UPLC Link Dey Check Cardano Contracts Against Published Code

UPLC Link dey allow Cardano users check whether deployed smart contract match the source code wey dem publish for am. The open-source platform go rebuild the contracts and compare their cryptographic fingerprints. Through Cexplorer, users fit access the repository and build information wey dey connect with the script wey dem dey inspect.

Cexplorer Dey Connect Cardano Scripts With Their Source

Cexplorer “Verify Source” option dey link contract inspection with UPLC Link, so e go provide access to the source repository, exact code revision, compiler version, and contract parameters.

Giovanni Gargiulo, Senior Blockchain Architect for Cardano Foundation, show the workflow during Developers Office Hours on September 25. Dem publish session summary on October 7 wey document the integration and plans to expand compiler support.

The tool dey address the gap between publishing code and identifying wetin dey run on-chain. Project fit release their source and commission audit, but users still need way to confirm say the deployed contract correspond to the reviewed version.

For applications wey dey handle ADA and other Cardano assets, this one dey connect the rules wey people fit inspect with the scripts wey dey govern swaps, loans, or locked funds. Source verification dey establish that connection; security audit dey assess the code for vulnerabilities.

Rebuilding Contracts Dey Produce Checkable Match

Cardano smart contracts dey execute as compiled Untyped Plutus Core, or UPLC. Their script hashes dey identify the compiled programs without revealing which source revision or build settings produce dem.

UPLC Link dey start with specific GitHub commit and compiler version. E go build the source, calculate the resulting script hashes, and compare dem with the expected on-chain identifiers.

The platform still dey handle parameterized contracts, wey their final form dey depend on values wey dem supply during setup. Developers fit enter those values through the interface, including references to other scripts, and recalculate the result.

To match, you need correct source, compiler, and parameters.

The public interface currently get alpha label and e dey support Aiken contracts. The presentation describe work toward Scalus, Plutarch, and plu-ts support, alongside planned connection with Blaster for automated formal verification of contract properties.

These extensions go broaden the platform coverage beyond the current Aiken workflow.

On-Chain Records Dey Support Independent Verification

CIP-0171 dey propose shared metadata format to record the information wey people need to reproduce Cardano contract build. E dey use transaction metadata label 1984 to identify the source repository, code revision, compiler, build environment, and parameters.

The source go remain for its repository, while the blockchain go preserve the build instructions. Auditors and researchers fit publish records independent of the original deployer, then test dem by rebuilding the referenced code and checking the resulting hash.

The specification still remain proposal for the official CIP registry. Its format fit accommodate several compiler families, with each verification tool determining which ones e support.

UPLC Link don already offer registration through signed Cardano transaction, with the network fee wey dem go pay in ADA. Its backend dey index submitted records for discovery through the public registry. The project still provide API for other services and publish instructions on how to run the platform locally.

For registered contract, reviewers fit start from its address or script hash, retrieve the recorded build details, and check the source connection by themselves. Application teams fit provide that reproducible record alongside their code and audit reports.