Contract source code verification in retrospect

[tobikuhlmann]

Expected Behavior

• We should be able to verify contracts in retrospect, after they got deployed or automatically verify contracts upon deployment
• Example contract that I couldn't get verified even with looking deeper into it is ExchangeEURProxy.sol: https://explorer.celo.org/address/0xe383394b913d7302c49f794c7d3243c429d53d1d/transactions

Current Behavior

• It's very hard or impossible to rebuild the metadata locally for an exact match with the deployed bytecode on-chain as truffle hashes absolute filepaths into the bytecode
• If you're not the original migrator of a contract, and don't know the exact folder structure of the migrator, and they used truffle to generate the artefacts (so the absolute file paths are embedded in the metadata and hashed into the bytecode), and they haven't verified it themselves - there is no way to compile it yourself such that your locally build metadata matches the deployed bytecode on-chain

[tobikuhlmann]

Related: ethereum/sourcify#27 and ethereum/sourcify#24

[tobikuhlmann]

Related: trufflesuite/truffle-compile#77

[aaronmboyd]

Note this is mostly a Truffle-specific issue. If the original migrator used hardhat or even generates metadata manually this is not a problem.

I realise now the old issue 77 under truffle-compile is a deprecated repository and no longer maintained. The new version is trufflesuite/truffle and there is a replacement issue covering the same thing: trufflesuite/truffle#1621, but it is definitely stale.

More importantly, there is a larger conversation going on with the Solidity compiler related to removing absolute paths for many reasons, including non-deterministic swarm hashes in compiled bytecode: ethereum/solidity#11410

[yorhodes]

We can resolve this by migrating our internal release tooling to Hardhat but it is difficult to prioritize #8118

[aaronmboyd]

@yorhodes This has been resolved by truffle team, no need to migrate to hardhat - trufflesuite/truffle#4119

It looks like with this merge: trufflesuite/truffle#4137 the project root will be noted as project:// instead of the entire absolute file path on the machine you build/migrate with.

@carterqw2 This will simplify the Blockscout verification explainer documentation significantly. We should both update the default truffle version for all Celo contracts going forward to utilise this fix.

[yorhodes]

unfortunately many of the deployed core contracts will forever be associated with this absolute path metadata unless they are upgraded
definitely great to hear that future deployments do not have to suffer from this limitation

[carterqw2]

That's nice, thanks for the update @aaronmboyd!

[github-actions]

This issue is stale and will be closed in 30 days without activity