Verify Mainnet Account Abstraction sources - #189
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements a deterministic Mainnet Account Abstraction source verification system for five DOS ID Wallet contracts on DOS Chain Mainnet. It introduces scripts for standard input extraction, immutable-aware bytecode comparison, Blockscout source verification, and Playwright browser UAT, along with comprehensive test suites and design documentation. The review feedback highlights three valuable improvements: stripping comments from Solidity files before parsing imports to avoid build crashes, using npx for Yarn execution to prevent global installation permission failures, and applying jq optional chaining to safely handle potentially null API response fields.
| function importedPaths(content) { | ||
| const paths = []; | ||
| const expressions = [ | ||
| /import\s*["']([^"']+)["']\s*;/g, | ||
| /import\s+[^;]*?\s+from\s*["']([^"']+)["']\s*;/g, | ||
| ]; | ||
| for (const expression of expressions) { | ||
| for (const match of content.matchAll(expression)) { | ||
| paths.push(match[1]); | ||
| } | ||
| } | ||
| return paths; | ||
| } |
There was a problem hiding this comment.
Commented-out imports (e.g., // import "./Foo.sol"; or inside /* ... */ blocks) are currently matched by the regular expressions in importedPaths. This can cause the script to attempt to resolve non-existent or irrelevant files, leading to unexpected build crashes.
To make the import extraction robust, strip single-line and multi-line comments from the Solidity source content before running the regex matches.
function importedPaths(content) {
const paths = [];
const cleanedContent = content
.replace(/\/\*[\s\S]*?\*\//g, '')
.replace(/\/\/.*/g, '');
const expressions = [
/import\s*["']([^"']+)["']\s*;/g,
/import\s+[^;]*?\s+from\s*["']([^"']+)["']\s*;/g,
];
for (const expression of expressions) {
for (const match of cleanedContent.matchAll(expression)) {
paths.push(match[1]);
}
}
return paths;
}| npm install --global yarn@1.22.22 | ||
| yarn --cwd "${aa_checkout}" install --frozen-lockfile --non-interactive |
There was a problem hiding this comment.
Installing yarn globally via npm install --global can fail on environments where the Node.js installation is system-owned or lacks write permissions for global directories.
Since npx is always available alongside npm, you can run the exact version of Yarn directly using npx yarn@1.22.22. This avoids global installation entirely, making the script cleaner, safer, and more portable.
| npm install --global yarn@1.22.22 | |
| yarn --cwd "${aa_checkout}" install --frozen-lockfile --non-interactive | |
| npx yarn@1.22.22 --cwd "${aa_checkout}" install --frozen-lockfile --non-interactive |
| (if $target.viaIR then .compiler_settings.viaIR == true else (.compiler_settings.viaIR // false) == false end) and | ||
| (if $target.key == "entry-point" then (.compiler_settings.metadata.bytecodeHash // "ipfs") == "ipfs" | ||
| else .compiler_settings.metadata.appendCBOR == false and .compiler_settings.metadata.bytecodeHash == "none" end) |
There was a problem hiding this comment.
If compiler_settings or metadata is null or missing in the Blockscout API response, accessing nested properties directly (e.g., .compiler_settings.metadata.bytecodeHash) will cause jq to crash with a Cannot index null with string ... error. This prints noisy errors to stderr and fails the verification check.
Using jq's optional chaining operator ? (e.g., .compiler_settings?.metadata?.bytecodeHash) safely navigates these fields and prevents any potential crashes or log pollution.
| (if $target.viaIR then .compiler_settings.viaIR == true else (.compiler_settings.viaIR // false) == false end) and | |
| (if $target.key == "entry-point" then (.compiler_settings.metadata.bytecodeHash // "ipfs") == "ipfs" | |
| else .compiler_settings.metadata.appendCBOR == false and .compiler_settings.metadata.bytecodeHash == "none" end) | |
| (if $target.viaIR then .compiler_settings?.viaIR == true else (.compiler_settings?.viaIR // false) == false end) and | |
| (if $target.key == "entry-point" then (.compiler_settings?.metadata?.bytecodeHash // "ipfs") == "ipfs" | |
| else .compiler_settings?.metadata?.appendCBOR == false and .compiler_settings?.metadata?.bytecodeHash == "none" end) |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 participant
What changed
Why
The five Mainnet wallet contracts were deployed and active, but their source metadata was not reproducibly verified on DOScan. This change makes source verification repeatable, fail-closed, and tied to the exact deployed bytecode without modifying Blockscout core.
Validation