Workshop: Ethereum Transactions - #1 Verifying Contracts

okay uh thanks everyone for joining it's 405. we will start the workshop now uh quick uh introduction uh so uh today giving us uh this workshop is chichwan who works at uh scan uh if you've seen some features on ecoscan such as the token approvals or the ens name tag that's coming from chichwan mainly so today he will be sharing with us um some simple things around verifying contracts why it matters how to do it and a walkthrough of one or two examples and this is the first in a series of workshops that we'll be doing that will be exploring uh transactions on ethereum in general so do watch out for the other uh workshops that we'll be doing uh right now tentatively we're planning to do it every saturday so every one week but it might change uh depending on circumstances and yeah so if you have any questions feel free to ask in the chat box i am going to force mute for everyone just uh to make sure that we don't get any weird zoom bombing situations um but yeah over to you chitrad ah thank you thank you thank you everyone for joining uh thank you for your time my name is chitran uh today we are going to start our first part of the three part series um well basically the first part is going to be about verifying contracts so we are going to talk about i'm going to share about uh what is verified contracts for those who are unfair unfamiliar with this system and where and how do you verify it so and what's the purpose of a verifying contract so before that uh let's start with angle the end goal for today will be to deploy a smart contract a simple one and to verify in uh these two sources each scan and sourcify so there are two platforms for us to verify contract and well at the end of the day we will uh we will see that our code is being published and everyone in the public can uh take a look at it so over here i have a link and this is an example in the scan i am using covan testnet of uh example of the contract that hasn't been verified so as you can see under the contract section over here everything in this area it's bytecodes uh basic well not very readable to human well of course you can read it but it takes it's not very friendly especially if you want to interact really easily and if you look at the transactions i've made two transactions over here uh the in this case uh there's a but in this case we can still see the function because i actually deployed similar function functions to the 28th scan and in text i have similar it detects i'm using the same function that's that's why it has automatically name it but normally you wouldn't see this you would you would see something like maybe this so it's really hard for people to know like what function am i calling in for this particular transaction if i didn't verify my contract and if i look at the logs the logs will be something like this so it will also be very hard for us to understand what's going on if someone have not verified a contract and let's look at another example of a verified version it's a very similar contract so over here first up i can see there's a little check check mark a green check mark over here it says that you know it actually means that uh the code is uh readable by everyone in the public need to scan so as we can see over here we can look at the contract name the compiler version and some other details such as we can go through the code over here for those who would like to inspect the code before interacting with the smart contract which is generally a good practice this is a good great way to do it and we also have the contract api in case uh for those who wants to build a like a project that interacts with the smart contract people normally gets the contract api and you can get it from here and one thing about interscan is that you can make things easy to interact with the contract so every verified contract will have this read and write a section it basically means that without having to code you can interact with the ether scan interface ui to interact with the contract for example now i can get current number is eight i'm just reading from the from the blockchain the state and i can even um interact with the contract over here if i want and you just need to connect to your metamask or word connect and if this scan does not really does not store your detail at all so feel free to use so this and okay let's take a look at the examples the transaction action shown here so you can see that hey i'm actually calling bound to current number much more current number okay even view source and it shows that uh well it's uh it's calling from uh here right so this is what happens this is our end goal today we will try to uh achieve a minute we'll try to achieve this one this one in the scan oops the verified version sorry wrong button this one interesting uh so we've published our code to public so everyone can read and uh review it if they like so now that's fatal scan and there is another version of a verify contract that people sometimes would like to use is called sourcified or death the difference of society in the scan is that society is decentralized they use ipfs to store your contract so for some people who likes who somehow likes their uh contract to be in a decentralized manner socified is the way to store it and take note that society in the scan they do not share their contract so after you verify your contract in one of this platform you have to do in another time uh in the other platform and vice versa so let's take a look at how society would look like oh unfortunately it's down uh the fun thing i said yesterday i tried to verify contract in sourcify just just to you know test run this project but i couldn't get it to run so so i guess if if if we manifest to run today we can see the final outcome but if we can't i'm just going to show you the steps of what we need and how to do it uh okay so this is a previously verified contract it's a bit slow uh it's very slow uh it always happens when you want to show things live uh it happens yesterday at night as well i don't know why anyway it's fine uh i'm going to show through the example the steps and you can just replicate the steps and if it works i mean if it's 65 it's back up you can follow snapchat and you can do it so one of what i have over here is that i can see that i have a contract full match contract uh in 42 k9042 it means covert and this is the contract address of my contract that i am verifying in sourcify over here they provide you with some folders so the source and the metadata the source will contain the contract code over here i store it here you can see that i'm using upper zeppelin and uh it follows the structure of my folder made a mistake by uh by putting it that did to perform long clicks okay yeah uh so there you are so we can see the code over here in sourcify and everything it's some something to scan since that they're storing in ipfs it generally means that it's more decentralized and one thing diff that is different about solidify with the scan is that in the scan there is a built-in right and right contract feature well sourcifier doesn't have it so for those who like to interact with eaterscan it's better to do it over there or you can just copy this thing and have to write a program to interact with the contract okay so that's the final [Music] that's what we want to achieve at the end of day to deploy a contract and to show hopefully sourcified work to show our contract deployed in inter scan and sourcify okay and today we are going to use three three more main stream tools to deploy our contract and which are primarily remix truffle and hard hat we are going to look into three of the different methods uh and each of them have a bit different but generally sharing the roadmap is similar we first will write a smart contract and then we deploy it using this one uh using the method for remix truffle or hardhat and then we will verify our smart contract so i think we can start with the demo now so i'll start with remix remix so remix will be oh yeah uh for those who would like to have questions this just pull it down the chat box i will reply if i see it and i will try to you know take a bit of a interval in between to read and probably answer questions if there are any okay so this is the remix browser ide you don't have to install anything you just have to have a chrome and then you just go to this website and then um you can see that it appears and you can use this to develop and deploy a smart contract without having to install any fancy softwares so first thing first i am going to create a new new workspace let's call it verify and automatically uh they'll give us some base some bait some basic contracts i'm not going to use them could delete them because i want to make things clean so that it's easier for me to work on this demo later and at the home page we can see that there are featured plugins over here we are going to use a couple of plugins mainly there are plugins for the scanner contract verifier so the verification you can deploy you can verify contract through uh by using remix parking but somehow when i was testing it in testnet it doesn't work so we're not going to do that we're going to do it manually in the scan uh interface and there's a flattener and that's a sourcify uh plug-in as well so we are going to talk about and flatten it later on but we're not going to look at the scan contract verification because it doesn't work for me and test that so i'm going to do that manually so first up let's create our own smart contract okay uh so first off we have to create a file i'm going to call it math and we have well generally there are there are two types of um contracts which you can verify one is a single file contract and one is multi-file contract multi-file contract is some it's it can be a bit tricky so for one sake for today we are going to use this example for multi-file and i'm going to import i'm going to use open zebralen's contract library because that is probably the library that everyone is using right now so for everyone's benefit i'm going to use that so first up i've already written some code snippet on my other screen i'm going to declare the declare the stuff that i need and i'm going to name this i'd like to i'd like to follow the the contract name to follow the file name uh to make things easy and we can actually import open zebra by by pointing it to the github repo like this but make sure that you include it https and then it will work and for the code snippet okay and okay so what i have here is that i have declared some events which i'm going to admit later uh we will talk about events in uh future workshops but for now just remember just bear in mind that we are going to make events and there are some write contract functions and a recontract function one recontract function that we are going to deploy so once we have everything we are going to this this part and ensure that the compiler version matches to this this thing uh so this is 0.6 above 0.6.0 so i'm going to 0.

6.12 because i tried to enable and i'll just compile it and then you can see that everything works now so i'm going to head back to the workspace and after compiling uh we can see that in the dot dapps file in the git there's a new folder here it's called github and inside there's an open zeppelin contract save math that we are using which is this one over here can i please zoom a little bit uh can i zoom is this helping i take it and say yes all right no problem cool uh where was i uh yes so the uh once i did once i uh compiled the contract remix automatically gets the uh file from this link and you can see it appearing in um in our workspace file explorer okay and now we are going to we have compiled it so we are now going to deploy it i'm going to choose oops wrong one metamask is injected for tree forgot to unlock okay uh i'm using kovan i have plenty of cover eater and well after it's done we can deploy okay methamphetamine and uh okay uh over here we can see that our contract has successfully been deployed copy that and we just go to coven to ca look at the whole contract so over here this is our contract we just i just deployed 16 seconds ago as expected this thing is a bunch of by codes that is not really readable so we can verify and publish it but we actually can't do it because we are using hang on this one uh although remix supports uh importing file from github link uh the scan verification for multifile does not so we have to find ways to overcome this uh of course uh in truffle and aramaic and hardhat there are better better alternatives but looking at remix we have to look for workarounds so the work first look around is that we are going to flatten the file by saying flatten it basically means that we are taking this part of the contract and we just copy paste it on top of our math contract underscore remix file so basically we are combining multiple files into one huge uh one huge solidity file and then we deploy it as one file so let's do it i already have my flattened file here after you have deployed it you can click this and save s all right over here it says that i have already this file so if i go to my workspace this thing should appear so uh note that now the save map file it's this one library and at the bottom we will have this uh contract underscore remix that math contract underscore remix that we just wrote so we are going to we are going to uh try to compile this and see if it works a lot and and it will not work because one thing about uh com flattening file is that we have to take care of the licensing for both control contracts that we are uh flattened threatening so on top here we can see that uh this thing has already has an mit license and over here there's another so you cannot have two license at one place so we're gonna just remove this one i'm gonna remove this one as well okay and after we have removed this we can compile it successfully just like this so uh the difference between this flattened file and the one before uh instead now everything is um everything is in one hub solidly file uh yes back double black chest is a way to command in a salty file yes um so now we are going to deploy this and we are going to verify this as a single uh smart contract so i've already compiled we'll throw this away to make sure to keep this clean right and confuse myself deploying it again and just give it a bit of time and yeah there you go we have successfully deployed our contract i'm just going to navigate to that address takes about two to show up but it's there don't worry it's there yeah so now this is our contract that we are going to verify and before i do that there are two things that i need to uh take i do not have to take care of one i have to know what version that i'm using for compiler and the other one if whether or not if i auto compile uh have i select the auto option for my um for when i'm deploying this so i have not so after that you just click this button here uh well how did i replace the github again i actually did not i flattened the file and the flattener automatically copies the code over from the github link uh smart contract and appended on top of the smart contract that i created and then it creates a new flattened version for the file which now i i i've just published can i address be also a wallet and contract the same type no it cannot what does optimization refers to optimization basically um optimization basically means that it uses the solidity compiler to try to make your code more optimized so that when you interact with it it actually saves guests at a cost of sometimes making the code a bit more more unreadable so for small contracts it shouldn't matter but for big contracts maybe it's a worthwhile thing to do so it always better uh well at the expense of making it hard to read how does one deploy contracts on different networks with the same address like one inch that is a good question something that i have yet to figure out uh i'm pretty sure they use uh this thing called create tool uh opcode um i'm not really sure but create tool code allows you to predetermine the contract address before you deploy so i think uh it has something to do with it uh not too sure of the details all right so let's proceed with our uh very very very fun contract so over here we select single file and compiler version i i chose 6.12 uh this one i can follow back if i can yeah it's very optional i just follow back mit because i use mitv4 continue and over here make sure that this thing follows our configuration that we had before here okay and you need to enter our solidity code so we have to copy exactly what we have over here and paste it here and just verify it thanksgiving so it takes a while to verify and after doing it exactly and you have the code you didn't change the code when you copy and paste it it will show you a success success status when you and you can go to your contract and you can see that now indeed you can view all codes and then you can interact interact with uh with this one over here okay so this is how we do it option number one by flattening the file but sometimes sometimes flattening the form may not be a good option because um for example what if what happened if we were to uh let's go back to our contract first uh here weapon if you were to use like a lot of imports where you we are using a lot of uh open librarian file for another safe map and probably there are other other things like maybe lc20 you know maybe five or six imports sometimes up to up to maybe 10 or 20 and what happened if we have import really important so everything is going to be quite messy and flattening your file is it's quite hard to reader it's one long big file so we still want to uh employ it as a multi-file and in and we can't do it this way uh the thing about remix is that well you can't do this way but um the thing already is that you can you will need to then uh create another contract um i will show you it's easier to show i'm going to re i'm going to name it exactly how it is how to and how to name it to save math and i'm going to copy over this file that i have from open nebulae exactly paste it here and in my original thing original thing that refers to github repo i am going to be pointed to our my local instance of a source safe math dot solve file which is this one that i just copied over so it will look exactly like the open zipline version except that now instead of pointing to the github we are actually cloning it copying it to our local workspace and then we can compound okay and then compound successfully and then we can deploy uh i'll just make it clear everything so we deploy so the trick is to change the import to the local instance of the file instead of referring to the github.com and let's go here [Music] take so long for this thing to appear all right uh this is a multi-file so when i go to here and try to verify it select solitude multiple files 6.12.

this one i can just choose whatever i want okay over here we will need to upload our file make sure the optimization is uh is the same as when you compile it so i'm going to load the file that i that i have deployed which are this one and this one so i'm gonna basically download this two file into my local workspace uh there's a simple way of doing it i can click this button over here click and download all files you just zip my file menu and this is a file that i just downloaded yes you mean workspace this book this space and it's going to be these two files that i'm going to use to verify so now i already have this just copy this path because i will need it here and upload these two okay now i've uploaded successfully these two files and verified yeah it's going to take a while all right uh as you can see it is successfully verified let's take a look so over here this thing is it's really uh referring to our local uh soft math uh workspace and this is our submit file so as you can see we have deployed a multi-part file this thing is something that this function is gonna use and everything it's exactly as i want it to be okay so this is how i however you find um single part or multi-part contracts in either scan and let's try to see let's try it let's try and see if sourcify works i can use the sourcified plugin coven because i this is covalent uh is this common or safe how can you be certain that the local file was not modified without going over each line uh um you can't you can't you can't uh you have to ensure that the person who deploys it doesn't tamper with the local file so maybe you can uh you can use the contract difference feature in uh in interscene or you can just copy it to textile and see if any difference in the in the lines yeah uh so have to be have to be sure that the library that people are using it's has not been tampered with so to say so yeah so over here i'm gonna copy this address okay let's see if it works because it doesn't work for me yesterday so let's see it works it's very simple anyway what is waiting there is also another way to verify uh files and socify the manual manually so this is the main page you need to go here and paste my contract which i just employed oh so far it's really really slow today i wonder what's up uh i'm gonna ignore that i assume it's down but the yeah it's down and to verify it you need the smart contract and also the meta json data that comes with it uh what what are these what are these the smart contracts uh let's get my example sorry uh yes this one so these two are the smart contracts which i will need to put in sourcify i'm going to just do this for for show the meta json data will be something that looks like this remix metadata so inside inside test ignore the other side inside it has uh some details which specify my need such as what are the functions [Music] and stuff so you need to upload this file as well i'm going to throw it in and once it's done you can just hit click verify and it will very fair for you but specified right now it's uh it's down so you have to wait for it to go up to do this step but these are the general files that you need to verify on sourcify okay so that's all for the remix part so to recap what have we done in uh in remix so we have created a simple smart contract with with uh fund events that means events we have import library using open zeppelin and we have we try to verify it as sourcify we have also flatten it and try to verify as a single file in the scan and then we change the import to point to the local file and then we verify it as a multi-file multi-part file in the scan and we also seen how to manually verify uh the smart contracts on uh sourcify so in remix this is uh what we have covered and how is that how it how how it's done okay uh so moving on there are two more things that uh let me show you the other one it's for those who don't like to use remix for for their own reasons they are less truffle that is also a common uh tool so let's let's create a simple truffle uh smart contract shuffle so let's use truffle to create a simple small contract and and i will explain uh what are the uh things that that affects her so yeah let's get okay uh so if for those who have not installed a truffle and other prerequisites you will need to install those such as truffle in in a global as a globe it's a global package such as a node node.js of version 12. i'm not sure you can check it out in the official site but but after that you can you can start then let's create a new folder let's call it uh and inside i am going to [Music] run some commands the first command will be truffle unit it will initialize a simple uh truffle style truffles truffle the stuff that we need for truffle uh the more the most important thing will be the truffle config.js i will show it later i really need a package.json file i'm using this because i don't want to create manually and this one will create a packet.

json file for us and then because we are going to use uh opensafely i'm going to install opensupply i'm going to save it okay uh now that once that is done we can i like using visual code so let's let's open in visual code at okay what have we done just now so first we have installed open zeppelin contract the npm package second we have created use the npm init to create this uh to bootstrap this uh config traffic config js files which we'll need to change and this truffle config json will specify the compiler version and also the network that we will use and there are some other features such as this for testing stuff that may be useful for you but we will not go too much in detail and there is it also nicely uh structured the uh project files for us we have contracts we have tests migrations and we will be using tests and it has a written a migration script which we won't be using we'll just delete it okay so slow sorry instead i'll be creating a new file with my visual studio hanging alright and i'm going to again similarly uh use declare the license and declare the compiler question and when i see this i just remembered that i didn't change my compiler version i'm going to change it here i'm coming this thing eight points you know i'm gonna use 8.0 because that's 8.0 it works save it and then we can import purpose like that it refers to the package there which is downloaded and then it goes to where a safe method source is located and i'm going to give it a contract name again okay and over here i'm going to paste the code there button again uh this is a very similar code which i'm using for values which is not for remix it has events it has a setters and getters function so that's that's it then we can now compile it so to compile truffle it's true the command is traffic because we have already installed truffle in our global path oh i forgot to save it it might fail oh it did not nice just to be sure i'm gonna compile it again okay awesome um once it has compiled we can check our build folder to see if everything is correct uh it looks correct okay so we're good to go so now we are going to deploy it to our network but before that we need some some more libraries one library that i will need is this truffle hd wallet provider library which helps me to select the account that i want to deploy using by by passing over the private key you'll see later okay and now whatever is downloading we can get to the traffic config file we are going to change some things over here first up we are going to include uh i finally receive over here we are going to include this thing that we are downloading and then we are going to pass in the private keys and the ether scan api key our explanator what is that from a file it's called dot my private key dot for my my private key private key dot text which i have not copied over to so i'm gonna do that now let's see okay so i have prepared my private keys and place it in this folder and display my primary keys for interscan and uh the account that i could deploy using okay i'm not gonna expose it so i'm gonna put it into one file uh the other more the other better way is to bring in your environments too much of myself not doing that now okay and then this one is right we have imported our keys now we need to add the network under the network area so the level we are going to use is coven paste it here okay so convent uh this is going to be my provider oh i actually exposed my my alchemy api key here uh but is what i'm going to do later so i'm using alchemy by the way and you can get api key for free in their website okay of course you can use any node uh yeah your computer and a network id 42 for coven and all these things we can configure these are the default settings okay and then before we deploy before we deploy uh we will need to go to this place truffle has this thing called migration script that we will need to change so by default it uh deploys the migration migration.sol file which i just deleted it's no longer there so i'm going to change it to deploy uh to the meth the the truffle mat file that i that i just created so uh just continues okay that's that's how it will look like okay so it basically means that we are getting the artifact from for cities we are getting artifacts which is here oh wait hang on yeah here we are getting this and then we are going to deploy that file okay so once we have the migration file we have configured the configs we have our we have already compiled this thing we can we can migrate it so the the command will be come from my grid and i'm going to specify my network uh the name of the network follows the name that you defined in the config so covert was something i defined this now so i'm going to use colburn okay you know so you can see it's running this migration script it's going to rely on this to deploy it to the network that i that i chose to deploy to takes a while uh sometimes it's fail so it's okay just try again all right now it's deploying all right there you go we've deployed our our contract at uh this address so let's go okay so this is the contract that i just deployed 21 seconds ago it's by me this is my smart i mean my address and it's popular at the point so now our task is to verify this uh one good thing about one will be good thing about using a truffle to deploy contract is that we can rely on some truffle plugins to verify a contract so we can use this button it's called a truffle plugin [Music] okay all right i'm going to check next yeah it's indeed here it's in my dev dependency okay and now in the truffle config file i am going to let truffle know that we are using uh this plugin so it's this thing that we use okay and then uh we need to specify the key that we are using so we will be doing this so it tells the config that we are using this plugin and we are passing in a key uh from from the my primary key folder for its api key and once that is done you may run travel run verify and then you specify the name of the contract that you publish and then you specify the network oh i forgot to mention uh follow us we've got instructors there you can pass in the arguments behind this line uh we refer to the libraries of the github repo of travel parking to see how it's done okay nice um sorry verified maximum reach uh successfully you require one contract let's see if it's successful all right it is successfully verified by uh using the truffle library okay and for the sake of completion uh we are going to verify to socify but the thing is truffle doesn't give you the doesn't nicely give you the meta metadata.json file it's nicely hidden here in a truffle.

json and you have to go and find the metadata function copy this right copy this part and then rely on some uh no longer rely on some online tools uh string and escape [Music] and escape and you copy this [Music] formatter oops i forgot to copy properly i did right oh yes i did and this is a valid going to be a valid json so we can download this json and it will give us the metadata.json file and in sourcify we can just paste the metadata distance file along with the two files which which we which we created and uh that will that will work and now we can see that so you find out it's down so you won't be using that for now uh unfortunately for truffle i couldn't find a nice library to use to verify to specify directly you have to do it the manual way but uh that is fine okay so that's all and also the flattener doesn't really work well with the library such as open zeppelin uh right it just doesn't seem to work for me okay uh and a quick recap it's for truffle we have uh used the open zeppelin npn package we have a quick quick tour in the in the truffle.config.js file deploy the smart contract and verify it only to scan using the plugin and we see how to extract the metadata from the truffle builds build build files and to try to verify it on sourcify all right so we have completed um we have completed remix and truffle last one remaining it's uh hard hat hard hat is also a very commonly used tool so let's go and do it first first i'm going to create another new new folder that's my new yeah okay and i am going to run uh one thing known as a hard hat that is an official way we won't be using that we'll be using [Music] uh we'll be doing this library which is built on top of the official library because this library gives us a nice plug-in to use to verify on the hard hat i mean on sourcify and there are also other functions which are kind of nice to use with this library so generally you can you can rely on this property library to develop on hardhat so i will first emit package and i will need to [Music] save dependency uh it's a bit slow because the file is a bit big [Music] right there's me guys all right uh it's downloaded so we can again open up with visual studio code because i just love using your code let's see if we have indeed yep i already have this i've installed this successfully and next up is we need to create a config file similar to the truffle file and it's going to call hardhat.com stands for typescript you can use the json.

js file as well but because uh this package this distant party package that we're going to use has types so i'm going to use that oops the content of the file is actually rather similar to the config.json in um in truffle i'm going to first import my my my keys here and the config states the salty version uh the source file of my contract the kovan network that we're using along with the private key and the api with this api key and uh this is going to be my url the note uh no point highlighting now because i'll show you guys this now but it's fine and because i'm using ts i will need to create this thing called ptx.json okay sorry yes this one is here it's just it's just telling my visual studio that i'm going to use ts and then there are some dependencies which i need to download the hard hat deploy dependency type script and opens the plain contract so while that is downloading we create a folder the source folder because we are going to run our contract there oops later on there you go so this is where we are going to um write our contract in because we have failure right here okay and now we are going to follow back the contract that uh we just deployed so i'm going to call it math so so we're going to copy this one similarly we import uh open zeppelin by referring to the fpm package because that is where the contracts are are being stored for those who want to see it's right here here uh utils right youtube's math and uh lots of uh contracts that we can use you know berzeplin i'm you're only using one of the many so yeah this file sorry this file to be exact okay right hey this thing is too big okay i'm going to continue with the rest of my contract okay and copy the contents over from my prepared it's code snippet all right so uh again it's the same file i just changed the contract name and once that is done the contract and you automatically uh read the config tsa let us know who what happened oh i forgot my private key folder let's see here just going to copy over okay there you go and we can try again so now um that is successfully being compiled now we can see that as a new folder artifacts and over here we have our view artifacts stuff that we need to deploy okay cool once that is done uh similar to how truffle is how traffic works you will need a migration script so we are going to create a folder it's called deploy because by default hard hat reads from the deploy folder in uh in truffle it's migration then i'm going to create a new file let's just randomly name it this one copy over this script it's just telling us that uh we are going to find deploy uh this contract with this name obviously the name is clear but not the same let me make it the same and there you have it now we have the we have changed the config we have created the deployment script we have compiled our project now we can deploy to the cover network so the command will be okay here's this deploy and yep we can see that this has been successfully deployed i'm going to copy this and go back to our leader scan page yeah it takes a while to reflect but you'll be there don't worry oh yes there you go uh yep this departure is 30 seconds ago cool so now uh the thing the good thing about is we can use the library library to uh verify it on each scan and also and also on sourcify without having to do things manually so because on intel scan we have really defined the keys that we need like here is the key so all we need to do is that we just we like have again covered because we draw in convert and we reduce the library the scan verify okay just give it a while all right over here it says that uh this contract is now verified so let's see if it it's not lying to us all right indeed this control has been verified by using the hard hat method so for how to get uh api key you go to etherscan.io you create a free account and over here you can create up to i think three free api keys creating account is free everything is free of charge okay finally how do we uh deploy i mean how do we verify contract on sourcify so there is also a handy command that i can use and i just type sourcify there you go uh because spotify is down so this thing will not work but if it's not if it's working uh you can see that your contract can be seen on a yeah it can be seen on certified yeah it says that uh covent is temporary unavailable so so yeah that's that's hard hat so final recap for hardware hub head we the config is similar to truffles config we create and deploy smart contract we take a look at the third party hard hat deploy library which has nice tools to verify to verify the contract to specify and we can do that by using the hardhat commands so i think that is all for a verified contract on three different using treatment methods any questions i think people can raise hands and if you raise sense i can unmute you okay centric hazard hey hello thanks for the quick walk through two questions um so i was trying to compare some of the yearn contracts they are verified on eater scan but they are not verified unsolicified so i actually before you started the the thing i was just wondering this is a choice right or is it kind of like like you're not required to verify your contracts on both platforms correct uh yesterday is right that is a choice uh i think in years contract case they they just at least i don't know i don't know i'm not sure why they they do not want to verify it on society maybe they think that verifying the scan is good enough because maybe a lot of people likes to interact with the young contract through the ui but it's definitely a choice you can choose not to verify in any of the platforms it's totally fine right right um and then with a verified contract on each scan you can you can really interact with the read and write functions or immediately right um but but that's really more on the same box you kind of don't want to interact individual functions in case it's like destructive uh yes that is correct uh you might not for example let's say this contract has a self-destruct function the function will still appear here but it is the programmer's duty to ensure that this function can only be caught by for example the deployer of the contract so even though let's say it's available here for the public to call even though if i were to call it and i'm not the deployer uh it will reject my uh my transaction uh as of course guess you'll still need to be paid up because i executed something there yeah yeah but this is this really just for like if you are deaf you're just trying to test some of the functions but but if i'm trying to verify a contract that that belongs to ian or rv for example i shouldn't be actually doing this by calling individual read write functions here right uh are you trying to are you in this case are you uh are you the yearn uh contract smart contract writer or you are you are trying to uh verify on their behalf no i'm a guest i'm trying to audit on trying to read the source code and verify that it does what it's supposed to do or try to develop test cases and find out okay so for that you can just um maybe normally they will have a github page yeah if it's it's great if not you can you just copy everything here yeah and uh maybe use hardhat or truffle and run it locally and yeah right locally uh you have to compile it and then there is you can actually write test case uh in hardhat or truffle where you can just test it yeah yeah i was just trying to not have to do that uh i think there's no choice okay okay cool uh hard hat is a nice local you don't have to connect to any note there's a hard hat local uh network that you can interact with and you can even uh say uh give your account some some submitter something in it so there are some nice features not very sure about solid solid t i mean i'm not sorry not really sure about truffle but i think you'll see nothing can be done i was hoping that you have like a stop point like like a like a pry kind of a function where i can execute a single function in isolation just to see what the outputs are without having me to write run the full integration test um you need to write the test case and you need to you know copy the state over and then you have to run it that's how i would do it maybe there's some other more advanced methods okay cool my second question is simply um i understand why multi-contract is not support on the scan is it is it something that's technically not possible or is it just not a feature that you have to pay technically it's supported in the scan but it's just that whether we're calling github.hit the https right we are trying we have basically what remix does is that you will go to get the github page and we download you will download the uh the file yeah and then you just make it appear in the workspace but in the scan uh they are not doing that uh maybe maybe because they don't want to download stuff from a random links right or yeah that that is currently not my position to answer yeah yeah do you need your key or do you need something else i'm just trying to understand what happens in the back end uh probably well um subject to discussion uh we can yeah i'm not sure i'm not sure how how no it's no worries if you can't go into that um but but i would imagine my point of view uh my words are not used my point of view is that uh randomly downloading files from the link may be dangerous okay because some files may have virus so if you put a link there which is downloaded it's dangerous okay okay thanks so much more on the security measure i would say okay cool uh just my earlier question was about the verifying that the copy paste local file is exactly as the effort the source file that you it just checking download shah hash of the two files uh do you mean uh for for use perspective perspective well if if i look at someone's contract and it says that it's using safe methods save map dot soul right but how do i know that that is exactly the safe matters provided by opens airplane if they did the manual copy base method that you showed not only but basically like yeah copy and pasting into low profile how does it like for sure that this is exactly the same yes i get a question uh it's a perfectly valid question uh over here although although this thing is here right it doesn't really mean it's importing file uh people can alter this so the only way for you to go is like you copy the set opens airplane savement file and then you copy paste this thing maybe use some maybe online file checker tool or something i'll check it [Music] i mean i can just do a diff between because you know opens airplane uh libraries are commonly used if you can just simply provide a sha checker on the on the contracts safemet.

com against your own local cop your own uh private copy of the statement so and just provide to the end user that hey this chart checks off that means that it's copied and pasted correctly that's a good idea but i think that's a good idea uh definitely you would consider right harif and also we have a contract difference checker you may want to check out uh i think it's something like like something like something that you may want to use it's not as nice as the shouting but you highlight out the the parts that are different so you can definitely check out this page i'm going to share this link but it's a it's a good uh it's a good suggestion okay all right cool thanks thanks just curious no problem um okay uh caleb you raised your hand earlier actually that's to ask a question or to elaborate on the um it possible to show multi-file um kind of the difference between one single file and multifile on each scan like an example of a contract uh i i deployed a few i need to find back uh can be done uh we we did mention uh going through read and write contract um just just to like how it what you can do with it and how it works on the scan okay sure uh right i'm gonna i'm gonna use this as a multi-file reference uh let's see how many contracts have i deployed [Music] probably uh this one oh this is not verified uh maybe the second one yep okay so this is uh yes right so this is the single file and this multi file we can see that's file one all of two the first one is being saved math the second file being uh the math contract that we that we want they were really interested in and this is just one file and with everything being a combined in a single long normal file so these are the difference and you can also search the source code which also works for multifile um uh you can oh yeah you can uh let's just try it so you can search for function but for you but to search right you need to go to the specific file that you're interested in so you go slightly above the search oh you mean this one oh wait hang on i know what you mean uh here cool let's let's try okay bad idea to move forward yep okay right cool uh forgot about that yeah and there are nice functions for multi-file and sql file where you can just copy the entire source of this file or you can even generate permalink for example if i want to go to this line i can generate permalink you can paste it will go you'll go this like highlight at this line so it's a nice thing to share uh yeah so we could we can run through the read and write contract okay okay since i'm already in uh this this contract i saw use that right okay so currently uh the current number is one so let's try to play around with this number what can we do we can there are three functions that we can call at let's try to add like maybe five so one plus five will be six oops okay i think i want to and it's not just for like uh simple use cases like this but you can also use it for example to execute a swap on uni swap or any other d5 platform uh if you know how the functions work and what parameters needs to be put in then um yeah even if the website for the d5 app is down uh or for whatever reason let's say andrei deploys a new contract and you know how to use it then you have a big advantage for using right contract versus others where can we learn how to interact with small contract swaps uh what what what what swaps are what platform are you referring to let's assume in studio b2 then uh you can go to the unison v2 official documentation to probably learn more about how they input the parameters as specifically each contract will work differently unless they're literally cloning from each other um so maybe like unison v2 would be one that is useful to know how it works uh because it applies for a lot of other contracts um i believe i believe so at least uh but yeah so so you need to like uh know exactly the specific contract and the parameters uh to know so it's not something that you can just like uh use for every other contract unless it's something as simple as this uh which you know we okay now that you mentioned it we can go to add contract number then we can look at what it does so it's basically taking the current number and edit and return it so that's all okay so uh so okay yeah we forgot to check the results so we need to refresh this page and yep we have uh changed the state of the smart contract yeah um teacher do you think it might be cool to show uh recontract for for example for unison v3 uh are you familiar right with the like b64 and all that stuff uh yes okay what uh let's try to find a token id are you willing to share your token id i remember you can search from inventory okay because you need social media it's a very common uh contract right and if this guy is taking it so we can just go in the scan b3 and ft yeah nicely tech and you can search it on a google search there you go uh and this contract it's it's very complicated it's really complicated there are 55 files first let's let's find uh something that we can use uh let's see if the min the min the min uh yeah the tricky part about this is that everything is multi-core i need to click inside oh this is not mean but i think i can i can have the token id doesn't matter so uh what do you want to do again with this let's say we want to see the the image and the details and the token uri uh okay because i've played around with this contract i roughly know what function to call so uh apparently over here there's a token url uri uh funk read read function just paste the token id which i just copied for those who want to know more about token id it's something that do with nft uh something that's beyond this code for now and i read it right and you just give me a long basically for details uh again this is gibberish to human eyes but and so we need to convert it so basically so by using this online base64 decoder we can decode it and uh this is actually json but it's very ugly let me try to modify it and there you go uh this is uh the content of the of the json so this guy has a position in unison v3 it's for 0.3 the pair is usdc and ref and this is the lower and uh upper upper limit of the uh trading pack the pair and a nice description this is a pool address and there are more details so how do we get the nft either the image scope here i'm doing right here completion right yes i keep forgetting is a bit of a tricky part where certain parts you need to copy or not but i think that should be correct you should go all the way to the end ah it's very hard to copy finalists to do it and then do i decode it yes to svg see so i have added this thing is not needed okay let's see there you go so this is the content of the of the nft has a it has included a nice image for you which you can decode and uh it shows this image yeah and this is just one example of how you can use the recontract function uh so uh you can use this for generally any contract as long as you know the parameters um both for to read a contract and to write or to execute using a contract okay let's see what can we do so what can we write into this contract hello i i have a one contract right that i tried to read but it says that the the the contract creator didn't provide the abi or something so in that case how do we read a token id let's say i want to get the metadata file um i want to know the token uri right uh first yeah first of all would like to know what contract is that has it been deployed to the blockchain uh yeah so hold on let me just give you the link that would be nice contract why is that uh happening that way yeah uh let me take a look at your contract first all right here's the all right cool got it um okay uh the problem of this thing is that uh this thing is not verified so you cannot there's no way for you to see what what's what's in it and therefore you cannot read there's no way to know the read and write functions unless okay so in theory right because um this nft is being uh indexed in open c right yep so the openc must have known how to get the token uri so there must be a way for us to find the token uri uh i would i would i would guess that this is a very common uh contract and maybe someone deploy it through some oh no i'm doing some digging here uh [Music] yeah this guy this guy they brought the contract but uh helium border to their mother to verify it here yeah and probably because one thing about api is that right you don't need all of the apis to be able to interact with the contract uh what do i mean for example if we take a look at our math contract here i have all these functions right i i have uh i have add mouse no no sorry these are events i have get current number i have uh multiplied to current number i have separate account number i don't i don't need all of this i only need the the ones that i need for example if in this contract i only want to add the current number and i can just copy this part over and i can just call the function that's all uh but but but you can interact with this contract but you have really no idea to know what's going on inside this contract because i'm not familiar with uh this is this date token so i there's no way for me to know uh what happened if you call the functions in there so uh yeah so if it's a standard uh contract then you can just try uh with the token uri method right uh because the token method is created exclusively on uh user v3 so maybe this maybe this contract it doesn't have the token uri function read function so you may not know oh okay okay all right thank you uh yes no problem uh if hypothetically i join a token pc and developer try the rug pool can i interact with the contractor to sort out my tokens before they do it yes you can you have to do it before they run pool it also depends on the exact contracts that are used by the specific token or project there have been cases even uh we've heard where uh someone created let's say a yield farm and they essentially copied it from someone else and there was vulnerability vulnerability found so in a original contract so people who know how to take advantage of the vulnerability just go to right contract and kind of spam uh to take advantage of that vulnerability yes uh so one thing to know that um cloning calling contracts are very easy but what happened if you are cloning sub a contract with bugs it may happen to if all these projects are coding from the contract that's bugs all these contracts has a potential same threat and a subsetting bill to the same attack so let's say so yeah okay i think uh caleb you can uh share on some of the earlier stuff right um i guess what i can do is i can just briefly give a background on how how we do the work the contract verification so if anybody has any issues in the future hopefully this would help help you guys debug easier essentially what we do at the back is very simple we just compile your contract at the back and we do a bite code match we would discard the metadata specifically because the metadata also assumes some of the things that your local machine has say for example the path which you are compiling the contracts from so we really cannot depend on the metadata for our sort of comparison what we do essentially is to compare the byte codes so as long as you can consistently reproduce by codes with your your bunch of sole files you should be able to verify your contract now to the some of the questions which have been asked earlier so for example if you want to deploy the same contract address cross network is possible i can share i can share a link here it's i mean you can give it a try yourself just create new addresses and after that start deploying contracts on different networks and you will be able to see how it happens the idea is basically if you want to create a contract the contract address is determined by an element in the transaction called announce so as long as your nonce is the same across the different networks you will be able to generate back the same contract address other ways would be to use create2 for example create2 you would be able to more deterministically create generate addresses which you had used before for example but yeah i mean this is a feature which it interviewed itself already had just that if you bypass if you pass through the nonce then you would not be able to go back backwards if it's the forward nonce then you wouldn't be able to eventually generate to the address i've seen what what some developers done is that they uh they deployed something supposedly supposedly to be on coven or wrinkle video and they end up doing it on me then some funds got stuck there so that actually happened before so what they had to do on mainnet what they had to do is that they had to increment the noise in order to reach back uh yeah that the particular nonce then create a contract on top to retrieve back the funds and things like that had happened before but in essence that's basically how contract address generation works you have the nonce you create the contract on it then after that you would be able to get back the same contract address [Music] awesome thank you for optimization it's interesting optimization the num okay so optimization optimization has two elements to it so one is whether you want to turn optimization on off the other one is runs so how many times you want to run optimization actually uh the on and off one i think it's quite straightforward then optimization runs that one is a bit needs a bit of intuition so the runs actually refer to how many times you expect that particular contract to be interacted with in its entire lifetime so if you are expecting people to save forex if i'm not mistaken the one one inch contract has a huge number of runs i think 10k or something i could be i could be confusing with another contract but i think it's 10k plus but the idea is these are the more the more runs you're specifying the contract to be optimized through essentially it would be cheaper to interact with the contract the byte code size would be larger it would be more expensive to deploy but it'll be cheaper for the users to interact with but instead if you want to like say for example optimize for deployment so ensuring that the contract is as small as possible during deployment time you essentially just put the optimization run parameter to just one so that's basically the idea so depending on your use case you might want to tinker around with the with the runs parameter any questions so far otherwise i'll move on to other questions how far can we optimize x to keep it usable um i've seen up to 10k i think i've seen one case where it's 100k before you can try you can try different ways 10k plus that's quite common actually uh i think i've seen more than one contract but more than 10k i don't quite see that often but the idea is that it's it just depends on your use case i mean what comes with in the end you could always deploy a secondary contract to work with the app that's possible as well though i don't quite see the reason why people would do that so yeah you can you can try larger number different numbers there's no there's no real limit to it like i would say after a contract is optimized unified does it uh no so the optimization just does some funky low-level things on the bytecode stack uh so essentially if you were to verify your contract i mean all of us we don't really read bytecode as much uh so as long as you can like reproduce back the same parameters and verify then that should be fine you can show people what's the what's the actual source codes itself all right um i'll move on okay that's one very interesting question whether a contract address can be a wallet address or not i'm assuming that the wallet address is what we call an externally owned account an account with a private key okay so this is the interesting thing in all cases of talking about these ecds are what we use for their addresses uh there's something called collision so actually it's possible to end up with uh with an address which is also a contract address so i can have a wallet and some random guy would be like 10 years 20 years down the road would would end up being able to create the contract address which is my wallet that's possible actually is two by the factor of 80. and then that's sort of because 2 2 i put by the factor of 80 of a chance for you to get in uh probabilities and everything uh actually it's possible there is a specific eip which some of the researchers they are recommending to bush that just came out in korea yesterday let me let me get the eip the idea of the eip is simply to prevent a contract which contains bytecode from being able to push historically which had my code from being able to push any sort of eoe types eoa types of transactions so okay so in essence yeah it's actually possible it's a huge number it's less likely to happen but it can happen all right i think i covered all the questions unless anyone else might have something to ask myself can you expand a little bit more on let's say uh smart contract wallets um like arjun and so on because they are technically wallets i can expand this try them out yeah awesome yeah it's cool it's yeah i mean for example i'm a user of noxis multisig as well yeah it's yeah i guess it's something which you have to try to be able to experience it it's nice i mean you get additional security features as it's like uh that's like things like you'll be able to add trusted uh trust trusted addresses if it's sending to a non-trusted address then you'll need a like three out of 12 three sort of like multi-sig feature you have recovery features as well yeah just give it a try it's essentially a contract which has certain rules specified to you know when can you send how can you send what's the amount you can send it's corner yeah uh and uh to clarify there is one downside where uh typically airdrops you might not get uh if you use a smart contract wallet i believe so yeah i think arjun had an issue with unison yeah i think unicef are you thinking yeah all right yeah do all your apping on on a separate eoa and rest okay so uh if there are no more questions i think we can let chichuan and caleb go for now um for those of you who joined uh and if you feel like it's worth supporting uh initiatives like this you can donate to this ekl address and yeah we'll use it for uh for different initiatives like the crypto data or for essentially doing more workshops like this