Solidity Smart Contract Verification Tool

This tool allows you to verify Solidity smart contracts by comparing the bytecode on the blockchain with the recompiled bytecode.

Features

• Recompiles Solidity smart contracts using a specified compiler version.
• Compares the on-chain bytecode with the recompiled bytecode.
• Provides detailed error messages if verification fails.
• Preserves metadata settings such as evmVersion and eofVersion when recompiling.
• Polkadot revive(https://github.com/paritytech/revive) support.
• No dependency on external services or third-party libraries.

Installation

Use Go 1.26.10, matching go.mod, CI, and Dockerfile.local. This includes the crypto/x509 certificate verification fix in GO-2026-6809. With gvm, select the toolchain before running Go commands:

source ~/.gvm/scripts/gvm
gvm use go1.26.10

1. Clone the repository:

git clone https://github.com/subscan-explorer/solidity-verification-tool.git

2. Navigate to the project directory:

cd solidity-verification-tool

3. Install dependencies:

go mod tidy

Usage

1. Start the server:

go run .

2. Send a POST request to /verify with the contract metadata and compiler version. If the contract was compiled for EOF, include settings.eofVersion in the metadata JSON.

curl -X POST -H "Content-Type: application/json" -d '{"metadata": {...}, "compilerVersion": "v0.8.26+commit.8a97fa7a","chain":46,"address":"xxxx"}' http://localhost:8081/verify

Example EOF metadata fragment:

{
  "settings": {
    "evmVersion": "osaka",
    "eofVersion": 1
  }
}

Revive support

Building Solidity contracts for PolkaVM requires installing extra dependencies. To install revive, run the following command:

go run . download # if will auto download latest resolc binary in static folder

Development

go test -mod=mod -v ./...
go vet ./...
make build

The compiler integration tests download amd64 solc binaries. ARM developers need an amd64 execution environment to run these tests.

CI compiles verification with the Go version in go.mod before the production Dockerfile packages it. Dockerfile.local compiles the service inside its Go builder image. Updating the production Alpine base alone does not rebuild Go.

License

This project is licensed under the MIT License.