diff --git a/docs.json b/docs.json index a1c021e4..6047ba80 100644 --- a/docs.json +++ b/docs.json @@ -8,6 +8,10 @@ "dark": "#614ff4" }, "redirects": [ + { + "source": "/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta", + "destination": "/hedera/core-concepts/smart-contracts/verifying-smart-contracts" + }, { "source": "/hedera/getting-started", "destination": "/#getting-started" @@ -389,7 +393,7 @@ "hedera/core-concepts/smart-contracts/json-rpc-relay", "hedera/core-concepts/smart-contracts/deploying-smart-contracts", "hedera/core-concepts/smart-contracts/smart-contract-addresses", - "hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta", + "hedera/core-concepts/smart-contracts/verifying-smart-contracts", "hedera/core-concepts/smart-contracts/smart-contract-traceability", { "group": "Tokens Managed by Smart Contracts", @@ -1120,25 +1124,17 @@ "group": "Smart Contract Verification API", "pages": [ "hedera/sdks-and-apis/smart-contract-verification-api", - "smart-contract-verification-api.yaml POST /verify", - "smart-contract-verification-api.yaml POST /verify/etherscan", - "smart-contract-verification-api.yaml POST /verify/solc-json", - "smart-contract-verification-api.yaml GET /check-all-by-addresses", - "smart-contract-verification-api.yaml GET /check-by-addresses", - "smart-contract-verification-api.yaml GET /files/any/{chain}/{address}", - "smart-contract-verification-api.yaml GET /files/{chain}/{address}", - "smart-contract-verification-api.yaml GET /repository/contracts/{matchType}/{chain}/{address}/{filePath}", - "smart-contract-verification-api.yaml GET /files/contracts/{chain}", - "smart-contract-verification-api.yaml GET /files/tree/any/{chain}/{address}", - "smart-contract-verification-api.yaml GET /files/tree/{chain}/{address}", - "smart-contract-verification-api.yaml GET /session/data", - "smart-contract-verification-api.yaml POST /session/clear", - "smart-contract-verification-api.yaml POST /session/input-files", - "smart-contract-verification-api.yaml POST /session/input-contract", - "smart-contract-verification-api.yaml POST /session/verify-checked", - "smart-contract-verification-api.yaml POST /session/input-solc-json", - "smart-contract-verification-api.yaml POST /session/verify/etherscan", - "smart-contract-verification-api.yaml POST /change-log-level" + "smart-contract-verification-api.yaml POST /v2/verify/{chainId}/{address}", + "smart-contract-verification-api.yaml POST /v2/verify/metadata/{chainId}/{address}", + "smart-contract-verification-api.yaml POST /v2/verify/etherscan/{chainId}/{address}", + "smart-contract-verification-api.yaml POST /v2/verify/similarity/{chainId}/{address}", + "smart-contract-verification-api.yaml GET /v2/verify/{verificationId}", + "smart-contract-verification-api.yaml GET /v2/contract/{chainId}/{address}", + "smart-contract-verification-api.yaml GET /v2/contract/all-chains/{address}", + "smart-contract-verification-api.yaml GET /v2/contracts/{chainId}", + "smart-contract-verification-api.yaml GET /health", + "smart-contract-verification-api.yaml GET /version", + "smart-contract-verification-api.yaml GET /chains" ] } ] diff --git a/hedera/core-concepts.mdx b/hedera/core-concepts.mdx index aea5ebd9..0d8f226b 100644 --- a/hedera/core-concepts.mdx +++ b/hedera/core-concepts.mdx @@ -32,7 +32,7 @@ sidebarTitle: Overview - + diff --git a/hedera/core-concepts/smart-contracts.mdx b/hedera/core-concepts/smart-contracts.mdx index 262b47b2..5b00562a 100644 --- a/hedera/core-concepts/smart-contracts.mdx +++ b/hedera/core-concepts/smart-contracts.mdx @@ -25,7 +25,7 @@ sidebarTitle: Overview - + diff --git a/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta.mdx b/hedera/core-concepts/smart-contracts/verifying-smart-contracts.mdx similarity index 72% rename from hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta.mdx rename to hedera/core-concepts/smart-contracts/verifying-smart-contracts.mdx index c3323103..5c944dfd 100644 --- a/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta.mdx +++ b/hedera/core-concepts/smart-contracts/verifying-smart-contracts.mdx @@ -5,12 +5,12 @@ title: "Verifying Smart Contracts" Smart contract verification is the process of verifying that the smart contract bytecode uploaded to the network matches the expected smart contract source files. Verification is *not* required for contracts deployed on the Hedera network, but it is best practice and essential to maintaining the contract's security and integrity by identifying vulnerabilities that could be exploited, as smart contracts are immutable once deployed. It also enables transparency and builds trust within the user community by proving that the deployed bytecode matches the contract's original source code. -To initiate verification, you can use a community-hosted Hedera Mirror Node Explorer, like [HashScan](https://hashscan.io/) ([Arkhia](https://explorer.arkhia.io/) and [Dragon Glass](https://app.dragonglass.me/) do not currently support this feature), that integrates with [Sourcify](/hedera/support-and-community/glossary#sourcify): A Solidity source code and metadata verification tool. Once you upload your files to the verification tool, Sourcify recompiles the submitted source code and metadata files to check them against the deployed bytecode. If a match is found, the contract's verification status is updated to either a [*Full (Perfect) Match*](https://docs.sourcify.dev/docs/full-vs-partial-match/#full-perfect-matches) or a [*Partial Match*](https://docs.sourcify.dev/docs/full-vs-partial-match/#partial-matches)*.* +Hedera Mainnet and Testnet are natively supported by [Sourcify](/hedera/support-and-community/glossary#sourcify), the open-source Solidity source code and metadata verification service hosted at [sourcify.dev](https://sourcify.dev). To verify a contract, submit your source files and metadata to Sourcify (directly via the web UI, the [v2 API](https://docs.sourcify.dev/docs/api/), or through your build tooling). Sourcify recompiles the submitted sources and compares them to the deployed bytecode. If a match is found, the contract's verification status is updated to either a [*Full (Perfect) Match*](https://docs.sourcify.dev/docs/full-vs-partial-match/#full-perfect-matches) or a [*Partial Match*](https://docs.sourcify.dev/docs/full-vs-partial-match/#partial-matches)*.* -The verification status is publicly available across all community-hosted Hedera Mirror Node Explorers. To learn what differentiates a *Full (Perfect) Match* from a *Partial Match*, check out the Sourcify documentation [here](https://docs.sourcify.dev/docs/full-vs-partial-match/). +Once a contract is verified on Sourcify, [HashScan](https://hashscan.io/) and other community-hosted Hedera Mirror Node Explorers read its verification status directly from Sourcify and surface it to users. To learn what differentiates a *Full (Perfect) Match* from a *Partial Match*, check out the Sourcify documentation [here](https://docs.sourcify.dev/docs/full-vs-partial-match/). -**Note**: This is an initial beta release, and both the HashScan user interface and API functionalities are scheduled for enhancements in upcoming updates. +**Note**: Manual HashScan verification is temporarily disabled. Verify your contracts directly at [sourcify.dev](https://sourcify.dev) or through Foundry/Hardhat. Once verified there, the status will appear on HashScan automatically. For verification, you will need the following items: @@ -74,7 +74,7 @@ You have options for generating the metadata file. The recommended skill levels To create a metadata file in Remix, compile your smart contract and the compiled artifacts will be saved in the `artifacts/` directory and the `.json` metadata file will be under `artifacts/build-info` and used for verification. Alternatively, you can copy and paste it from the Solidity compiler tab. Please see the image below. -![](/images/core-concepts/smart-contracts/verifying-smart-contracts-beta/verifying-smart-contracts-beta-2.png) +![](/images/core-concepts/smart-contracts/verifying-smart-contracts/verifying-smart-contracts-beta-2.png) See the Remix IDE docs for more detailed documentation [here](https://remix-ide.readthedocs.io/en/latest/contract_metadata.html). @@ -86,7 +86,7 @@ See the Remix IDE docs for more detailed documentation [here](https://remix-ide. To create the `.json` metadata file with Hardhat, compile the contract using the `npx hardhat compile` command. The compiled artifacts will be saved in the `artifacts/` directory and the `.json` metadata file will be under `artifacts/build-info` and used for verification. See Sourcify Hardhat metadata documentation [here](https://docs.sourcify.dev/docs/metadata/#hardhat). - + **Note**: The requirement for verification with a contract compiled with Hardhat is only the `build-info` JSON file. @@ -96,7 +96,7 @@ To create the `.json` metadata file with Hardhat, compile the contract using the To create the metadata file with Foundry, compile the contract using the `forge build` command. The compilation outputs to `out/CONTRACT_NAME` folder. The `.json` file contains the metadata of the contract under `"rawMetadata"` and `"metadata"` fields. However, you don't need to extract the metadata manually for verification. See Sourcify Foundry metadata documentation [here](https://docs.sourcify.dev/docs/metadata/#foundry). -![](/images/core-concepts/smart-contracts/verifying-smart-contracts-beta/verifying-smart-contracts-beta-3.png) +![](/images/core-concepts/smart-contracts/verifying-smart-contracts/verifying-smart-contracts-beta-3.png) **Note**: The requirements for verification with a contract compiled with Foundry are both the `.json` metadata and the Solidity source file. @@ -188,29 +188,27 @@ An example deployed EVM smart contract address: *** -## Different Instances of Sourcify: Hedera's Custom Approach - -It's important to note that multiple instances of Sourcify do exist, tailored to the specific needs of different networks. Hedera runs an independent instance of Sourcify, distinct from the public-facing Sourcify.dev instances like Etherscan and other Etherscan clones. - -Running an independent instance of Sourcify allows Hedera to have more control over the verification process, tailoring it to the custom needs of the Hedera ecosystem. For instance, after a testnet reset, Hedera requires the ability to reset testnet smart contract verifications - something Sourcify.dev cannot accommodate. - -> ***Verified Smart Contracts Testnet Reset:** When the Hedera Testnet is reset, the contract must be redeployed and verified. The contract will receive a new contract EVM address and contract ID. The smart contract will need to be verified using the new addresses.* - -An essential detail to remember is that smart contracts verified on Hedera's Sourcify instance won't automatically appear as verified on Sourcify.dev or vice versa. Users interested in having their smart contract recognized across multiple platforms should consider verifying on both instances. - -*** - ## Verify Your Smart Contract -Learn how to verify your smart contract on [HashScan](/hedera/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan) or programmatically using the [Sourcify API](/hedera/sdks-and-apis/smart-contract-verification-api): +Verify your contract directly at [sourcify.dev](https://sourcify.dev), via the [Sourcify v2 API](/hedera/sdks-and-apis/smart-contract-verification-api), or through Foundry / Hardhat tooling: + + + + @@ -224,7 +222,7 @@ Learn how to verify your smart contract on [HashScan](/hedera/tutorials/smart-co **➡** [**HashScan Network Explorer**](https://hashscan.io/) -**➡** [**Smart Contract Verifier Page**](https://verify.hashscan.io/) +**➡** [**Sourcify Verification UI**](https://sourcify.dev) **➡** [**Full vs Partial Match Docs**](https://docs.sourcify.dev/docs/full-vs-partial-match/) diff --git a/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-foundry.mdx b/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-foundry.mdx index 841877fe..4603711e 100644 --- a/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-foundry.mdx +++ b/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-foundry.mdx @@ -12,7 +12,7 @@ By the end of this tutorial, you will be able to: - Compile and deploy a smart contract using Foundry - Interact with a smart contract using Foundry's `cast` command -- Verify your smart contract on [Hashscan](https://hashscan.io/) +- Verify your smart contract programmatically with `forge verify-contract` --- @@ -39,7 +39,7 @@ This will install `forge`, `cast`, `anvil`, and `chisel`. 3. [Step 3: Create a Deployment Script](#step-3%3A-create-a-deployment-script) 4. [Step 4: Deploy your ERC20 Smart Contract](#step-4%3A-deploy-your-erc20-smart-contract) 5. [Step 5: Interacting with the Contract](#step-5%3A-interacting-with-the-contract) -6. [Step 6: Verifying the Contract on Hashscan](#step-6%3A-verifying-the-contract-on-hashscan) +6. [Step 6: Verify Your Smart Contract with Foundry](#step-6%3A-verify-your-smart-contract-with-foundry) --- @@ -214,7 +214,7 @@ After a few moments, you will see the address of your newly deployed contract: ``` - Copy the deployed contract address—you'll need this in subsequent steps. + Copy the deployed contract address. You'll need this in subsequent steps. --- @@ -301,17 +301,19 @@ The output will show the 100 tokens you sent: --- -## Step 6: Verifying the Contract on Hashscan +## Step 6: Verify Your Smart Contract with Foundry -Verifying your smart contract makes its source code publicly available on Hashscan. The constructor for this contract takes one argument (`initialOwner`), which we must provide for successful verification. +Foundry can verify your contract programmatically straight from the command line via `forge verify-contract`. Programmatic verification is the most reliable and efficient method, especially for complex or upgradeable contracts, because Foundry already knows your exact compilation settings, dependency graph, and deployment artifacts. -Run the following command, using the variables you set earlier. +`forge verify-contract` submits the verification request to [Sourcify](https://sourcify.dev), which natively supports Hedera Mainnet (chain ID `295`) and Testnet (chain ID `296`). Once Sourcify accepts the match, the verified status surfaces automatically on [HashScan](https://hashscan.io/) and any other explorer that reads from Sourcify. + +The constructor for this contract takes one argument (`initialOwner`), which we must provide for successful verification. Run the following command, using the variables you set earlier. ```bash forge verify-contract $CONTRACT_ADDRESS src/HederaToken.sol:HederaToken \ --chain-id 296 \ --verifier sourcify \ - --verifier-url "https://server-verify.hashscan.io/" \ + --verifier-url "https://sourcify.dev/server" \ --constructor-args $(cast abi-encode "constructor(address)" $MY_ADDRESS) ``` @@ -333,12 +335,10 @@ Contract successfully verified - Follow more [Foundry guides with Hedera](/hedera/tutorials/smart-contracts/foundry). - + [Github](https://github.com/kpachhai) | [Linkedin](https://www.linkedin.com/in/kiranpachhai/) - + + [GitHub](https://github.com/LukeForrest-Hashgraph) | [X](https://x.com/_LukeForrest) + diff --git a/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-hardhat.mdx b/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-hardhat.mdx index 0a7307a6..3b2dd61d 100644 --- a/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-hardhat.mdx +++ b/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-hardhat.mdx @@ -33,7 +33,7 @@ Before you begin, you should have **completed** the following tutorial: 2. [Step 2: Creating the ERC-721 Contract](#step-2%3A-creating-the-erc-721-contract) 3. [Step 3: Deploy Your ERC-721 Smart Contract](#step-3%3A-deploy-your-erc-721-smart-contract) 4. [Step 4: Minting an ERC-721 Token](#step-4%3A-minting-an-erc-721-token) -5. [Step 5: Verify Your Smart Contract on HashScan](#step-5%3A-verify-your-smart-contract-on-hashscan) +5. [Step 5: Verify Your Smart Contract with Hardhat](#step-5%3A-verify-your-smart-contract-with-hardhat) --- @@ -241,7 +241,7 @@ npx hardhat run scripts/deploy.ts --network testnet ``` - Copy the deployed address—you'll need this in subsequent steps. + Copy the deployed address. You'll need this in subsequent steps. The output looks like this: @@ -351,33 +351,35 @@ Balance: 1 NFTs ``` --- -## Step 5: Verify Your Smart Contract on HashScan +## Step 5: Verify Your Smart Contract with Hardhat -After deploying your smart contract, you should verify the source code on HashScan. Programmatic verification is the most reliable and efficient method, especially for complex or upgradeable contracts. +After deploying your smart contract, you can verify the source code programmatically from Hardhat. Programmatic verification is the most reliable and efficient method, especially for complex or upgradeable contracts, because Hardhat already knows your exact compilation settings, dependency graph, and deployment artifacts. + +Hardhat submits the verification request to [Sourcify](https://sourcify.dev), which natively supports Hedera Mainnet (chain ID `295`) and Testnet (chain ID `296`). Once Sourcify accepts the match, the verified status surfaces automatically on [HashScan](https://hashscan.io/) and any other explorer that reads from Sourcify. ### Install the Verification Plugin -Hardhat uses the dedicated [`hashscan-verify`](https://www.npmjs.com/package/hashscan-verify) plugin to interface with the HashScan Smart Contract Verifier API (which is based on the Sourcify standard). +Hardhat's official [`@nomicfoundation/hardhat-verify`](https://hardhat.org/hardhat-runner/plugins/nomicfoundation-hardhat-verify) plugin supports Sourcify out of the box. Install the plugin in your project: ```bash -npm i -D hashscan-verify +npm i -D @nomicfoundation/hardhat-verify ``` ### Configure Hardhat for Verification -Import the plugin in your `hardhat.config.ts` file: +Import the plugin in your `hardhat.config.ts` file and enable Sourcify verification. Because Hedera is supported on the default Sourcify server (`https://sourcify.dev/server`), no custom `apiUrl` is needed. ```typescript -import hashscanVerify from "hashscan-verify"; // <--- ADD THIS LINE +import hardhatVerify from "@nomicfoundation/hardhat-verify"; // <--- ADD THIS LINE import type { HardhatUserConfig } from "hardhat/config"; import hardhatToolboxMochaEthersPlugin from "@nomicfoundation/hardhat-toolbox-mocha-ethers"; import { configVariable } from "hardhat/config"; const config: HardhatUserConfig = { - plugins: [hardhatToolboxMochaEthersPlugin, hashscanVerify], // ADD TO PLUGIN LIST + plugins: [hardhatToolboxMochaEthersPlugin, hardhatVerify], // ADD TO PLUGIN LIST solidity: { profiles: { default: { @@ -398,8 +400,12 @@ const config: HardhatUserConfig = { testnet: { type: "http", url: configVariable("HEDERA_RPC_URL"), - accounts: [configVariable("HEDERA_PRIVATE_KEY")] + accounts: [configVariable("HEDERA_PRIVATE_KEY")], + chainId: 296 } + }, + sourcify: { + enabled: true } }; @@ -408,35 +414,32 @@ export default config; ### Run the Verification Command -The plugin adds the `hashscan-verify` task to Hardhat. The basic command structure is: +The plugin adds the `verify` task to Hardhat. The basic command structure is: ```bash -npx hardhat hashscan-verify \ - --contract ":" \ - --network +npx hardhat verify --network [constructor_args...] ``` ### Example: Verifying Your MyToken Contract -Using the contract address from your deployment: +Using the contract address from your deployment, pass the deployer address (the `initialOwner` constructor argument) at the end of the command: ```bash # Replace with your actual deployed contract address CONTRACT_ADDRESS="0x6035bA3BCa9595637B463Aa514c3a1cE3f67f3de" +DEPLOYER_ADDRESS="0xA98556A4deeB07f21f8a66093989078eF86faa30" -npx hardhat hashscan-verify "$CONTRACT_ADDRESS" \ - --contract "contracts/MyToken.sol:MyToken" \ - --network testnet +npx hardhat verify --network testnet "$CONTRACT_ADDRESS" "$DEPLOYER_ADDRESS" ``` -The plugin will handle uploading the source code and metadata to the HashScan verifier. You should receive a **Full Match** verification status. +The plugin uploads the source code and metadata to Sourcify and you should receive a **Full Match** verification status. The verified contract will then appear on HashScan automatically. **Troubleshooting Verification** | **Issue** | **Solution** | | :------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Verification Fails/Mismatch | Ensure your local compilation settings (Solidity version, optimizer runs, viaIR) exactly match the settings used for deployment. Run `npx hardhat clean && npx hardhat compile` before retrying. | -| Constructor Arguments Error | If your contract has constructor arguments, pass them as positional arguments after the contract name in the verification command. | +| Verification Fails/Mismatch | Ensure your local compilation settings (Solidity version, optimizer runs, viaIR) exactly match the settings used for deployment. Run `npx hardhat clean && npx hardhat build` before retrying. | +| Constructor Arguments Error | If your contract has constructor arguments, pass them as positional arguments after the contract address in the verification command. | | Hardhat Keystore Password Prompt | The task may prompt for your Hardhat keystore password if it needs to sign a transaction to read deployment details. Enter it when prompted. | **Congratulations! 🎉 You have successfully learned how to deploy and verify an ERC-721 smart contract using Hardhat, OpenZeppelin, and Ethers. Feel free to reach out in** [**Discord**](https://hedera.com/discord)**!** @@ -453,6 +456,9 @@ The plugin will handle uploading the source code and metadata to the HashScan ve [Github](https://github.com/kpachhai) | [Linkedin](https://www.linkedin.com/in/kiranpachhai/) + + [GitHub](https://github.com/LukeForrest-Hashgraph) | [X](https://x.com/_LukeForrest) + [Github](https://github.com/theekrystallee) | [X](https://x.com/theekrystallee) diff --git a/hedera/open-source-solutions/hedera-contract-builder.mdx b/hedera/open-source-solutions/hedera-contract-builder.mdx index c8dd09f4..f97c22e2 100644 --- a/hedera/open-source-solutions/hedera-contract-builder.mdx +++ b/hedera/open-source-solutions/hedera-contract-builder.mdx @@ -20,7 +20,7 @@ The Contract Builder is packed with features to make development smoother and fa * **Rapid Development:** Go from idea to deployed contract on the Hedera testnet in seconds. Author, compile, and deploy with just a few clicks. * **No Setup Required:** Access everything you need directly in your browser. No need to install packages or configure local environments. * **Built-in Templates & Standards:** Start quickly with pre-built templates and support for common standards like ERC-20, ERC-721, ERC-1155, and Hedera Token Service (HTS) system contracts. -* **Seamless Workflow:** Easily verify your contract code using [Sourcify](https://verify.hashscan.io/) on [HashScan](https://hashscan.io/) and execute contract functions to test logic. +* **Seamless Workflow:** Easily verify your contract code on [Sourcify](https://sourcify.dev). Once verified, the status appears automatically on [HashScan](https://hashscan.io/), and you can execute contract functions to test logic. * **Collaboration:** Share your contracts with collaborators to streamline teamwork. * **Open Source:** Built in collaboration with [Kabila](https://www.kabila.app/), the Contract Builder is an open-source project, encouraging community contributions and transparency. diff --git a/hedera/sdks-and-apis/smart-contract-verification-api.mdx b/hedera/sdks-and-apis/smart-contract-verification-api.mdx index aa7c5657..df9674c5 100644 --- a/hedera/sdks-and-apis/smart-contract-verification-api.mdx +++ b/hedera/sdks-and-apis/smart-contract-verification-api.mdx @@ -6,50 +6,104 @@ sidebarTitle: "Overview" ## Overview -The Sourcify API enables programmatic access to smart contract verification services, allowing developers to verify contract source code, check verification status, and retrieve verified contract files. This decentralized verification service is essential for developers and auditors who need to ensure smart contract transparency and verify that deployed bytecode matches the provided source code across multiple blockchain networks. +The Sourcify API enables programmatic access to smart contract verification services, allowing developers to verify contract source code, check verification status, and retrieve verified contract files. Sourcify is a decentralized, open-source verification service that's essential for developers and auditors who need to confirm smart contract transparency by proving that the deployed bytecode matches the published source code across EVM-compatible networks. + +[Sourcify](https://sourcify.dev) natively supports **Hedera Mainnet (chain ID `295`)** and **Hedera Testnet (chain ID `296`)**, so verification on Hedera uses the same API and tooling as any other supported chain. ### Key Features -* **Contract Verification**: Submit smart contract source code and metadata for verification against deployed bytecode on various blockchain networks. -* **Multiple Verification Methods**: Support for direct file upload, Etherscan-verified contract import, and solc-json compilation artifact verification. -* **Verification Status Checking**: Query the verification status of contracts by address and chain ID, with support for both full and partial matches. -* **File Retrieval**: Access verified contract source code, metadata, and compilation artifacts for any verified contract. -* **Multi-Chain Support**: Compatible with Ethereum mainnet, testnets, and other EVM-compatible networks including Hedera. -* **Repository Access**: Browse and download verified contract files with organized file tree structures. +* **Contract Verification**: Submit smart contract source code and metadata for verification against deployed bytecode on any supported network. +* **Multiple Verification Methods**: Support for Solidity Standard JSON input, Solidity metadata.json uploads, Etherscan-verified contract import, and similarity-based verification. +* **Verification Job Tracking**: Asynchronous verification jobs with a `verificationId` so you can poll for status. +* **Contract Lookup**: Query verified contract data by address and chain ID, list verified contracts on a given chain, or search all chains for a single address. +* **Multi-Chain Support**: Compatible with every chain Sourcify recognizes, including Hedera Mainnet and Testnet. - -📣 For interactive API exploration and testing, visit https://server-verify.hashscan.io/api-docs/ - + + Hedera previously operated a self-hosted Sourcify instance at `verify.hashscan.io` and `server-verify.hashscan.io`. Requests to those hosts are forwarded to `sourcify.dev` so existing integrations continue to work, but the legacy endpoints are deprecated. Please update your tooling and scripts to call `sourcify.dev` directly. + + +## Hedera Chain IDs + +| Network | Chain ID | +| --------------- | -------- | +| Hedera Mainnet | 295 | +| Hedera Testnet | 296 | ## Base URL ``` -https://server-verify.hashscan.io +https://sourcify.dev/server ``` + +📣 For interactive API exploration and testing, visit https://sourcify.dev/server/api-docs/ + + ## Endpoints -#### Stateless Verification +#### Verify Contracts + +| Method | Endpoint | Description | +|--------|----------|-------------| +| POST | `/v2/verify/{chainId}/{address}` | verify a contract using Solidity Standard JSON input | +| POST | `/v2/verify/metadata/{chainId}/{address}` | verify a contract using a Solidity `metadata.json` file | +| POST | `/v2/verify/etherscan/{chainId}/{address}` | import and verify a contract that's already verified on Etherscan | +| POST | `/v2/verify/similarity/{chainId}/{address}` | verify a contract via similarity search against existing verified contracts | + +#### Verification Jobs -
MethodEndpointDescription
POST/verifyverify contracts by uploading source files and metadata
POST/verify/etherscanverify contracts already verified on etherscan
POST/verify/solc-jsonverify contracts using solc-json compilation artifacts
+| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/v2/verify/{verificationId}` | check the status of a verification job by its `verificationId` | + +#### Contract Lookup + +| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/v2/contract/{chainId}/{address}` | fetch verification status and source files for a contract on a specific chain | +| GET | `/v2/contract/all-chains/{address}` | look up a single address across every chain Sourcify supports | +| GET | `/v2/contracts/{chainId}` | paginated list of verified contracts on a given chain | -#### Repository Access +#### System | Method | Endpoint | Description | |--------|----------|-------------| -| GET | `/check-all-by-addresses` | check verification status (full or partial match) for multiple contracts | -| GET | `/check-by-addresses` | check verification status (full match only) for multiple contracts | -| GET | `/files/any/{chain}/{address}` | retrieve all files for a contract (full and partial match) | -| GET | `/files/{chain}/{address}` | retrieve all files for a contract (full match only) | -| GET | `/files/contracts/{chain}` | get all verified contract addresses on a specific chain | -| GET | `/files/tree/any/{chain}/{address}` | get file tree structure (full and partial match) | -| GET | `/files/tree/{chain}/{address}` | get file tree structure (full match only) | -| GET | `/repository/contracts/{match_type}/{chain}/{address}/{filePath}` | download specific files from verified contracts | +| GET | `/health` | service health check | +| GET | `/version` | running server version | +| GET | `/chains` | list of supported and deprecated chains | + +## API Reference + +The full Sourcify v2 API reference (including request/response schemas, authentication details, and worked examples) lives in the official Sourcify documentation: + +**➡** [**Sourcify v2 API Documentation**](https://docs.sourcify.dev/docs/api/) + +**➡** [**Sourcify Server Swagger UI**](https://sourcify.dev/server/api-docs/) + +**➡** [**Sourcify Web UI**](https://sourcify.dev) + +## Verifying with Developer Tools -#### Session Management +Most developers verify contracts through their build tooling rather than calling the API directly. Both Foundry and Hardhat have first-class Sourcify support: -
MethodEndpointDescription
GET/session/dataretrieve current session verification data
POST/session/clearclear session data
POST/session/input-filesadd files to verification session
POST/session/input-contractimport deployed contract from ipfs
POST/session/verify-checkedverify contracts in current session
POST/session/input-solc-jsonadd solc-json to session for verification
POST/session/verify/etherscanverify etherscan contracts in session
+ -#### Administration + -
MethodEndpointDescription
POST/change-log-levelmodify application logging level (requires authentication)
+ + + [GitHub](https://github.com/LukeForrest-Hashgraph) | + [X](https://x.com/_LukeForrest) + + + [GitHub](https://github.com/theekrystallee) | + [X](https://x.com/theekrystallee) | + [LinkedIn](https://www.linkedin.com/in/theekrystallee/) + + diff --git a/hedera/tutorials/smart-contracts/foundry/configuring-foundry-with-hedera-localnet-testnet-a-step-by-step-guide.mdx b/hedera/tutorials/smart-contracts/foundry/configuring-foundry-with-hedera-localnet-testnet-a-step-by-step-guide.mdx index 88a6dcaf..6f6d190b 100644 --- a/hedera/tutorials/smart-contracts/foundry/configuring-foundry-with-hedera-localnet-testnet-a-step-by-step-guide.mdx +++ b/hedera/tutorials/smart-contracts/foundry/configuring-foundry-with-hedera-localnet-testnet-a-step-by-step-guide.mdx @@ -311,9 +311,11 @@ forge test ## Step 8: Verifying the Contract on Hashscan -Verifying your smart contract makes its source code publicly available on Hashscan. +Verifying your smart contract publishes its source code to [Sourcify](https://sourcify.dev), and HashScan picks up the verified status automatically. -**\*Note**: Please note that verification of the contract can not be done on Localnet and this process is relevant only for Hedera Testnet/Mainnet. Also, make sure to replace `` with your own contract address you got after the deployment above.\* + + Sourcify only verifies contracts on registered networks. Hedera Mainnet (chain ID `295`) and Testnet (chain ID `296`) are supported, but **Hedera Localnet is not**. Skip this step when working against Localnet and rerun verification once your contract is deployed on Testnet or Mainnet. Make sure to replace `` with the address you got after the deployment above. + Run the following command, using the variables you set earlier. @@ -321,7 +323,7 @@ Run the following command, using the variables you set earlier. forge verify-contract src/Counter.sol:Counter \ --chain-id 296 \ --verifier sourcify \ - --verifier-url "https://server-verify.hashscan.io/" + --verifier-url "https://sourcify.dev/server" ``` After running the command, you should see a success message. @@ -388,6 +390,10 @@ Want to take your local development setup even further? Here are some excellent [GitHub](https://github.com/kpachhai) | [LinkedIn](https://www.linkedin.com/in/kiranpachhai/) + + [GitHub](https://github.com/LukeForrest-Hashgraph) | + [X](https://x.com/_LukeForrest) + [GitHub](https://github.com/theekrystallee) | [X](https://x.com/theekrystallee) diff --git a/hedera/tutorials/smart-contracts/foundry/how-to-mint-and-burn-an-erc-721-token-using-foundry-part-1.mdx b/hedera/tutorials/smart-contracts/foundry/how-to-mint-and-burn-an-erc-721-token-using-foundry-part-1.mdx index af162892..30d70ee3 100644 --- a/hedera/tutorials/smart-contracts/foundry/how-to-mint-and-burn-an-erc-721-token-using-foundry-part-1.mdx +++ b/hedera/tutorials/smart-contracts/foundry/how-to-mint-and-burn-an-erc-721-token-using-foundry-part-1.mdx @@ -263,13 +263,13 @@ export MY_ADDRESS=$(cast wallet address $HEDERA_PRIVATE_KEY) ``` -Let's also verify our contract because it is so easy to do so and it is good practice: +Let's also verify our contract because it is so easy to do so and it is good practice. Verification submits the source code to [Sourcify](https://sourcify.dev), which natively supports Hedera Testnet (chain ID `296`); the verified status will then appear on [HashScan](https://hashscan.io/). ```bash forge verify-contract $CONTRACT_ADDRESS src/MyToken.sol:MyToken \ --chain-id 296 \ --verifier sourcify \ - --verifier-url "https://server-verify.hashscan.io/" \ + --verifier-url "https://sourcify.dev/server" \ --constructor-args $(cast abi-encode "constructor(address)" $MY_ADDRESS) ``` @@ -356,7 +356,7 @@ export CONTRACT_ADDRESS= forge verify-contract $CONTRACT_ADDRESS src/MyToken.sol:MyToken \ --chain-id 296 \ --verifier sourcify \ - --verifier-url "https://server-verify.hashscan.io/" \ + --verifier-url "https://sourcify.dev/server" \ --constructor-args $(cast abi-encode "constructor(address)" $MY_ADDRESS) ``` @@ -513,6 +513,10 @@ Want to take your local development setup even further? Here are some excellent [GitHub](https://github.com/kpachhai) | [LinkedIn](https://www.linkedin.com/in/kiranpachhai/) + + [GitHub](https://github.com/LukeForrest-Hashgraph) | + [X](https://x.com/_LukeForrest) + [GitHub](https://github.com/theekrystallee) | [X](https://x.com/theekrystallee) diff --git a/hedera/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan.mdx b/hedera/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan.mdx index ec84dc7e..f5cd8aac 100644 --- a/hedera/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan.mdx +++ b/hedera/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan.mdx @@ -1,91 +1,86 @@ --- title: "Verify a Smart Contract on HashScan" -description: "How to verify a smart contract using the HashScan Smart Contract Verification tool." --- -Verifying smart contracts helps ensure the deployed bytecode matches the expected source files. [HashScan](https://hashscan.io/) Smart Contract Verifier is a tool that simplifies this process. This guide will walk through the basic steps of smart contract verification using the HashScan Smart Contract Verifier tool. +Verifying smart contracts proves that the deployed bytecode matches the source files you publish. On Hedera, verification is handled by [Sourcify](https://sourcify.dev), which natively supports Hedera Mainnet (chain ID `295`) and Testnet (chain ID `296`). Once a contract is verified on Sourcify, [HashScan](https://hashscan.io/) automatically picks up the verified status and displays the source code on the contract page. - - ![](/images/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan/how-to-verify-a-smart-contract-on-hashscan-1.png) - - - - **_📣 Note: This is an initial release. API functionalities will see - enhancements in upcoming updates of the_** - [_https://github.com/hashgraph/hedera-sourcify_](https://github.com/hashgraph/hedera-sourcify) - _repository._ - + + The in-app HashScan verification form is temporarily disabled. Verify your contracts directly at [sourcify.dev](https://sourcify.dev) using the steps below, or use the Foundry / Hardhat tutorials linked at the bottom of this page. + --- ## Prerequisites -- Solidity [source code file](/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta#smart-contract-source-code) of the deployed smart contract. -- Solidity [JSON (metadata) file](/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta#the-metadata-file) of the deployed smart contract. +- Solidity [source code file](/hedera/core-concepts/smart-contracts/verifying-smart-contracts#smart-contract-source-code) of the deployed smart contract. +- Solidity [JSON (metadata) file](/hedera/core-concepts/smart-contracts/verifying-smart-contracts#the-metadata-file) of the deployed smart contract. - EVM address of the smart contract deployed on the Hedera network. --- ## Table of Contents -1. [Find the Contract](#step-1%3A-find-the-contract-on-hashscan) -2. [Import Source Files](#step-2%3A-import-source-files) -3. [Verify Contract](#step-3%3A-verify-contract) -4. [Verification Match](#step-4%3A-verification-match) -5. [Re-Verify Smart Contract](#step-5%3A-re-verify-smart-contract) -6. [Additional Resources](#additional-resources) +1. [Verify on Sourcify](#step-1%3A-verify-on-sourcify) +2. [Confirm on HashScan](#step-2%3A-confirm-on-hashscan) +3. [Bundled Metadata for Complex Contracts](#bundled-metadata-for-complex-contracts) +4. [Recommended: Programmatic Verification](#recommended%3A-programmatic-verification) +5. [Additional Resources](#additional-resources) --- -## Step 1: Find the Contract on HashScan - -Open a web browser and navigate to [HashScan](https://hashscan.io/). Make sure you are on the correct Hedera network (mainnet, testnet, or previewnet), and search for the deployed contract address in the search bar at the top of the page. In the **_Contract Bytecode_** section click on **_Verify_**. The source code file importer popup window will open. - - - ![](/images/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan/how-to-verify-a-smart-contract-on-hashscan-2.png) - +## Step 1: Verify on Sourcify ---- - -## Step 2: Import Source Files +1. Open [sourcify.dev](https://sourcify.dev) in your browser. +2. Choose the network that matches your deployment: **Hedera Mainnet** (chain ID `295`) or **Hedera Testnet** (chain ID `296`). +3. Paste the deployed contract's EVM address. +4. Upload your Solidity source files (`.sol`) and the metadata file (`.json`). The metadata file is generated when you compile the contract; for example, with Hardhat it lives under `artifacts/build-info/`, and with Foundry the metadata is included in the per-contract JSON under `out/`. +5. Submit the verification request. Sourcify will recompile your sources and compare them against the deployed bytecode. -Add your Solidity source code files in the source file importer popup. Source files include the smart contract (`.sol`) [source code file](/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta#smart-contract-source-code) and [metadata](/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta#the-metadata-file) (`.json` ) file. The metadata file can be found in the `artifacts/` directory of your smart contract project and its name correlates with the smart contract. For example, the metadata for the `HelloHedera.sol` contract would be called `HelloHedera.json`. +If the comparison succeeds, Sourcify returns either a [Full Match](https://docs.sourcify.dev/docs/full-vs-partial-match/#full-perfect-matches) or a [Partial Match](https://docs.sourcify.dev/docs/full-vs-partial-match/#partial-matches): - - ![](/images/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan/how-to-verify-a-smart-contract-on-hashscan-3.png) - +- **Full Match**: the bytecode and metadata are an exact match. Source code, comments, and variable names line up with the deployed contract. +- **Partial Match**: the bytecode mostly matches, but the metadata hash differs (typically due to comments or variable names). This is sufficient for most verification purposes. - + 1. **Remix**: - - **Required for Full Match Verification**: Both the metadata file found in the `contracts/artifacts/` folder and the smart contract's Solidity file. More details [here](/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta#remix-ide-beginner). + - **Required for Full Match Verification**: Both the metadata file found in the `contracts/artifacts/` folder and the smart contract's Solidity file. More details [here](/hedera/core-concepts/smart-contracts/verifying-smart-contracts#remix-ide-beginner). 2. **Hardhat**: - - **Required for Full Match Verification**: Only the output of the compilation JSON file found in the `/artifacts/build-info/` folder. More details [here](/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta#hardhat-intermediate). + - **Required for Full Match Verification**: Only the output of the compilation JSON file found in the `/artifacts/build-info/` folder. More details [here](/hedera/core-concepts/smart-contracts/verifying-smart-contracts#hardhat-intermediate). 3. **Solidity Compiler (solc)**: - - **Required for Full Match Verification**: Both the metadata file (generated by `solc --metadata`) and the smart contract's Solidity file. More details [here](/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta#solidity-compiler-advanced). + - **Required for Full Match Verification**: Both the metadata file (generated by `solc --metadata`) and the smart contract's Solidity file. More details [here](/hedera/core-concepts/smart-contracts/verifying-smart-contracts#solidity-compiler-advanced). 4. **Foundry**: - - **Required for Full Match Verification**: Both the metadata file (generated by `forge-build`) and the smart contract's Solidity file. - -**_Note: Uploading only the Solidity file without the metadata file will result in a Partial Match._** + - **Required for Full Match Verification**: Both the metadata file (generated by `forge build`) and the smart contract's Solidity file. + **_Note: Uploading only the Solidity file without the metadata file will result in a Partial Match._** --- -## Step 3: Advanced Manual Verification for Complex Contracts +## Step 2: Confirm on HashScan + +Open the contract on [HashScan](https://hashscan.io/), making sure you're on the same network you verified against. The contract's source code, ABI, and verification badge will appear on the **Contract** tab once HashScan picks up the verified status from Sourcify. + +To learn more about each verification match status, head over to the official Sourcify documentation [here](https://docs.sourcify.dev/docs/full-vs-partial-match/). + +**Congratulations! 🎉 You have successfully verified a smart contract on Hedera. Feel free to reach out on** [**Discord**](https://hedera.com/discord) **if you have any questions!** + +--- -For complex projects with multiple dependencies (such as OpenZeppelin libraries) or upgradeable proxy contracts, manually uploading individual source files can be **extremely difficult and error-prone**. Each dependency file must be uploaded separately, and ensuring all imports are correctly resolved can be challenging. +## Bundled Metadata for Complex Contracts -A more robust approach is to programmatically verify the contract using hardhat/foundry directly but you can also take a manual approach where you generate a **`single, self-contained metadata.json file`** that includes all source code dependencies inline. This single file can then be uploaded to HashScan for verification. +For projects with multiple dependencies (such as OpenZeppelin libraries) or upgradeable proxy contracts, manually uploading individual source files can be **extremely difficult and error-prone**. Each dependency must be uploaded separately, and ensuring all imports resolve correctly is challenging. + +A more robust manual approach is to generate a single, self-contained `metadata.json` file that includes all source code dependencies inline. This single file can then be uploaded to Sourcify in place of dozens of individual files. ### Why Use This Approach? -When your smart contract imports many external libraries and multiple files, the standard manual verification process requires you to: +When a contract imports many external libraries and files, the standard manual upload requires you to provide: -- Upload the main contract `.sol` file -- Upload the metadata `.json` file -- Upload **every** imported dependency file (which can be dozens of files) +- The main contract `.sol` file +- The metadata `.json` file +- **Every** imported dependency file -This is tedious and prone to errors. The advanced approach bundles everything into one file. +The bundled approach packages everything into one file. ### Generating the Single Metadata File @@ -98,140 +93,74 @@ Both Hardhat and Foundry projects can be configured to generate this single file chmod +x generate_hedera_sc_metadata.sh ``` - 2. **Run the script** to generate the bundles: - - ```bash - # USAGE: - # ./generate_hedera_sc_metadata.sh [ContractName] [ContractName=0xAddress] ... - - # EXAMPLES: - # ./generate_hedera_sc_metadata.sh MyToken - # ./generate_hedera_sc_metadata.sh MyToken=0x1234567890abcdef... - # ./generate_hedera_sc_metadata.sh src/MyContract.sol:MyContract=0x9876... - - # For example for a contract "MyToken", you would do: - ./generate_hedera_sc_metadata.sh MyToken - ``` - - 3. This produces a directory (e.g., `verify-bundles/`) containing a single `metadata.json` file for each contract. - ```bash - >> tree verify-bundles/ - verify-bundles/ - ├── MANIFEST.txt - └── MyToken - └── metadata.json - ``` - 4. **On HashScan**, go to the contract's page, click **Verify**, and upload the corresponding single `metadata.json` file. - -### When to Use This Approach - -Use the single `metadata.json` approach when: - -- Your contract imports multiple external libraries and files (OpenZeppelin, etc.) -- You're verifying upgradeable proxy contracts -- The standard manual upload process is too cumbersome -- You want a more reliable verification workflow - - - **Prefer Programmatic Verification:** While this advanced manual approach is - more robust than uploading individual files, the **programmatic verification** - methods using Hardhat's `hashscan-verify` plugin or Foundry's `forge - verify-contract` command are even more reliable and efficient. See the - standalone verification guides for fully automated workflows. - - ---- - -## Step 4: Verify Contract - -After importing the source files, if you get the "_Contract \ is ready to be verified"_ message, click **VERIFY** to initiate the verification process. Sourcify will then compare the deployed contract bytecode to the source files you imported in the previous step. - - - ![](/images/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan/how-to-verify-a-smart-contract-on-hashscan-4.png) - +2. **Run the script** to generate the bundles: ---- - -## Step 5: Verification Match + ```bash + # USAGE: + # ./generate_hedera_sc_metadata.sh [ContractName] [ContractName=0xAddress] ... -If your verification is successful, the verifier will return either a [Full Match](https://docs.sourcify.dev/docs/full-vs-partial-match/#full-perfect-matches) or [Partial Match](https://docs.sourcify.dev/docs/full-vs-partial-match/#partial-matches) status. Let's review each verification status and what they mean: + # EXAMPLES: + # ./generate_hedera_sc_metadata.sh MyToken + # ./generate_hedera_sc_metadata.sh MyToken=0x1234567890abcdef... + # ./generate_hedera_sc_metadata.sh src/MyContract.sol:MyContract=0x9876... -- **Full Match**: Indicates the bytecode is a full (perfect) match, including all the metadata. The contract source code and metadata settings are identical to the deployed version. -- **Partial Match**: Indicates the bytecode _mostly_ (partially) matches with the deployed contract, except for the metadata hash like comments or variable names. It is usually sufficient for most verification purposes. + # For example, for a contract "MyToken": + ./generate_hedera_sc_metadata.sh MyToken + ``` - - ![](/images/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan/how-to-verify-a-smart-contract-on-hashscan-5.png) - +3. This produces a directory (e.g., `verify-bundles/`) containing a single `metadata.json` file for each contract. -To learn more about each verification match status, head over to the official Sourcify documentation [here](https://docs.sourcify.dev/docs/full-vs-partial-match/). + ```bash + >> tree verify-bundles/ + verify-bundles/ + ├── MANIFEST.txt + └── MyToken + └── metadata.json + ``` -**Congratulations! 🎉 You have successfully learned how to verify a smart contract. Feel free to reach out on** [**Discord**](https://hedera.com/discord) **if you have any questions!** +4. On [sourcify.dev](https://sourcify.dev), select the Hedera network, enter the contract address, and upload the corresponding single `metadata.json` file. --- -## Step 6: Re-Verify Smart Contract - -If you change your contract or want to upgrade your contract from a **Partial Match** to a **Full Match**, there are two options for re-verification: - -#### Option 1 +## Recommended: Programmatic Verification -Head to the smart contract verifier [page](https://verify.hashscan.io/) and import your new updated source files. +While the bundled metadata approach above is more robust than uploading individual files, programmatic verification through Foundry or Hardhat is even more reliable and integrates cleanly into a deployment pipeline. See the standalone guides for fully automated workflows: - - ![](/images/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan/how-to-verify-a-smart-contract-on-hashscan-6.png) - - -Enter the smart contract address and chain, then click **_Verify_**. - - - ![](/images/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan/how-to-verify-a-smart-contract-on-hashscan-7.png) - - -#### Option 2 - -Revisit [**Step 1**](#step-1%3A-find-the-contract-on-hashscan) and use the **_Re-verify Contract_** flow. Then proceed to Steps 2 through 4. + - - ![](/images/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan/how-to-verify-a-smart-contract-on-hashscan-8.png) - + --- -## Video Tutorial - -{/* */} - -