reproducible builds and verified smart contracts

[Martin Monperrus]

Hi all,

I wanted to share something from the smart-contract world that is very related to what we are 
discussing here: “verified smart contracts.”

The idea is essentially reproducible builds applied to blockchain code.

In practice, a project publishes its Solidity/Vyper/etc. source code and the exact build 
configuration on platforms such as Etherscan  or Sourcify) and anyone can recompile it to check that 
the bytecode deployed on-chain matches the output bit for bit. Trusted authorities like Etherscan  
or Sourcify display the results of this recompilation and outputs the contract has "verified" (ie 
reproducible) or not. If you want to have a look: https://info.etherscan.com/how-to-verify-contracts/

Concrete examples:

* https://etherscan.io/token/0xdac17f958d2ee523a2206206994597c13d831ec7

  the green check means "reproducible"

* https://sourcify.dev/server/v2/contract/1/0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552 says

> "verifiedAt": "2024-08-08T11:21:32Z",
> "creationMatch": "exact_match",
> "runtimeMatch": "exact_match",
> "match": "exact_match",
>
There are 820193 verified / reproducible smart contracts <https://etherscan.io/contractsverified>.

The mechanics aren’t identical to traditional builds, but the conceptual overlap is large: 
transparent source, deterministic compilation, verifiable artifacts, and an ecosystem gradually 
moving toward “trust, but verify.”

Thought it might be of interest to some here.

Best,

--Martin Monperrus
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20251119/1580c34d/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: iXxt20YkA0Tax2W9.png
Type: image/png
Size: 3880 bytes
Desc: not available
URL: <http://lists.reproducible-builds.org/pipermail/rb-general/attachments/20251119/1580c34d/attachment.png>