Stack Exchange, First off I would like to say, as a grateful reader on many different stack forums, thank you all for the competent, articulate and drama-free solutions written on these pages. So many other discussion boards quickly turn into argumentative "king of the hill" style games. It's refreshing to be able to go to a stack forum and ALWAYS find something worth reading. Thank you all.
I have a problem that I can't seem to solve and I'm learning cryptocurrency with hopes to eventually run a node for various tokens... In an attempt to DYOR and hopefully profit on some ICOs I thought I would verify that these audit companies are actually doing a good job. In an audit report that was done by a company cyber scope that specializes in audits, all of which are posted on their GitHub. The ETF company in question advertises their smart contract address and I can see the source on EtherScan. It's got the green check mark and says that it's verified. I'm not sure how this verification is done and I understand there could be some plausible ways that these values don't match up but The SHA 256 value of the two files that were verified for their smart contract do not match up to the SHA 256 values that I get if I can pile the source code individually. Interestingly enough I have contacted both cybroscope and this ETF company by email and written communication and after a couple emails they understand exactly what I'm referring to they stop responding. Since then I've noticed that I'm no longer able to search by the company name on either scan to find these smart contracts I need the contract address, almost like after I mentioned it they are trying to hide this detail.
I'm concerned that the version of the smart contract that was audited was changed to be malicious in a sneaky way and I don't have enough knowledge about solidity to read it myself and if I can't verify the checksum what's the point of even having it? We use checksums all the time to verify that it download is intact. I want to make sure that the smart contract code that's going to run at launch is actually the version that received the good audit. I made a very detailed post on Reddit in a subform specifically for this project and it was immediately flagged and removed. I inquired with the moderator as to why after reading their content policy and to refuse to give me anything more than extremely vague answer. Of course i was dissatisfied with this and politely explained that to him. It was at this point that i got permanently banned from the forum. Very frustrating.
I found a couple good articles that are similar or provide some background to discuss I have linked to those below.
Ultimately, I would like to know how I can carry out DYOR and verify that it's a trustworthy project etc etc.
Thanks!
