Sourcify — हर Contract के लिए Verified Source Code

# Sourcify — हर Contract के लिए Verified Source Code

Blockchain transparent है, लेकिन bytecode पढ़ना impossible है। Source code verification जरूरी है — और Sourcify इसे decentralized तरीके से करता है।

Problem: Etherscan Monopoly

आज verification का process:

Contract deploy करो

Etherscan पर जाओ

Source code manually paste करो

Compiler settings match करो

Hope करो कि verification pass हो

Problems:

• ❌ Centralized (Etherscan down = no verification)

• ❌ Manual process

• ❌ Chain-specific (हर chain पर repeat करो)

• ❌ Metadata often lost

Sourcify का Solution

Decentralized verification using IPFS + metadata.json

Core Concept

Solidity compiler एक metadata file generate करती है:

{
  "compiler": {"version": "0.8.20"},
  "language": "Solidity",
  "output": {
    "abi": [...],
    "devdoc": {...},
    "userdoc": {...}
  },
  "settings": {
    "optimizer": {"enabled": true, "runs": 200},
    "metadata": {"bytecodeHash": "ipfs"}
  },
  "sources": {
    "Contract.sol": {
      "keccak256": "0x...",
      "urls": ["bzz-raw://...", "dweb:/ipfs/..."]
    }
  }
}

Ye metadata bytecode में embed होता है:

0x608060405... <bytecode> ...a264697066735822<metadata_hash>

Verification Process

1. Contract Compile करें

forge build --extra-output metadata

या

hardhat compile

2. Metadata Extract करें

# Foundry
cat out/MyContract.sol/MyContract.json | jq '.metadata'

# Hardhat
cat artifacts/contracts/MyContract.sol/MyContract.json

3. Sourcify पर Verify करें

Method A: Web UI

https://sourcify.dev पर जाओ

"Verify Contract" click करें

Address + chain select करें

Source files drag-and-drop करें

Verify!

Method B: API

curl -X POST \
  https://sourcify.dev/server/verify \
  -F 'address=0x...' \
  -F 'chain=1' \
  -F '[email protected]' \
  -F '[email protected]'

Method C: Foundry Script

// Deploy + verify
forge script DeployScript \
  --rpc-url $RPC_URL \
  --broadcast \
  --verify \
  --verifier sourcify

Full vs Partial Match

Full Match (Perfect)

• Bytecode exactly match

• All metadata identical

• 100% confidence

Partial Match

• Functionally equivalent

• Metadata slightly different (timestamps, paths)

• Still trustworthy

IPFS Integration

Verified contracts automatically IPFS पर publish होते हैं:

ipfs://Qm.../
  ├── metadata.json
  ├── Contract.sol
  ├── dependencies/
  │   ├── ERC20.sol
  │   └── SafeMath.sol
  └── abi.json

Benefits:

• Permanent storage

• Censorship-resistant

• Automatic discoverability

Multi-Chain Support

Sourcify supports 100+ chains:

• Ethereum Mainnet

• All testnets

• Polygon, Arbitrum, Optimism

• BSC, Avalanche

• Gnosis Chain

• ... और बहुत सारे

One verification → all explorers

Integration with Tools

1. Etherscan

Etherscan अब Sourcify से data pull करता है:

"Contract verified on Sourcify"
[View on Sourcify] button

2. Hardhat

// hardhat.config.js
module.exports = {
  sourcify: {
    enabled: true,
    apiUrl: "https://sourcify.dev/server",
    browserUrl: "https://repo.sourcify.dev"
  }
};

npx hardhat sourcify

3. Foundry

forge verify-contract \
  --verifier sourcify \
  --verifier-url https://sourcify.dev/server \
  0xYourContract \
  src/Contract.sol:ContractName

4. Remix IDE

Deploy के time "Publish to IPFS" checkbox → automatic Sourcify verification।

Repository Structure

Local Sourcify repo browse करें:

git clone https://github.com/sourcifyeth/repo
cd repo/contracts

# Full matches
ls full_match/1/0xContractAddress/

# Partial matches
ls partial_match/1/0xContractAddress/

Developer Workflow

Recommended Setup

// Foundry project
// foundry.toml
[profile.default]
via_ir = false
bytecode_hash = "ipfs"
cbor_metadata = true

# Deploy script
forge script Deploy \
  --rpc-url mainnet \
  --broadcast \
  --verify \
  --verifier sourcify \
  --verifier-url https://sourcify.dev/server

CI/CD Integration

# .github/workflows/deploy.yml
name: Deploy and Verify
  run: |
    forge script Deploy --broadcast --verify --verifier sourcify
  env:
    PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}

Benefits for Users

Trust

User: "Is this contract safe?"
→ Check Sourcify
→ Read actual source code
→ Verify functions match documentation

Composability

// अन्य contracts के ABI automatically discover करो
import "sourcify://1/0xContractAddress/Contract.sol";

Auditing

Auditors directly IPFS से source download कर सकते हैं — guaranteed same as deployed।

Common Issues

Issue 1: Metadata Mismatch

Error: Bytecode doesn't match

Fix: Exact compiler settings use करो:

// hardhat.config.js
solidity: {
  version: "0.8.20",
  settings: {
    optimizer: {
      enabled: true,
      runs: 200  // ये exactly same होना चाहिए
    }
  }
}

Issue 2: Missing Dependencies

Error: Cannot resolve imports

Fix: सभी imported files include करें:

curl -X POST https://sourcify.dev/server/verify \
  -F '[email protected]' \
  -F '[email protected]' \
  -F '[email protected]' \
  -F '[email protected]'

निष्कर्ष

Sourcify blockchain ecosystem के लिए critical infrastructure है:

• Decentralized — no single point of failure

• Permanent — IPFS storage

• Universal — multi-chain support

• Automated — tooling integration

हर contract verified होना चाहिए। यह transparency और trust के लिए जरूरी है।

अगले deployment में Sourcify verification add करें — users appreciate करेंगे।