search

aergoio / aergoscan

Aergo Blockchain Explorer
http://aergoscan.io
5 stars 1 forks source link

Proposal: Contract code verification #33

Open kroggen opened 2 years ago

kroggen commented 2 years ago

Most tokens should be created through the ARC1 Factory, to increase the trust in the created tokens. Once a token is created by the factory, we know that the code is not modified so we can have a higher degree of trust on them.

Tokens created without the factory do not have the same security guarantees

Proposal

To implement a contract code verification on AergoScan

It would be used for those tokens created outside the factory

In these cases the token creator (or anyone) can send the contract code and then it is compiled by AergoScan and the bytecode is compared to the deployed one. If it is the same, the contract code can then be displayed on the token page on AergoScan, for anyone interested in reviewing it

graup commented 2 years ago

Yeah, this is definitely a necessary feature. This was planned for a long time (#2) but never implemented.

kroggen commented 1 year ago

There is a problem to implement this

LuaJIT bytecode generation is not deterministic

https://github.com/LuaJIT/LuaJIT/issues/1008

kroggen commented 1 year ago

Possible solution:

Compile the source code in a loop up to 1000 times, until the output bytecode matches the one deployed

rabbitprincess commented 1 year ago

Possible solution:

Compile the source code in a loop up to 1000 times, until the output bytecode matches the one deployed

in https://github.com/LuaJIT/LuaJIT/issues/1008 issue, it is indeterministic by table iterate logic. but table iterate is deterministic in luajit 5.2.1 version, so these problem is not occur now.