chore: add alternative verification scripts

Signed-off-by: Tomás Migone <[email protected]>

Author: tmigone

packages/horizon/scripts/flatten-verify

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage: ./flatten-verify contracts/payments/GraphPayments.sol
+
+SRC="$1"
+OUT_DIR="build/flattened"
+OUT_BASE="$(basename "$SRC" .sol)"
+OUT_FLAT="${OUT_DIR}/${OUT_BASE}.flattened.sol"
+OUT_CLEAN="${OUT_DIR}/${OUT_BASE}.for-verify.sol"
+
+mkdir -p "$OUT_DIR"
+
+echo "🔹 Flattening $SRC → $OUT_FLAT"
+npx hardhat flatten "$SRC" > "$OUT_FLAT"
+
+echo "🔹 Cleaning SPDX & pragma duplicates → $OUT_CLEAN"
+awk 'BEGIN{spdx=0;pragma=0}
+  /^\/\/ SPDX-License-Identifier:/ { if (spdx++) next }
+  /^pragma solidity/               { if (pragma++) next }
+  { print }' "$OUT_FLAT" > "$OUT_CLEAN"
+
+echo "✅ Done."
+echo "Flattened file: $OUT_FLAT"
+echo "Cleaned verify file: $OUT_CLEAN"

packages/horizon/scripts/verify-debug/compare-bytecode-immutable-aware.ts

@@ -0,0 +1,75 @@
+// scripts/compare-bytecode-immutables-aware.ts
+import fs from 'node:fs'
+
+import { ethers } from 'hardhat'
+
+function stripCborTrailer(hex: string) {
+  if (!hex || hex.length < 6) return hex
+  const lenHex = hex.slice(-4)
+  const len = parseInt(lenHex, 16)
+  const trailerLen = len * 2 + 4 // hex chars
+  if (trailerLen > 0 && trailerLen < hex.length) return hex.slice(0, hex.length - trailerLen)
+  return hex
+}
+
+function maskRanges(hex: string, ranges: { start: number; length: number }[]) {
+  // hex is 0x...; convert to array of bytes (2 hex chars per byte), mask with '??'
+  const body = hex.startsWith('0x') ? hex.slice(2) : hex
+  const bytes = body.match(/.{1,2}/g) ?? []
+  for (const { start, length } of ranges) {
+    for (let i = 0; i < length; i++) {
+      const idx = start + i
+      if (idx >= 0 && idx < bytes.length) bytes[idx] = '??'
+    }
+  }
+  return '0x' + bytes.join('')
+}
+
+async function main() {
+  const address = process.env.ADDRESS!
+  const fqn = process.env.FQN // e.g. contracts/payments/GraphPayments.sol:GraphPayments
+
+  if (!fqn || !address) {
+    console.error('❌ FQN or ADDRESS is not set')
+    process.exit(1)
+  }
+
+  const artifactPath = `build/contracts/${fqn.replace(/:/g, '/')}.json`
+  const artifact = JSON.parse(fs.readFileSync(artifactPath, 'utf8'))
+
+  // on-chain runtime, strip CBOR trailer
+  const onchain = await ethers.provider.getCode(address)
+  const onchainStripped = stripCborTrailer(onchain.toLowerCase())
+
+  // compiled runtime from artifact (still has immutable placeholders)
+  const compiled = (artifact.deployedBytecode as string).toLowerCase()
+  const immRefs = artifact.immutableReferences ?? {} // { <hex slot>: [{ start, length }] }
+
+  // Build ranges: artifact.immutableReferences lists byte offsets (not hex chars)
+  const ranges: { start: number; length: number }[] = []
+  for (const _ of Object.keys(immRefs)) {
+    for (const ref of immRefs[_]) {
+      ranges.push({ start: ref.start, length: ref.length })
+    }
+  }
+
+  // mask CBOR trailer and immutable regions on BOTH sides
+  const compiledStripped = stripCborTrailer(compiled)
+  const maskedOnchain = maskRanges(onchainStripped, ranges)
+  const maskedCompiled = maskRanges(compiledStripped, ranges)
+
+  console.log('Masked on-chain prefix:', maskedOnchain.slice(0, 20), '…', maskedOnchain.length)
+  console.log('Masked compiled pref:', maskedCompiled.slice(0, 20), '…', maskedCompiled.length)
+
+  if (maskedOnchain === maskedCompiled) {
+    console.log('✅ Runtime matches when ignoring immutables & metadata.')
+  } else {
+    console.error('❌ Runtime still differs after masking. Re-check solc settings / viaIR / optimizer.')
+    process.exit(1)
+  }
+}
+
+main().catch((e) => {
+  console.error(e)
+  process.exit(1)
+})

packages/horizon/scripts/verify-debug/compare-bytecode.ts

@@ -0,0 +1,58 @@
+// scripts/compare-bytecode.ts
+import fs from 'node:fs'
+
+import { ethers } from 'hardhat'
+
+function stripCborRuntime(code: string) {
+  // Deployed runtime bytecode ends with a CBOR-encoded metadata whose byte length is stored in the final 2 bytes.
+  // Remove that trailer so metadataHash differences don't confuse us.
+  if (!code || code.length < 4) return code
+  const lenHex = code.slice(-4)
+  const len = parseInt(lenHex, 16)
+  const trailerLen = len * 2 + 4 // hex chars
+  if (trailerLen > 0 && trailerLen < code.length) return code.slice(0, code.length - trailerLen)
+  return code
+}
+
+async function main() {
+  const address = process.env.ADDRESS! // target deployed address
+  const fqn = process.env.FQN // "contracts/payments/GraphPayments.sol:GraphPayments";
+
+  if (!fqn || !address) {
+    console.error('❌ FQN or ADDRESS is not set')
+    process.exit(1)
+  }
+
+  const artifactPath = `build/contracts/${fqn.replace(/:/g, '/')}.json`
+  const artifact = JSON.parse(fs.readFileSync(artifactPath, 'utf8'))
+
+  const onchain = await ethers.provider.getCode(address)
+  const onchainStripped = stripCborRuntime(onchain.toLowerCase())
+
+  // Hardhat artifact has both creation bytecode (bytecode) and deployed runtime (deployedBytecode)
+  const compiled = artifact.deployedBytecode.toLowerCase()
+
+  // If there are link placeholders like __$abcd$__, the bytecode is not linked:
+  if (compiled.includes('__$')) {
+    console.error('⚠️ Artifact has unlinked libraries. Link addresses must match deployment.')
+    process.exit(1)
+  }
+
+  const compiledStripped = stripCborRuntime(compiled)
+
+  console.log('On-chain (stripped) prefix:', onchainStripped.slice(0, 20), '…', onchainStripped.length)
+  console.log('Compiled (stripped)   pref:', compiledStripped.slice(0, 20), '…', compiledStripped.length)
+
+  if (onchainStripped === compiledStripped) {
+    console.log('✅ Runtime matches (ignoring metadata). Problem likely in constructor args / creation code.')
+  } else if (onchainStripped.startsWith(compiledStripped) || compiledStripped.startsWith(onchainStripped)) {
+    console.log('✅ Prefix matches. Differences only in metadata. Check metadata.bytecodeHash and solc version.')
+  } else {
+    console.error('❌ Runtime mismatch. Check solc settings, viaIR, optimizer, libraries, or immutables.')
+    process.exit(1)
+  }
+}
+main().catch((e) => {
+  console.error(e)
+  process.exit(1)
+})

packages/horizon/scripts/verify-debug/compare-creation.ts

@@ -0,0 +1,47 @@
+// scripts/compare-creation.ts
+import fs from 'node:fs'
+
+import { Interface } from 'ethers'
+import { ethers } from 'hardhat'
+
+async function main() {
+  const fqn = process.env.FQN // "contracts/payments/GraphPayments.sol:GraphPayments";
+  const txHash = process.env.TX! // deployment tx hash
+  const args = process.env.ARGS ? JSON.parse(process.env.ARGS) : [] // '[arg1,arg2,...]'
+
+  if (!fqn || !txHash) {
+    console.error('❌ FQN or TX is not set')
+    process.exit(1)
+  }
+
+  const artifactPath = `build/contracts/${fqn.replace(/:/g, '/')}.json`
+  const artifact = JSON.parse(fs.readFileSync(artifactPath, 'utf8'))
+
+  // Creation (init) code is artifact.bytecode with libraries linked + encoded ctor args appended.
+  if (artifact.bytecode.includes('__$')) {
+    console.error('Unlinked libraries in creation bytecode.')
+    process.exit(1)
+  }
+
+  const iface = new Interface(artifact.abi)
+  const encodedArgs = iface.encodeDeploy(args)
+  const compiledInit = (artifact.bytecode + encodedArgs.slice(2)).toLowerCase()
+
+  const tx = await ethers.provider.getTransaction(txHash)
+  if (!tx) {
+    console.error('❌ Transaction not found')
+    process.exit(1)
+  }
+  const deployedInit = (tx.data || '').toLowerCase()
+
+  console.log('compiled init len:', compiledInit.length, ' deployed init len:', deployedInit.length)
+  console.log(
+    compiledInit === deployedInit
+      ? '✅ Creation bytecode matches.'
+      : '❌ Creation bytecode mismatch (ctor args / linking / settings).',
+  )
+}
+main().catch((e) => {
+  console.error(e)
+  process.exit(1)
+})

packages/horizon/scripts/verify-debug/decode-creation-args.ts

@@ -0,0 +1,87 @@
+// scripts/decode-creation-args.ts
+import fs from 'node:fs'
+
+import { ethers } from 'hardhat'
+
+function stripCborTrailer(hex: string) {
+  // Remove trailing CBOR metadata based on the last 2 bytes length
+  if (!hex || hex.length < 6) return hex
+  const lenHex = hex.slice(-4)
+  const len = parseInt(lenHex, 16)
+  const trailerLen = len * 2 + 4 // hex chars
+  if (trailerLen > 0 && trailerLen < hex.length) return hex.slice(0, hex.length - trailerLen)
+  return hex
+}
+
+async function main() {
+  const FQN = process.env.FQN // e.g. "contracts/payments/GraphPayments.sol:GraphPayments"
+  const TX = process.env.TX // deployment tx hash
+
+  if (!FQN || !TX) {
+    console.error('❌ FQN or TX is not set')
+    process.exit(1)
+  }
+
+  const artifactPath = `build/contracts/${FQN.replace(/:/g, '/')}.json`
+  const artifact = JSON.parse(fs.readFileSync(artifactPath, 'utf8'))
+
+  const tx = await ethers.provider.getTransaction(TX)
+  if (!tx?.data) throw new Error('Cannot fetch tx.data; check TX hash / network')
+
+  const txData = tx.data.toLowerCase()
+  let creation = (artifact.bytecode as string).toLowerCase()
+  if (creation.startsWith('0x') === false) creation = '0x' + creation
+
+  // Try exact prefix match first
+  let prefix = creation
+  if (!txData.startsWith(prefix)) {
+    // Try stripping CBOR trailers from both sides just in case
+    prefix = stripCborTrailer(prefix)
+    const txNoCbor = stripCborTrailer(txData)
+    if (txNoCbor.startsWith(prefix)) {
+      // use tx with its trailer stripped as well
+      const argsData = '0x' + txNoCbor.slice(prefix.length)
+      await decode(argsData, artifact)
+      return
+    }
+    // Fallback: find the longest prefix that matches (robust against tiny metadata diffs)
+    let i = Math.min(prefix.length, txData.length)
+    while (i > 2 && !txData.startsWith(prefix.slice(0, i))) i -= 2
+    if (i <= 2) {
+      throw new Error('Creation bytecode prefix not found in tx.data. Check solc settings.')
+    }
+    const argsData = '0x' + txData.slice(i)
+    await decode(argsData, artifact)
+    return
+  }
+
+  const argsData = '0x' + txData.slice(prefix.length)
+  await decode(argsData, artifact)
+}
+
+async function decode(argsData: string, artifact: any) {
+  const ctor = (artifact.abi as any[]).find((x) => x.type === 'constructor')
+  const types = ctor?.inputs?.map((i: any) => i.type) ?? []
+  if (types.length === 0) {
+    if (argsData === '0x' || argsData.length <= 2) {
+      console.log('Constructor has no params. Args: []')
+      return
+    } else {
+      console.warn('No constructor inputs in ABI, but args data present. Types unknown.')
+      console.log('Raw argsData:', argsData)
+      return
+    }
+  }
+
+  const coder = ethers.AbiCoder.defaultAbiCoder()
+  const decoded = coder.decode(types, argsData)
+  // Pretty-print as JSON array so you can reuse directly
+  const printable = decoded.map((v: any) => (typeof v === 'bigint' ? v.toString() : v))
+  console.log('Constructor types:', types)
+  console.log('Decoded args JSON:', JSON.stringify(printable))
+}
+
+main().catch((e) => {
+  console.error(e)
+  process.exit(1)
+})

packages/horizon/scripts/verify-debug/locate-runtime-diff.ts

@@ -0,0 +1,84 @@
+import fs from 'node:fs'
+
+import { ethers } from 'hardhat'
+
+function stripCbor(hex: string) {
+  if (!hex || hex.length < 6) return hex
+  const len = parseInt(hex.slice(-4), 16)
+  const trailer = len * 2 + 4
+  return trailer > 0 && trailer < hex.length ? hex.slice(0, hex.length - trailer) : hex
+}
+
+function hexToBytes(hex: string) {
+  const h = hex.startsWith('0x') ? hex.slice(2) : hex
+  return h.match(/.{1,2}/g)?.map((b) => parseInt(b, 16)) ?? []
+}
+function bytesToHex(a: number[]) {
+  return '0x' + a.map((b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+function mask(bytes: number[], ranges: { start: number; length: number }[]) {
+  const out = bytes.slice()
+  for (const { start, length } of ranges) {
+    for (let i = 0; i < length; i++) {
+      const idx = start + i
+      if (idx >= 0 && idx < out.length) out[idx] = 0xff // sentinel
+    }
+  }
+  return out
+}
+
+function firstDiff(a: number[], b: number[]) {
+  const n = Math.min(a.length, b.length)
+  for (let i = 0; i < n; i++) if (a[i] !== b[i]) return i
+  if (a.length !== b.length) return n
+  return -1
+}
+
+async function main() {
+  const ADDRESS = process.env.ADDRESS
+  const FQN = process.env.FQN
+  if (!FQN || !ADDRESS) {
+    console.error('❌ FQN or ADDRESS is not set')
+    process.exit(1)
+  }
+
+  const artifactPath = `build/contracts/${FQN.replace(/:/g, '/')}.json`
+  const art = JSON.parse(fs.readFileSync(artifactPath, 'utf8'))
+
+  const on = stripCbor((await ethers.provider.getCode(ADDRESS)).toLowerCase())
+  const comp = stripCbor((art.deployedBytecode as string).toLowerCase())
+
+  // Gather immutable ranges from artifact
+  const immRefs = art.immutableReferences ?? {}
+  const ranges: { start: number; length: number }[] = []
+  for (const k of Object.keys(immRefs)) for (const r of immRefs[k]) ranges.push({ start: r.start, length: r.length })
+
+  console.log('immutable ranges:', ranges)
+
+  const onBytes = hexToBytes(on)
+  const compBytes = hexToBytes(comp)
+
+  // Mask immutables on both sides
+  const onMasked = mask(onBytes, ranges)
+  const compMasked = mask(compBytes, ranges)
+
+  const i = firstDiff(onMasked, compMasked)
+  if (i === -1) {
+    console.log('✅ Runtime matches after masking immutables & stripping metadata.')
+    return
+  }
+
+  const lo = Math.max(0, i - 32),
+    hi = Math.min(onMasked.length, i + 32)
+  console.log('❌ First diff at byte offset:', i)
+  console.log('on-chain   :', bytesToHex(onBytes.slice(lo, hi)))
+  console.log('compiled   :', bytesToHex(compBytes.slice(lo, hi)))
+  console.log('on-masked  :', bytesToHex(onMasked.slice(lo, hi)))
+  console.log('comp-masked:', bytesToHex(compMasked.slice(lo, hi)))
+}
+
+main().catch((e) => {
+  console.error(e)
+  process.exit(1)
+})