Skip to content

Commit 67c0780

Browse files
Use new match terminology in all pages (#39)
* Add .vscode to .gitignore * Update documentation links to reflect new exact match terminology and add @docusaurus/plugin-client-redirects for handling redirect * Adapt matches description page to new terminology * Rename match doc file * Adapt all pages to new match terminology * Update docs/3. Verification/2. exactMatchVsMatch.md Co-authored-by: Kaan Uzdoğan <kaanuzdogan@hotmail.com> * Update .gitignore * Update match descriptions --------- Co-authored-by: Kaan Uzdoğan <kaanuzdogan@hotmail.com>
1 parent 0fab1a5 commit 67c0780

File tree

18 files changed

+100
-47
lines changed

18 files changed

+100
-47
lines changed

.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,5 @@
1818
npm-debug.log*
1919
yarn-debug.log*
2020
yarn-error.log*
21+
22+
.vscode

blog/finding-auxdatas-in-bytecode/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ The runtime bytecode of contracts by default also contain a special field at the
2222

2323
For a visual explanation of everything above, check out [playground.sourcify.dev](https://playground.sourcify.dev/)
2424

25-
Because of its sensitivity, some verifiers leave this field out in verification. In Sourcify’s case, if the recompiled bytecode and the onchain bytecodes match each other exactly (including the auxdata), it’s great. This will give us a [“full match”](https://docs.sourcify.dev/docs/full-vs-partial-match/). If not, we need to find the auxdatas and leave them out when comparing to be able to get at least a "partial match".
25+
Because of its sensitivity, some verifiers leave this field out in verification. In Sourcify’s case, if the recompiled bytecode and the onchain bytecodes match each other exactly (including the auxdata), it’s great. This will give us a [“full match”](https://docs.sourcify.dev/docs/exact-match-vs-match/). If not, we need to find the auxdatas and leave them out when comparing to be able to get at least a "partial match".
2626

2727
However this is not always trivial especially in these cases:
2828

blog/human-readable-tx-wg/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ As a basic example, our goal is to show something similar to the one on the righ
2828

2929
Nowadays, many wallets can do the basic ABI decoding and show a verified contract link but users still lack a description of the action they are about to take and additional safety information about the contract they are going to interact with.
3030

31-
How we achieve this at Sourcify is through the [NatSpec](https://docs.soliditylang.org/en/latest/natspec-format.html) documentation. If you document your code using NatSpec's `@notice` and `@dev` fields and [fully verify](https://docs.sourcify.dev/docs/full-vs-partial-match/) your contract on Sourcify, the wallet can show the users the description you wrote when calling the function. (details [in this talk at Devcon VI](https://www.youtube.com/watch?v=Ggm82pnalCI) or [this lightning talk](https://www.youtube.com/watch?v=D7gZtHel8Lg)).
31+
How we achieve this at Sourcify is through the [NatSpec](https://docs.soliditylang.org/en/latest/natspec-format.html) documentation. If you document your code using NatSpec's `@notice` and `@dev` fields and [fully verify](https://docs.sourcify.dev/docs/exact-match-vs-match/) your contract on Sourcify, the wallet can show the users the description you wrote when calling the function. (details [in this talk at Devcon VI](https://www.youtube.com/watch?v=Ggm82pnalCI) or [this lightning talk](https://www.youtube.com/watch?v=D7gZtHel8Lg)).
3232

3333
Over time it became clear to me that even if we convince the majority of developers to document using NatSpec and fully verify on Sourcify, this single route won't solve this wicked problem of **Human-readable Transactions**. The problem is multi-faceted and requires different approaches for different cases. For instance, you can't add NatSpec docs to an already deployed contract, or you can't use [Dynamic Expressions](https://docs.soliditylang.org/en/latest/natspec-format.html#dynamic-expressions) for a commit-reveal transaction (e.g. ENS commit).
3434

blog/human-readable-txs-learnings/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ This is a MUST. Period. Without verification there's no way to tell what a contr
6161

6262
DO NOT INTERACT WITH CONTRACTS THAT ARE UNVERIFIED
6363

64-
The contract should be verified by a verifier, but ideally it is verified at multiple places. Even better if the verification is a ["perfect/exact match"](/docs/full-vs-partial-match/), this gives you a cryptographic guarantee that what you see is exactly what the contract author deployed, even the comments, whitespaces etc.
64+
The contract should be verified by a verifier, but ideally it is verified at multiple places. Even better if the verification is a ["perfect/exact match"](/docs/exact-match-vs-match/), this gives you a cryptographic guarantee that what you see is exactly what the contract author deployed, even the comments, whitespaces etc.
6565

6666
Players here: [Blockscout](https://www.blockscout.com), [Etherscan](https://etherscan.io/), [Routescan](https://routescan.io/), [Tenderly](https://tenderly.co/), Sourcify, and the [Verified Alliance](https://verifieralliance.org/) initiative.
6767

blog/talk-about-onchain-metadata-hash/index.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ date: 2023-08-13
1313

1414
## Introduction
1515

16-
Solidity compiler has a feature, not known by everyone, that appends the IPFS hash of the [contract metadata](/docs/metadata/) to the contract bytecode. This hash effectively acts as a _fingerprint_ of the compilation, and when deployed, goes onchain. With that, we can verify the contracts ["perfectly"](/docs/full-vs-partial-match/) and fetch the contract source code from IPFS. One of our
16+
Solidity compiler has a feature, not known by everyone, that appends the IPFS hash of the [contract metadata](/docs/metadata/) to the contract bytecode. This hash effectively acts as a _fingerprint_ of the compilation, and when deployed, goes onchain. With that, we can verify the contracts ["perfectly"](/docs/exact-match-vs-match/) and fetch the contract source code from IPFS. One of our
1717
missions at Sourcify is to make this feature more known and used, but [not everyone is a fan of it](https://github.com/ethereum/solidity/issues/1571).
1818

1919
(If you don't fully understand the metadata hash check out [our playground](https://playground.sourcify.dev/) to see it in action.)
@@ -82,7 +82,7 @@ This is because this constructor code part will not be included in the runtime b
8282

8383
### Verifying with the Runtime Bytecode + Metadata Hash
8484

85-
There's a way around this problem. If you verify a contract with its [metadata hash appended](https://docs.soliditylang.org/en/latest/metadata.html#encoding-of-the-metadata-hash-in-the-bytecode) to the runtime bytecode, you'll get a [full match](http://localhost:3000/docs/full-vs-partial-match/). This means the source code you are looking at is exactly the same as the one that was originally compiled, because if you change anything about the contract (even a whitespace), the metadata hash will change and you will not get a "full match" but a "partial match".
85+
There's a way around this problem. If you verify a contract with its [metadata hash appended](https://docs.soliditylang.org/en/latest/metadata.html#encoding-of-the-metadata-hash-in-the-bytecode) to the runtime bytecode, you'll get a [full match](http://localhost:3000/docs/exact-match-vs-match/). This means the source code you are looking at is exactly the same as the one that was originally compiled, because if you change anything about the contract (even a whitespace), the metadata hash will change and you will not get a "full match" but a "partial match".
8686

8787
This, I'd argue, is the only foolproof way to verify a contract's source code. This method covers all the cases above and the ones I haven't mentioned or we don't know about yet. By being based on the runtime code, this also removes the need to trust a third party to index the creation bytecode, and instead you can get the bytecode from your own execution client's JSON RPC interface.
8888

blog/technical-verification-walkthrough/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -479,7 +479,7 @@ This section does not contain any opcodes or executable bytes and therefore inde
479479
480480
However it is not straightforward to find where these sections are in the bytecode. You can read [our blog post](/blog/finding-auxdatas-in-bytecode/) for more technical info how to do this.
481481
482-
To read more about how this helps with verification [see our docs](/docs/full-vs-partial-match)
482+
To read more about how this helps with verification [see our docs](/docs/exact-match-vs-match)
483483
484484
Since we replace a `cborAuxdata` with another, this is a `replace` type transformation.
485485

docs/20. databaseMigration.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ We cannot move completely to a database dropping the filesystem because we want
2525

2626
- **RepositoryV1 (deprecated)**: a refined version of the old repository containing contracts stored with new verification and storage strategies.
2727
- **RepositoryV2**: a filesystem-based repository where sources for each contract are stored in its `sources/` folder, without replicating the contract's original filesystem structure. Instead, it names files using `keccak256(file: string)`.
28-
- **Database**: a PostgreSQL database based on [the schema of the Alliance Database](https://github.com/verifier-alliance/database-specs) customized to better fit Sourcify. In particular the Alliance Database doesn't allow storing contracts without creation bytecode and it doesn't explicitly support the concept of [full vs partial verification](/docs/full-vs-partial-match).
28+
- **Database**: a PostgreSQL database based on [the schema of the Alliance Database](https://github.com/verifier-alliance/database-specs) customized to better fit Sourcify. In particular, the Alliance Database doesn't allow storing contracts without creation bytecode.
2929

3030
## Migration process
3131

docs/3. Verification/2 .fullVsPartialMatch.md renamed to docs/3. Verification/2. exactMatchVsMatch.md

Lines changed: 19 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
id: full-vs-partial-match
3-
title: Full vs Partial Match
4-
slug: /full-vs-partial-match
2+
id: exact-match-vs-match
3+
title: Exact Match vs Match
4+
slug: /exact-match-vs-match
55
---
66

77
import AvailableOnlyForSolidityAdmonition from "../AvailableOnlyForSolidityAdmonition";
@@ -19,26 +19,28 @@ Different compilation settings i.e. compiler versions, optimization runs result
1919

2020
:::
2121

22-
If the bytecode from recompiling the contract with the given source code files and the metadata correspond to the bytecode of the contract of the given address and chain, it will be a **match**. Sourcify defines two types of matches upon verifying contracts: **full (perfect) matches** and **partial matches**.
22+
If the bytecode from recompiling the contract with the given source code files and the metadata correspond to the bytecode of the contract of the given address and chain, it will be a **match**. Sourcify defines two types of matches upon verifying contracts: **Exact Matches** and **Matches**.
2323

2424
:::info Info
2525

26-
The match levels will be renamed in Sourcify's API v2:
26+
The match levels used a different terminology previously:
2727

28-
- Full match will be renamed to **exact match**
29-
- Partial match will be renamed to **match**
28+
- Exact Match was called **Full / Perfect Match**
29+
- Match was called **Partial Match**
3030

31-
This only concerns the naming, and the description of the match levels on this page will still be valid.
31+
This only concerns the naming. Their semantics are the same as before.
3232

3333
:::
3434

35-
## Full (Perfect) Matches
35+
## Exact Matches
3636

37-
<AvailableOnlyForSolidityAdmonition description="Vyper contracts don't support full matches because Vyper doesn't include the metadata hash in the bytecode."/>
37+
<AvailableOnlyForSolidityAdmonition description="Vyper contracts don't support exact matches because Vyper doesn't include the metadata hash in the bytecode."/>
3838

39-
Full matches (sometimes referred as _perfect matches_) refer to the cases when the bytecode of the deployed contract is byte-by-byte the same as compilation output of the given source code files under the compilation settings defined in the [metadata file](/docs/metadata).
39+
Exact Matches refer to the cases when the bytecode of the deployed contract is byte-by-byte the same (excluding libraries and immutables) as the compilation output of the given source code files under the compilation settings defined in the [Metadata file](/docs/metadata).
4040

41-
This means the contents of the source code files and the compilation settings are exactly the same as when the contract author compiled and deployed the contract. Not even a byte! If you were to add a comment, change a variable or function name, the full match will be broken.
41+
Most importantly, the fingerprints (metadata hashes) of the onchain code and the recompilation are exactly matching. The Metadata file includes the integrity hash of the source files, such that it is guaranteed that the contents of the source code files are exactly the same as when the contract author compiled and deployed the contract. If you were to add a comment, change a variable or function name, the exact match will be broken.
42+
43+
Note that the addresses of the used [libraries](/docs/libraries) can differ in the bytecode if they were linked after the compilation. Similarly, any [immutables](/docs/immutables) will differ in the recompiled bytecode, as they are only placed into the runtime bytecode during deployment.
4244

4345
How does Sourcify achieve this?
4446

@@ -80,18 +82,14 @@ Change a byte in the source code --> Source code hash changes --> Metadata chang
8082

8183
:::
8284

83-
However the only thing that changes in the bytecode when making a non-functional change (add comments, change variable names) is the appended metadata hash field. Which brings us to the partial matches 👇
85+
However, the only thing that changes in the bytecode when making a non-functional change (add comments, change variable names) is the appended metadata hash field. Which brings us to matches 👇
8486

85-
## Partial Matches
87+
## Matches
8688

87-
Partial matches refer to cases when the deployed bytecode of the onchain contract match the bytecode resulting from the recompilation with the metadata and the source files **except the metadata hash**.
89+
Matches refer to cases when the deployed bytecode of the onchain contract match the bytecode resulting from the recompilation with the metadata and the source files **except the metadata hash**.
8890

8991
In other words, the deployed contract and the given source code + metadata _function_ as the same but there are differences in source code comments, variable names, or other metadata fields such as source paths.
9092

91-
This type of match is similar to how Etherscan verifies contracts. Yes, the matching source code in theory functions the same as the deployed contract but the displayed source code can be misleading or the bytecode can contain [excecutable instructions not seen in the source code](https://samczsun.com/hiding-in-plain-sight/).
92-
93-
## Exceptions
93+
Note that here too, [libraries](/docs/libraries) and [immutables](/docs/immutables) can differ between the onchain bytecode and the recompilation.
9494

95-
### Immutables
96-
97-
### Libraries
95+
This type of match is similar to how Etherscan verifies contracts. Yes, the matching source code in theory functions the same as the deployed contract but the displayed source code can be misleading or the bytecode can contain [excecutable instructions not seen in the source code](https://samczsun.com/hiding-in-plain-sight/).

docs/3. Verification/4. immutables.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ slug: /immutables
88

99
## Solidity
1010

11-
While Sourcify can verify **Solidity** contracts containing immutable variables, the process is more intricate than verifying contracts that don't have immutables. First, Sourcify recompiles the contract, which produces the runtime bytecode and the `immutableReferences` object. This object indicates the specific position within the execution bytecode where the immutable variables are located. After obtaining these, the next step is to replace all instances of the immutables in both the runtime and deployed bytecodes with zeros. Finally, a direct comparison is made between the two bytecodes to get a full or a partial match.
11+
While Sourcify can verify **Solidity** contracts containing immutable variables, the process is more intricate than verifying contracts that don't have immutables. First, Sourcify recompiles the contract, which produces the runtime bytecode and the `immutableReferences` object. This object indicates the specific position within the execution bytecode where the immutable variables are located. After obtaining these, the next step is to replace all instances of the immutables in both the runtime and deployed bytecodes with zeros. Finally, a direct comparison is made between the two bytecodes to get an exact match or a match.
1212

1313
More details on how immutables affect verification below:
1414

docs/3. Verification/8. Etherscan.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import EtherscanInstances from "./etherscanInstancesTable.tsx";
1111

1212
It is possible to import contracts already verified on Etherscan instances.
1313

14-
Usually, if the contract is verified via the "Standard JSON Input", it reveals a "full match" instead of "partial".
14+
Usually, if the contract is verified via the "Standard JSON Input", it reveals an Exact Match instead of a Match.
1515

1616
[![Etherscan import](./etherscanScreenshot.png)](./etherscanScreenshot.png)
1717

0 commit comments

Comments
 (0)