Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 16 additions & 20 deletions docs.json
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,10 @@
"dark": "#614ff4"
},
"redirects": [
{
"source": "/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta",
"destination": "/hedera/core-concepts/smart-contracts/verifying-smart-contracts"
},
{
"source": "/hedera/getting-started",
"destination": "/#getting-started"
Expand Down Expand Up @@ -389,7 +393,7 @@
"hedera/core-concepts/smart-contracts/json-rpc-relay",
"hedera/core-concepts/smart-contracts/deploying-smart-contracts",
"hedera/core-concepts/smart-contracts/smart-contract-addresses",
"hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta",
"hedera/core-concepts/smart-contracts/verifying-smart-contracts",
"hedera/core-concepts/smart-contracts/smart-contract-traceability",
{
"group": "Tokens Managed by Smart Contracts",
Expand Down Expand Up @@ -1120,25 +1124,17 @@
"group": "Smart Contract Verification API",
"pages": [
"hedera/sdks-and-apis/smart-contract-verification-api",
"smart-contract-verification-api.yaml POST /verify",
"smart-contract-verification-api.yaml POST /verify/etherscan",
"smart-contract-verification-api.yaml POST /verify/solc-json",
"smart-contract-verification-api.yaml GET /check-all-by-addresses",
"smart-contract-verification-api.yaml GET /check-by-addresses",
"smart-contract-verification-api.yaml GET /files/any/{chain}/{address}",
"smart-contract-verification-api.yaml GET /files/{chain}/{address}",
"smart-contract-verification-api.yaml GET /repository/contracts/{matchType}/{chain}/{address}/{filePath}",
"smart-contract-verification-api.yaml GET /files/contracts/{chain}",
"smart-contract-verification-api.yaml GET /files/tree/any/{chain}/{address}",
"smart-contract-verification-api.yaml GET /files/tree/{chain}/{address}",
"smart-contract-verification-api.yaml GET /session/data",
"smart-contract-verification-api.yaml POST /session/clear",
"smart-contract-verification-api.yaml POST /session/input-files",
"smart-contract-verification-api.yaml POST /session/input-contract",
"smart-contract-verification-api.yaml POST /session/verify-checked",
"smart-contract-verification-api.yaml POST /session/input-solc-json",
"smart-contract-verification-api.yaml POST /session/verify/etherscan",
"smart-contract-verification-api.yaml POST /change-log-level"
"smart-contract-verification-api.yaml POST /v2/verify/{chainId}/{address}",
"smart-contract-verification-api.yaml POST /v2/verify/metadata/{chainId}/{address}",
"smart-contract-verification-api.yaml POST /v2/verify/etherscan/{chainId}/{address}",
"smart-contract-verification-api.yaml POST /v2/verify/similarity/{chainId}/{address}",
"smart-contract-verification-api.yaml GET /v2/verify/{verificationId}",
"smart-contract-verification-api.yaml GET /v2/contract/{chainId}/{address}",
"smart-contract-verification-api.yaml GET /v2/contract/all-chains/{address}",
"smart-contract-verification-api.yaml GET /v2/contracts/{chainId}",
"smart-contract-verification-api.yaml GET /health",
"smart-contract-verification-api.yaml GET /version",
"smart-contract-verification-api.yaml GET /chains"
]
}
]
Expand Down
2 changes: 1 addition & 1 deletion hedera/core-concepts.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ sidebarTitle: Overview
<Card title="JSON-RPC Relay" href="/hedera/core-concepts/smart-contracts/json-rpc-relay" />
<Card title="Deploying Smart Contracts" href="/hedera/core-concepts/smart-contracts/deploying-smart-contracts" />
<Card title="Smart Contract Addresses" href="/hedera/core-concepts/smart-contracts/smart-contract-addresses" />
<Card title="Verifying Smart Contracts" href="/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta" />
<Card title="Verifying Smart Contracts" href="/hedera/core-concepts/smart-contracts/verifying-smart-contracts" />
<Card title="Smart Contract Traceability" href="/hedera/core-concepts/smart-contracts/smart-contract-traceability" />
<Card title="Tokens Managed by Smart Contracts" href="/hedera/core-concepts/smart-contracts/tokens-managed-by-smart-contracts" />
<Card title="ERC-20 (Fungible Tokens)" href="/hedera/core-concepts/smart-contracts/tokens-managed-by-smart-contracts/erc-20-fungible-tokens" />
Expand Down
2 changes: 1 addition & 1 deletion hedera/core-concepts/smart-contracts.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ sidebarTitle: Overview
<Card title="JSON-RPC Relay" href="/hedera/core-concepts/smart-contracts/json-rpc-relay" />
<Card title="Deploying Smart Contracts" href="/hedera/core-concepts/smart-contracts/deploying-smart-contracts" />
<Card title="Smart Contract Addresses" href="/hedera/core-concepts/smart-contracts/smart-contract-addresses" />
<Card title="Verifying Smart Contracts" href="/hedera/core-concepts/smart-contracts/verifying-smart-contracts-beta" />
<Card title="Verifying Smart Contracts" href="/hedera/core-concepts/smart-contracts/verifying-smart-contracts" />
<Card title="Smart Contract Traceability" href="/hedera/core-concepts/smart-contracts/smart-contract-traceability" />
<Card title="Tokens Managed by Smart Contracts" href="/hedera/core-concepts/smart-contracts/tokens-managed-by-smart-contracts" />
<Card title="ERC-20 (Fungible Tokens)" href="/hedera/core-concepts/smart-contracts/tokens-managed-by-smart-contracts/erc-20-fungible-tokens" />
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,12 @@ title: "Verifying Smart Contracts"

Smart contract verification is the process of verifying that the smart contract bytecode uploaded to the network matches the expected smart contract source files. Verification is *not* required for contracts deployed on the Hedera network, but it is best practice and essential to maintaining the contract's security and integrity by identifying vulnerabilities that could be exploited, as smart contracts are immutable once deployed. It also enables transparency and builds trust within the user community by proving that the deployed bytecode matches the contract's original source code.

To initiate verification, you can use a community-hosted Hedera Mirror Node Explorer, like [HashScan](https://hashscan.io/) ([Arkhia](https://explorer.arkhia.io/) and [Dragon Glass](https://app.dragonglass.me/) do not currently support this feature), that integrates with [Sourcify](/hedera/support-and-community/glossary#sourcify): A Solidity source code and metadata verification tool. Once you upload your files to the verification tool, Sourcify recompiles the submitted source code and metadata files to check them against the deployed bytecode. If a match is found, the contract's verification status is updated to either a [*Full (Perfect) Match*](https://docs.sourcify.dev/docs/full-vs-partial-match/#full-perfect-matches) or a [*Partial Match*](https://docs.sourcify.dev/docs/full-vs-partial-match/#partial-matches)*.*
Hedera Mainnet and Testnet are natively supported by [Sourcify](/hedera/support-and-community/glossary#sourcify), the open-source Solidity source code and metadata verification service hosted at [sourcify.dev](https://sourcify.dev). To verify a contract, submit your source files and metadata to Sourcify (directly via the web UI, the [v2 API](https://docs.sourcify.dev/docs/api/), or through your build tooling). Sourcify recompiles the submitted sources and compares them to the deployed bytecode. If a match is found, the contract's verification status is updated to either a [*Full (Perfect) Match*](https://docs.sourcify.dev/docs/full-vs-partial-match/#full-perfect-matches) or a [*Partial Match*](https://docs.sourcify.dev/docs/full-vs-partial-match/#partial-matches)*.*

The verification status is publicly available across all community-hosted Hedera Mirror Node Explorers. To learn what differentiates a *Full (Perfect) Match* from a *Partial Match*, check out the Sourcify documentation [here](https://docs.sourcify.dev/docs/full-vs-partial-match/).
Once a contract is verified on Sourcify, [HashScan](https://hashscan.io/) and other community-hosted Hedera Mirror Node Explorers read its verification status directly from Sourcify and surface it to users. To learn what differentiates a *Full (Perfect) Match* from a *Partial Match*, check out the Sourcify documentation [here](https://docs.sourcify.dev/docs/full-vs-partial-match/).

<Info>
**Note**: This is an initial beta release, and both the HashScan user interface and API functionalities are scheduled for enhancements in upcoming updates.
**Note**: Manual HashScan verification is temporarily disabled. Verify your contracts directly at [sourcify.dev](https://sourcify.dev) or through Foundry/Hardhat. Once verified there, the status will appear on HashScan automatically.
</Info>

For verification, you will need the following items:
Expand Down Expand Up @@ -74,7 +74,7 @@ You have options for generating the metadata file. The recommended skill levels
To create a metadata file in Remix, compile your smart contract and the compiled artifacts will be saved in the `artifacts/` directory and the `<dynamic_hash>.json` metadata file will be under `artifacts/build-info` and used for verification. Alternatively, you can copy and paste it from the Solidity compiler tab. Please see the image below.

<Frame>
![](/images/core-concepts/smart-contracts/verifying-smart-contracts-beta/verifying-smart-contracts-beta-2.png)
![](/images/core-concepts/smart-contracts/verifying-smart-contracts/verifying-smart-contracts-beta-2.png)
</Frame>

See the Remix IDE docs for more detailed documentation [here](https://remix-ide.readthedocs.io/en/latest/contract_metadata.html).
Expand All @@ -86,7 +86,7 @@ See the Remix IDE docs for more detailed documentation [here](https://remix-ide.
To create the `.json` metadata file with Hardhat, compile the contract using the `npx hardhat compile` command. The compiled artifacts will be saved in the `artifacts/` directory and the `<dynamic_hash>.json` metadata file will be under `artifacts/build-info` and used for verification. See Sourcify Hardhat metadata documentation [here](https://docs.sourcify.dev/docs/metadata/#hardhat).

<Frame>
<img src="/images/core-concepts/smart-contracts/verifying-smart-contracts-beta/verifying-smart-contracts-beta-1.png" />
<img src="/images/core-concepts/smart-contracts/verifying-smart-contracts/verifying-smart-contracts-beta-1.png" />
</Frame>

**Note**: The requirement for verification with a contract compiled with Hardhat is only the `build-info` JSON file.
Expand All @@ -96,7 +96,7 @@ To create the `.json` metadata file with Hardhat, compile the contract using the
To create the metadata file with Foundry, compile the contract using the `forge build` command. The compilation outputs to `out/CONTRACT_NAME` folder. The `.json` file contains the metadata of the contract under `"rawMetadata"` and `"metadata"` fields. However, you don't need to extract the metadata manually for verification. See Sourcify Foundry metadata documentation [here](https://docs.sourcify.dev/docs/metadata/#foundry).

<Frame>
![](/images/core-concepts/smart-contracts/verifying-smart-contracts-beta/verifying-smart-contracts-beta-3.png)
![](/images/core-concepts/smart-contracts/verifying-smart-contracts/verifying-smart-contracts-beta-3.png)
</Frame>

**Note**: The requirements for verification with a contract compiled with Foundry are both the `.json` metadata and the Solidity source file.
Expand Down Expand Up @@ -188,29 +188,27 @@ An example deployed EVM smart contract address:

***

## Different Instances of Sourcify: Hedera's Custom Approach

It's important to note that multiple instances of Sourcify do exist, tailored to the specific needs of different networks. Hedera runs an independent instance of Sourcify, distinct from the public-facing Sourcify.dev instances like Etherscan and other Etherscan clones.

Running an independent instance of Sourcify allows Hedera to have more control over the verification process, tailoring it to the custom needs of the Hedera ecosystem. For instance, after a testnet reset, Hedera requires the ability to reset testnet smart contract verifications - something Sourcify.dev cannot accommodate.

> ***Verified Smart Contracts Testnet Reset:** When the Hedera Testnet is reset, the contract must be redeployed and verified. The contract will receive a new contract EVM address and contract ID. The smart contract will need to be verified using the new addresses.*

An essential detail to remember is that smart contracts verified on Hedera's Sourcify instance won't automatically appear as verified on Sourcify.dev or vice versa. Users interested in having their smart contract recognized across multiple platforms should consider verifying on both instances.

***

## Verify Your Smart Contract

Learn how to verify your smart contract on [HashScan](/hedera/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan) or programmatically using the [Sourcify API](/hedera/sdks-and-apis/smart-contract-verification-api):
Verify your contract directly at [sourcify.dev](https://sourcify.dev), via the [Sourcify v2 API](/hedera/sdks-and-apis/smart-contract-verification-api), or through Foundry / Hardhat tooling:

<Card
title="How To Verify A Smart Contract On Hashscan"
title="Verify a Smart Contract on HashScan"
href="/hedera/tutorials/smart-contracts/how-to-verify-a-smart-contract-on-hashscan"
/>

<Card
title="Smart Contract Verification Api"
title="Deploy and Verify a Smart Contract with Foundry"
href="/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-foundry"
/>

<Card
title="Deploy and Verify a Smart Contract with Hardhat"
href="/hedera/getting-started-evm-developers/deploy-a-smart-contract-with-hardhat"
/>

<Card
title="Smart Contract Verification API"
href="/hedera/sdks-and-apis/smart-contract-verification-api"
/>

Expand All @@ -224,7 +222,7 @@ Learn how to verify your smart contract on [HashScan](/hedera/tutorials/smart-co

**➡** [**HashScan Network Explorer**](https://hashscan.io/)

**➡** [**Smart Contract Verifier Page**](https://verify.hashscan.io/)
**➡** [**Sourcify Verification UI**](https://sourcify.dev)

**➡** [**Full vs Partial Match Docs**](https://docs.sourcify.dev/docs/full-vs-partial-match/)

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ By the end of this tutorial, you will be able to:

- Compile and deploy a smart contract using Foundry
- Interact with a smart contract using Foundry's `cast` command
- Verify your smart contract on [Hashscan](https://hashscan.io/)
- Verify your smart contract programmatically with `forge verify-contract`

---

Expand All @@ -39,7 +39,7 @@ This will install `forge`, `cast`, `anvil`, and `chisel`.
3. [Step 3: Create a Deployment Script](#step-3%3A-create-a-deployment-script)
4. [Step 4: Deploy your ERC20 Smart Contract](#step-4%3A-deploy-your-erc20-smart-contract)
5. [Step 5: Interacting with the Contract](#step-5%3A-interacting-with-the-contract)
6. [Step 6: Verifying the Contract on Hashscan](#step-6%3A-verifying-the-contract-on-hashscan)
6. [Step 6: Verify Your Smart Contract with Foundry](#step-6%3A-verify-your-smart-contract-with-foundry)

---

Expand Down Expand Up @@ -214,7 +214,7 @@ After a few moments, you will see the address of your newly deployed contract:
```

<Check>
Copy the deployed contract address—you'll need this in subsequent steps.
Copy the deployed contract address. You'll need this in subsequent steps.
</Check>

---
Expand Down Expand Up @@ -301,17 +301,19 @@ The output will show the 100 tokens you sent:

---

## Step 6: Verifying the Contract on Hashscan
## Step 6: Verify Your Smart Contract with Foundry

Verifying your smart contract makes its source code publicly available on Hashscan. The constructor for this contract takes one argument (`initialOwner`), which we must provide for successful verification.
Foundry can verify your contract programmatically straight from the command line via `forge verify-contract`. Programmatic verification is the most reliable and efficient method, especially for complex or upgradeable contracts, because Foundry already knows your exact compilation settings, dependency graph, and deployment artifacts.

Run the following command, using the variables you set earlier.
`forge verify-contract` submits the verification request to [Sourcify](https://sourcify.dev), which natively supports Hedera Mainnet (chain ID `295`) and Testnet (chain ID `296`). Once Sourcify accepts the match, the verified status surfaces automatically on [HashScan](https://hashscan.io/) and any other explorer that reads from Sourcify.

The constructor for this contract takes one argument (`initialOwner`), which we must provide for successful verification. Run the following command, using the variables you set earlier.

```bash
forge verify-contract $CONTRACT_ADDRESS src/HederaToken.sol:HederaToken \
--chain-id 296 \
--verifier sourcify \
--verifier-url "https://server-verify.hashscan.io/" \
--verifier-url "https://sourcify.dev/server" \
--constructor-args $(cast abi-encode "constructor(address)" $MY_ADDRESS)
```

Expand All @@ -333,12 +335,10 @@ Contract successfully verified
- Follow more [Foundry guides with Hedera](/hedera/tutorials/smart-contracts/foundry).

<Columns cols={2}>
<Card
title="Writer: Kiran, Developer Advocate"
title="Writer: Kiran, Developer Advocate"
arrow
>
<Card title="Writer: Kiran, Developer Advocate" arrow>
[Github](https://github.com/kpachhai) | [Linkedin](https://www.linkedin.com/in/kiranpachhai/)
</Card>

<Card title="Editor: Luke, DevRel Engineer" arrow>
[GitHub](https://github.com/LukeForrest-Hashgraph) | [X](https://x.com/_LukeForrest)
</Card>
</Columns>
Loading
Loading