The scenario is that scammers could give a .sol on an open github repo and deploy another contract on the ethereum blockchain. One reason to do that is to give a github smart contract with a vesting coded and deployed a smart contract without vesting coded on to the blockchain.

The reason I'm asking this is that I can't always check on etherscan.io the source code of some contracts Sometime they do release a github smart contract but how to make sure that the one deployed on github is the one deployed on the blockchain ?

bytecode ?


From https://programtheblockchain.com/posts/2018/01/16/verifying-contract-source-code/:

As you may recall from our recent post How Smart Contract Deployment Works, the transaction that deploys a smart contract has a payload that is derived from the compiled source code and any constructor parameters. This process is fully deterministic, so if you compile the same source code with the same compiler and apply the same constructor parameters, you’ll get the exact same payload.

This repeatable process is the key to verifying the correspondence between Solidity source code and a deployed smart contract. When publishing your source code, you need to provide all the necessary information to recreate the deployment payload. In addition to the source code itself, you need to share what compiler settings you used, what version of the compiler you used, and what constructor parameters you applied. Anyone can then generate the corresponding deployment payload, and then they can find the transaction on the blockchain that created the smart contract in question. If the two payloads match, then the provided source code was, in fact, what was used to deploy that smart contract.

This process is a bit cumbersome, so most people choose to delegate this responsibility to a third party.

Specifically, people usually have Etherscan do the work. You can verify any contract on Etherscan, not just ones you deployed. So if the author has provided sufficient information to repeat their compilation process (full source code, compiler version and settings, constructor parameters), then you can use Etherscan's tools to verify that the code is correct.

If they haven't provided that information, you might ask them to do so.

| improve this answer | |
  • ok, but on etherscan I can't see the source code for some of them that's why I'd like to work on this scenario when I can't have access to the source code on etherscan how do I verify. In the ICO market, very few ppl ask those questions and you can wait until the end of the ICO to have an answer, my point was checking without relying on them to verify if the smart contract deployed is the one I read on their github repo. Thank you for your answer and the link ! – francoisduvalcork Mar 25 '18 at 0:21
  • The link I shared tells you how to verify the source code on Etherscan. Is there a step you're confused about? – user19510 Mar 25 '18 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.