Warning: Could not verify contract version"
 else
-    echo "✓ Contract version: $VERSION"
+  echo "✓ Contract version: $VERSION"
 fi
 
 # Get registration fee
-FEE=$(cast call --rpc-url "$RPC_URL" $REGISTRY_PROXY_ADDRESS "REGISTRATION_FEE()(uint256)")
+FEE=$(cast call $REGISTRY_PROXY_ADDRESS "REGISTRATION_FEE()(uint256)")
 if [ -z "$FEE" ]; then
     echo "Warning: Could not retrieve registration fee"
     FEE_IN_FIL="unknown"
@@ -78,11 +81,18 @@ else
 fi
 
 # Get burn actor address
-BURN_ACTOR=$(cast call --rpc-url "$RPC_URL" $REGISTRY_PROXY_ADDRESS "BURN_ACTOR()(address)")
+BURN_ACTOR=$(cast call $REGISTRY_PROXY_ADDRESS "BURN_ACTOR()(address)")
 if [ -z "$BURN_ACTOR" ]; then
-    echo "Warning: Could not retrieve burn actor address"
+  echo "Warning: Could not retrieve burn actor address"
 else
-    echo "✓ Burn actor address: $BURN_ACTOR"
+  echo "✓ Burn actor address: $BURN_ACTOR"
+fi
+
+# Get contract version (this should be used instead of hardcoded version)
+CONTRACT_VERSION=$(cast call --rpc-url "$RPC_URL" $REGISTRY_PROXY_ADDRESS "VERSION()(string)")
+if [ -z "$CONTRACT_VERSION" ]; then
+    echo "Warning: Could not retrieve contract version"
+    CONTRACT_VERSION="Unknown"
 fi
 
 # Get contract version (this should be used instead of hardcoded version)
@@ -97,7 +107,7 @@ echo ""
 echo "=========================================="
 echo "=== DEPLOYMENT SUMMARY ==="
 echo "=========================================="
-echo "ServiceProviderRegistry Implementation: $REGISTRY_IMPLEMENTATION_ADDRESS" 
+echo "ServiceProviderRegistry Implementation: $REGISTRY_IMPLEMENTATION_ADDRESS"
 echo "ServiceProviderRegistry Proxy: $REGISTRY_PROXY_ADDRESS"
 echo "=========================================="
 echo ""
@@ -121,4 +131,18 @@ echo "    cast call $REGISTRY_PROXY_ADDRESS \"getAllActiveProviders()(uint256[])
 echo "  State changes (requires registration fee):"
 echo "    Register as provider (requires proper encoding of PDPData)"
 echo ""
-echo "=========================================="
+
+# Automatic contract verification
+if [ "${AUTO_VERIFY:-true}" = "true" ]; then
+  echo
+  echo "🔍 Starting automatic contract verification..."
+
+  pushd "$(dirname $0)/.." >/dev/null
+  source tools/verify-contracts.sh
+  verify_contracts_batch "$REGISTRY_IMPLEMENTATION_ADDRESS,src/ServiceProviderRegistry.sol:ServiceProviderRegistry"
+  popd >/dev/null
+else
+  echo
+  echo "⏭️  Skipping automatic verification (export AUTO_VERIFY=true to enable)"
+fi
+echo "=========================================="

service_contracts/tools/deploy-session-key-registry.sh

@@ -9,34 +9,49 @@
 # - called from service_contracts directory
 # - PATH has forge and cast
 
-if [ -z "$RPC_URL" ]; then
-  echo "Error: RPC_URL is not set"
+if [ -z "$ETH_RPC_URL" ]; then
+  echo "Error: ETH_RPC_URL is not set"
   exit 1
 fi
 
 # Auto-detect chain ID from RPC if not already set
-if [ -z "$CHAIN_ID" ]; then
-  CHAIN_ID=$(cast chain-id --rpc-url "$RPC_URL")
-  if [ -z "$CHAIN_ID" ]; then
+if [ -z "$CHAIN" ]; then
+  export CHAIN=$(cast chain-id)
+  if [ -z "$CHAIN" ]; then
     echo "Error: Failed to detect chain ID from RPC"
     exit 1
   fi
 fi
 
-if [ -z "$KEYSTORE" ]; then
-  echo "Error: KEYSTORE is not set"
+
+if [ -z "$ETH_KEYSTORE" ]; then
+  echo "Error: ETH_KEYSTORE is not set"
   exit 1
 fi
 
-ADDR=$(cast wallet address --keystore "$KEYSTORE" --password "$PASSWORD")
+ADDR=$(cast wallet address --password "$PASSWORD")
 echo "Deploying SessionKeyRegistry from address $ADDR..."
 
 # Check if NONCE is already set (when called from main deploy script)
 # If not, get it from the network (when running standalone)
 if [ -z "$NONCE" ]; then
-  NONCE="$(cast nonce --rpc-url "$RPC_URL" "$ADDR")"
+  NONCE="$(cast nonce "$ADDR")"
 fi
 
-export SESSION_KEY_REGISTRY_ADDRESS=$(forge create --rpc-url "$RPC_URL" --keystore "$KEYSTORE" --password "$PASSWORD" --broadcast --nonce $NONCE --chain-id $CHAIN_ID lib/session-key-registry/src/SessionKeyRegistry.sol:SessionKeyRegistry | grep "Deployed to" | awk '{print $3}')
+export SESSION_KEY_REGISTRY_ADDRESS=$(forge create --password "$PASSWORD" --broadcast --nonce $NONCE lib/session-key-registry/src/SessionKeyRegistry.sol:SessionKeyRegistry | grep "Deployed to" | awk '{print $3}')
 
 echo SessionKeyRegistry deployed at $SESSION_KEY_REGISTRY_ADDRESS
+
+# Automatic contract verification
+if [ "${AUTO_VERIFY:-true}" = "true" ]; then
+  echo
+  echo "🔍 Starting automatic contract verification..."
+
+  pushd "$(dirname $0)/.." >/dev/null
+  source tools/verify-contracts.sh
+  verify_contracts_batch "$SESSION_KEY_REGISTRY_ADDRESS,src/SessionKeyRegistry.sol:SessionKeyRegistry"
+  popd >/dev/null
+else
+  echo
+  echo "⏭️  Skipping automatic verification (export AUTO_VERIFY=true to enable)"
+fi