About Contracts Verification

Contracts verification is an important step for the deployment of EVMv1 smart contracts. The goals of the production pipeline of the contracts verification are:

1. Automated verification after each smart contracts deployment.
2. Reproducible verification process locally as a developer.
3. Support major block explorer solutions.
4. Keep the pipeline lean.

Production Pipeline

• It uses truffle-plugin-verify.
• Scripts:
  • info-print-contract-addresses.js
  • etherscan-verify-framework.sh
  • code snippets:

    cd packages/ethereum-contracts
    npx truffle exec --network ${{ matrix.network }} scripts/info-print-contract-addresses.js : addresses.vars
    source addresses.vars
    source tasks/etherscan-verify-framework.sh ${{ matrix.network }}

• Workflows integrated with the pipeline:
  • handler.deploy-to-testnets.yml
• Supported systems:
  • Etherscan and its cousins.
• Supported networks:
  • :ethereum:
  • https://goerli.etherscan.io/
  • https://rinkeby.etherscan.io/
  • https://ropsten.etherscan.io/
  • https://kovan.etherscan.io/
  • :polygon:
  • https://mumbai.polygonscan.com/
  • https://polygonscan.com/
  • :arbitrum:
  • https://testnet.arbiscan.io/
  • https://arbiscan.io/
  • :optimism:
  • https://kovan-optimistic.etherscan.io/
  • https://optimistic.etherscan.io/
  • :avalanche:
  • https://testnet.snowtrace.io/
  • https://snowtrace.io/
• Unsupported:
  • xdai/gnosis chain in general, due to lack of sourcify/blockscout integration.
  • https://avascan.info/, lack of tooling.

Security Considerations

• Verifiability
  • Solidity compiler generates contract metadata and the contract bytecode contains the hash.
• Availability
  • Sourcify seems doing a better job thinking about this problem from the beginning (? reference).
  • Some etherscan-flavor scanners publish the "swarm sources", e.g. https://snowtrace.io/address/0x60377C7016E4cdB03C87EF474896C11cB560752C#code.

Bugs & Future Works

• Arbitrum verificaiton of SuperToken logic contract
• xdai blockscount code verification automation #319
• Use proxy verification feature of truffle-plugin-verify #620