SPDX license when importing other people's contracts

Question

Since Solidity 0.6.8, the compiler started throwing warnings if a contract isn't annotated with a SPDX license identifier:

// SPDX-License-Identifier: MIT

contract MyContract {
    ...
}

Suppose that I'm importing third-party contracts, like those from OpenZeppelin or the UnorderedKeySet library built by Rob Hitchens. I will eventually want to verify the source code of my contracts on Etherscan, and it's common to flatten the contracts before doing that. How should I handle the SPDX identifiers in this case?

It it ok for a flattened file to contain multiple SPDX identifiers?

Answer 1

You're right to note that this is an issue when flattening source code for Etherscan verification. There are two solutions to this.

The best solution is to not flatten the source code and instead use Standard Input JSON for verification. Most tooling plugins support that by now (like truffle-plugin-verify and hardhat-etherscan). If you're not using any of these tools, you can also use the Solt tool which generates a Standard Input JSON file for a specific contract, that can then be submitted to Etherscan.

An alternative (but worse) solution is to use a flattening tool that can remove SPDX Identifiers, such as sol-merger. Then you can add the SPDX Identifier of your choice to the top of the flattened file (or not use one if you like).