Reproducible compilation

A reproducible compilation checks that specific sources and settings produce the expected artifacts. It establishes correspondence; it is not a security audit and does not prove that an implementation is still active. That requires reading proxy routes at a specific block.

Compiler and settings#

The v2.2 reference recipe uses:

This settings fragment describes the recipe. Compile with the complete input, including sources and outputSelection, rather than reconstructing it from the fragment:

{
  "optimizer": { "enabled": true, "runs": 200 },
  "viaIR": true,
  "evmVersion": "paris",
  "metadata": { "bytecodeHash": "none" }
}

Identify the exact input#

The Standard JSON input collects source and dependency content under their original paths. Preserve filenames, imported source unit names, settings and versions. Do not replace dependencies with the latest release or mix sources from different releases.

Documentation reference: 11 October 2026. The v22.standard-input.json input in reference package 20261011-145007 contains 54 source units. Its SHA-256, calculated over the file bytes, is:

54a204b3dd61ceb7196f84c7337927fbf5b3af5c721e6eac1319487da050ddf6

This hash identifies that specific input, not a final package yet to be published. Changing comments or JSON formatting changes the file hash even if bytecode remains identical. Publication must identify its own input and SHA-256 along with the bytecode comparison result.

Publication status: verified sources will be published jointly on BaseScan near closure. Public download of the final input and artifacts is pending; no unavailable download URL is presented here.

Reproduce without publishing#

With the exact compiler already installed and the complete input available, work in a local directory. These commands do not send transactions or publish code:

solc --version
sha256sum v22.standard-input.json
solc --standard-json < v22.standard-input.json > v22.compiler-output.json

Check that the version includes 0.8.37+commit.f401782d and the hash matches the file from the release being verified. The hash above applies only to the stated reference input. An input embedding all sources does not need network import resolution.

Also check errors in the output JSON: the process exit code alone does not prove that Solidity compiled successfully.

import json
from pathlib import Path

result = json.loads(Path("v22.compiler-output.json").read_text())
errors = [item for item in result.get("errors", []) if item.get("severity") == "error"]
for item in errors:
    print(item.get("formattedMessage", item.get("message", "")))
assert not errors, "Solidity compilation failed"
assert result.get("contracts"), "No contract output"
print("Compilation completed; compare artifacts next")

Review warnings too, and retain the compiler, input, output and hashes. This local compilation requires no wallet, private key or API key.

Compare artifacts and deployment#

Compare by source unit name and contract name, not just output filename. For identical sources, compare both evm.bytecode.object (creation) and evm.deployedBytecode.object (runtime), together with ABI and storage layout when evaluating an upgrade.

Compiler runtime can contain locations for immutable values set by the constructor at deployment. Checking an address requires resolving immutableReferences, constructor arguments and any linked-library references. Creation code and constructor arguments are also different things. Do not discard arbitrary differences to force a match.

bytecodeHash: "none" omits the metadata hash from bytecode; it does not mean that every source change is harmless or that all metadata information disappears. A comment-only change can preserve generated code, but recompilation and comparison are required to demonstrate it. Changing logic, literals or names used to compute identifiers can change the result.

Comparison with on-chain code must identify the network, address and block, and handle the host, implementations and modules separately. A proxy match does not establish the logic it delegates to. See Security and contracts for review scope and possible changes while components remain OPEN.