Truffle deployed contracts can't be verified through Etherscan

[akravin]

• I've asked for help in the Truffle Gitter before filing this issue.
• Also I published a question on stackoverflow site https://stackoverflow.com/questions/44704420/truffle-deployed-contracts-cant-be-verified-through-etherscan

---

Issue

Truffle deployed contracts can't be verified through Etherscan (https://etherscan.io/verifyContract)

Steps to Reproduce

1. Init a new Truffle project:

$ mkdir test-contract
$ cd test-contract
$ truffle init

2. Create a simple Ownable contract (Ownable.sol) in "test-contract/contracts" folder:

pragma solidity ^0.4.11;

contract Ownable {
    address public owner;

    function Ownable() {
        owner = msg.sender;
    }

    modifier onlyOwner {
        if (msg.sender != owner) throw;
        _;
    }

    function transferOwnership(address newOwner) onlyOwner {
        if (newOwner != address(0)) {
            owner = newOwner;
        }
    }
}

3. Compile the Truffle project:

$ cd test_contract
$ truffle compile

4. See the bytecode generated by Truffle compiler in test-contract/build/Ownable.json file in "unlinked-bytecode" attribute.

5. (Optional). Deploy Ownable contract to Ethereum (TEST-NET)

$ cd test-contract
$ truffle migrate

-- Deploy only ownable and standard token
Running migration: 1_initial_migration.js
  Deploying Migrations...
  Migrations: 0x822432d53f6a8e5f2d4dad208fe1eecd33cf053d
Saving successful migration to network...
Saving artifacts...
Running migration: 2_deploy_contracts.js
  Deploying Ownable...
  Ownable: 0x6c8e1b321ce94b12069222b543558d4159527ecd
Saving successful migration to network...

Expected Behavior

The bytecode generated by Truffle must be the same as bytecode generated by Remix (online compiler) or solcjs (local compiler), i.e.:

6060604052341561000c57fe5b5b60008054600160a060020a03191633600160a060020a03161790555b5b610119806100396000396000f300606060405263ffffffff7c01000000000000000000000000000000000000000000000000000000006000350416638da5cb5b81146043578063f2fde38b14606c575bfe5b3415604a57fe5b60506087565b60408051600160a060020a039092168252519081900360200190f35b3415607357fe5b6085600160a060020a03600435166096565b005b600054600160a060020a031681565b60005433600160a060020a0390811691161460b15760006000fd5b600160a060020a0381161560e8576000805473ffffffffffffffffffffffffffffffffffffffff1916600160a060020a0383161790555b5b5b505600a165627a7a723058201eb1de901e30ec9818544272a4c70946cd9cb7cd848237ba3dca118e44d771a60029

Actual Results

The actual bytecode generated by Truffle compiler is different from the bytecodes generated by Remix (online compiler) or solcjs (local compiler):

0x6060604052341561000c57fe5b5b60008054600160a060020a03191633600160a060020a03161790555b5b60f3806100386000396000f300606060405263ffffffff60e060020a6000350416638da5cb5b8114602a578063f2fde38b146053575bfe5b3415603157fe5b6037606e565b60408051600160a060020a039092168252519081900360200190f35b3415605a57fe5b606c600160a060020a0360043516607d565b005b600054600160a060020a031681565b60005433600160a060020a0390811691161460985760006000fd5b600160a060020a0381161560c25760008054600160a060020a031916600160a060020a0383161790555b5b5b505600a165627a7a72305820607fc60d96cffbd50e58fbc028c1e4b6f3dfdf356bd439390481a479ef8d25500029

See https://ropsten.etherscan.io/address/0x6c8e1b321ce94b12069222b543558d4159527ecd

RESULT: The SolJS bytecode is identical to the Remix bytecode but different from the truffle bytecode.

Environment

• Operating System:

OS: Ubuntu 15.10
uname -a
Linux sasha 4.2.0-42-generic #49-Ubuntu SMP Tue Jun 28 21:26:26 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

• Truffle version:

Truffle v3.2.4

• Solidity compiler

0.4.11+commit.68ef5810.Emscripten.clang

• Ethereum client:

geth 1.6.1-stable-021c3c28

• node version:

nodejs v6.3.1

• npm version:

npm 4.6.1

[akravin]

There's a compiler optimization in solc/truffle-compile that in this moment etherscan does not support when compiling contracts.

https://github.com/trufflesuite/truffle-compile/blob/331809c73389f27f9dda40229061bb75b18f27ca/index.js#L70

[interfect]

This is a blocker for me. Nobody is going to trust my deployed contracts if they can't verify them. How can I turn this optimization off?

[interfect]

@mtbitcoin, can you expose the "runs" parameter when verifying contracts on Etherscan?

[mtbitcoin]

does browser solidity have a similiar option for the "runs" parameter?

[akravin]

@interfect, As workaround you can revert runs parameter to its default value 200 in truffle-compile/index.js file. Etherscan has been informed about this issue but I don't know how fast they'll add supporting the "runs" parameter

[elenadimitrova]

@akravin any reason you closed this without a solution being implemented? Rather than just relying on a workaround? This will be a blocker for us too in very near future.

[akravin]

@mtbitcoin, Remix online compiler doesn't have this parameter, but most developers use truffle to deploy their contracts. So the problem is urgent

[mtbitcoin]

@akravin If remix doesn't support this then how do you propose we (Etherscan) fix this problem? Can truffle be configured to be compile without the "run" parameter ?

[akravin]

@mtbitcoin I propose to add "runs" parameter on your verify page in order to eliminate problems with contract verification that were compiled another way rather than Remix or Mist. I think all compiler's options must be supported to verify contract's source code by Etherscan, because developers may change them anytime. In order to support "runs" parameter you may use solcjs and standard input json.
For example, standard input json may be wrote as below:

{
  "language": "Solidity",
  "sources": {
    "MyContract": {
      "content": "pragma solidity ^0.4.11; contract Ownable {address public owner; function Ownable() { owner = msg.sender; } modifier onlyOwner { if (msg.sender != owner) throw; _;} function transferOwnership(address newOwner) onlyOwner { if (newOwner != address(0)) { owner = newOwner; }}}"
    }
  },
  "settings": {
    "optimizer": {
      "enabled": true,
      "runs": 0
    },
    "outputSelection": {
      "*": {
        "MyContract": [
          "evm.bytecode.object"
        ]
      }
    }
  }
}

In this file replace "runs" parameter on user input. After that run solcjs as following:

$ solcjs --standard-json < input.json

Output of this command is output JSON (http://solidity.readthedocs.io/en/develop/using-the-compiler.html) which contains "evm.bytecode.object" tag. You just need to compare it with bytecode in the Ethereum transaction.

PS: Solidity compiler "solc" has separate option "--optimize-runs" for changing this value

[akravin]

@mtbitcoin As I know in truffle "runs" parameter is hardcoded and its default value equals 0 (zero)

[rstormsf]

no solutions on this?

[mtbitcoin]

@akravin Thanks for the info. Looking into this, but it will require a rewrite for our backend code handling the source code verification

Edit: Also "--standard-json < input.json" appears to work only with version 0.4.11 and above.

[mtbitcoin]

From what i understand, solcjs has a "runs" value of 200, so if you can truffle to also "runs" at "200" instead of "0" this will produce the same code (see https://stackoverflow.com/questions/44704420/truffle-deployed-contracts-cant-be-verified-through-etherscan)

[rstormsf]

@mtbitcoin How would you verify a contract that depends on 3rd party libraries like openZeppelin ?
Basically if I have a contract that has lots of nested inherited conracts?