forge_verify/

utils.rs

use crate::{bytecode::VerifyBytecodeArgs, types::VerificationType};
use alloy_dyn_abi::{DynSolValue, JsonAbiExt};
use alloy_network::{AnyNetwork, AnyRpcBlock};
use alloy_primitives::{Address, B256, Bytes, ChainId, TxKind, U256};
use alloy_provider::{Provider, network::BlockResponse};
use alloy_rpc_types::BlockId;
use clap::ValueEnum;
use eyre::{OptionExt, Result};
use foundry_block_explorers::{
    contract::{ContractCreationData, ContractMetadata, Metadata},
    errors::EtherscanError,
    utils::lookup_compiler_version,
};
use foundry_cli::utils::LoadConfig;
use foundry_common::{
    abi::encode_args, compile::ProjectCompiler, find_matching_contract_artifact,
    ignore_metadata_hash, shell,
};
use foundry_compilers::{
    Graph,
    artifacts::{BytecodeHash, CompactContractBytecode},
    compilers::ParsedSource,
    multi::{MultiCompilerLanguage, MultiCompilerParser},
    utils::canonicalize,
};
use foundry_config::Config;
use foundry_evm::{
    constants::DEFAULT_CREATE2_DEPLOYER,
    core::{
        FoundryBlock as _,
        decode::RevertDecoder,
        evm::{BlockEnvFor, ChainFor, EvmEnvFor, FoundryEvmNetwork, TxEnvFor},
    },
    executors::{ExecutorBuilder, TracingExecutor},
    opts::EvmOpts,
    traces::TraceRequirements,
    utils::{apply_chain_and_block_specific_env_changes_for_chain, block_env_from_header},
};
use foundry_evm_networks::NetworkConfigs;
use reqwest::Url;
use revm::{
    bytecode::Bytecode,
    context::{Block as _, Transaction as _},
    database::Database,
};
use semver::{BuildMetadata, Version};
use serde::{Deserialize, Serialize};
use yansi::Paint;

#[cfg(all(test, feature = "monad"))]
use foundry_config::FoundryHardfork;

/// Enum to represent the type of bytecode being verified
#[derive(Debug, Serialize, Deserialize, Clone, Copy, ValueEnum)]
pub enum BytecodeType {
    #[serde(rename = "creation")]
    Creation,
    #[serde(rename = "runtime")]
    Runtime,
}

impl BytecodeType {
    /// Check if the bytecode type is creation
    pub const fn is_creation(&self) -> bool {
        matches!(self, Self::Creation)
    }

    /// Check if the bytecode type is runtime
    pub const fn is_runtime(&self) -> bool {
        matches!(self, Self::Runtime)
    }
}

#[derive(Debug, Serialize, Deserialize)]
pub struct JsonResult {
    pub bytecode_type: BytecodeType,
    pub match_type: Option<VerificationType>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub message: Option<String>,
}

pub fn match_bytecodes(
    local_bytecode: &[u8],
    bytecode: &[u8],
    constructor_args: &[u8],
    is_runtime: bool,
    bytecode_hash: BytecodeHash,
) -> Option<VerificationType> {
    // 1. Try full match
    if local_bytecode == bytecode {
        // If the bytecode_hash = 'none' in Config. Then it's always a partial match according to
        // sourcify definitions. Ref: https://docs.sourcify.dev/docs/full-vs-partial-match/.
        if bytecode_hash == BytecodeHash::None {
            return Some(VerificationType::Partial);
        }

        Some(VerificationType::Full)
    } else {
        is_partial_match(local_bytecode, bytecode, constructor_args, is_runtime)
            .then_some(VerificationType::Partial)
    }
}

pub fn build_project(
    args: &VerifyBytecodeArgs,
    config: &Config,
) -> Result<CompactContractBytecode> {
    let project = config.project()?;
    let compiler = ProjectCompiler::new().quiet(true);

    let target_path = match args.contract.path() {
        Some(path) => Some(canonicalize(project.root().join(path))?),
        None => Graph::<MultiCompilerParser>::resolve(&project.paths).ok().and_then(|graph| {
            if graph
                .nodes
                .iter()
                .any(|node| matches!(node.data.language(), MultiCompilerLanguage::Vyper(_)))
            {
                return None;
            }
            let mut matches = graph.nodes.iter().filter(|node| {
                node.data.contract_names().iter().any(|name| name == &args.contract.name)
            });
            let target = matches.next()?;
            (matches.next().is_none()
                && graph.input_nodes().any(|input| input.path() == target.path()))
            .then(|| target.path().to_path_buf())
        }),
    };
    if let Some(target_path) = target_path {
        let mut output = compiler.files([target_path.clone()]).compile(&project)?;
        let artifact =
            find_matching_contract_artifact(&mut output, &target_path, Some(&args.contract.name))?;
        return Ok(artifact.into_contract_bytecode());
    }

    let mut output = compiler.compile(&project)?;

    let artifact = output
        .remove_contract(&args.contract)
        .ok_or_eyre("Build Error: Contract artifact not found locally")?;

    Ok(artifact.into_contract_bytecode())
}

pub fn print_result(
    res: Option<VerificationType>,
    bytecode_type: BytecodeType,
    json_results: &mut Vec<JsonResult>,
    etherscan_metadata: Option<&Metadata>,
    config: &Config,
) {
    if let Some(res) = res {
        if shell::is_json() {
            let json_res = JsonResult { bytecode_type, match_type: Some(res), message: None };
            json_results.push(json_res);
        } else {
            let _ = sh_println!(
                "{} with status {}",
                format!("{bytecode_type:?} code matched").green().bold(),
                res.green().bold()
            );
        }
    } else if !shell::is_json() {
        let _ = sh_err!(
            "{bytecode_type:?} code did not match - this may be due to varying compiler settings"
        );
        if let Some(etherscan_metadata) = etherscan_metadata {
            let mismatches = find_mismatch_in_settings(etherscan_metadata, config);
            for mismatch in mismatches {
                let _ = sh_eprintln!("{}", mismatch.red().bold());
            }
        }
    } else {
        let json_res = JsonResult {
            bytecode_type,
            match_type: res,
            message: Some(format!(
                "{bytecode_type:?} code did not match - this may be due to varying compiler settings"
            )),
        };
        json_results.push(json_res);
    }
}

fn is_partial_match(
    mut local_bytecode: &[u8],
    mut bytecode: &[u8],
    constructor_args: &[u8],
    is_runtime: bool,
) -> bool {
    // 1. Check length of constructor args
    if constructor_args.is_empty() || is_runtime {
        // Assume metadata is at the end of the bytecode
        return try_extract_and_compare_bytecode(local_bytecode, bytecode);
    }

    // The constructor args are part of what is being verified: the onchain creation code must
    // actually end with them before they can be stripped, otherwise args of the right length
    // could never fail the comparison.
    if !bytecode.ends_with(constructor_args) {
        return false;
    }

    // If not runtime, extract constructor args from the end of the bytecode.
    // The args come from the caller, so neither buffer is known to be that long.
    let (Some(bytecode_head), Some(local_head)) = (
        bytecode.len().checked_sub(constructor_args.len()).map(|n| &bytecode[..n]),
        local_bytecode.len().checked_sub(constructor_args.len()).map(|n| &local_bytecode[..n]),
    ) else {
        return false;
    };
    bytecode = bytecode_head;
    local_bytecode = local_head;

    try_extract_and_compare_bytecode(local_bytecode, bytecode)
}

fn try_extract_and_compare_bytecode(mut local_bytecode: &[u8], mut bytecode: &[u8]) -> bool {
    local_bytecode = ignore_metadata_hash(local_bytecode);
    bytecode = ignore_metadata_hash(bytecode);

    // Now compare the local code and bytecode
    local_bytecode == bytecode
}

fn find_mismatch_in_settings(
    etherscan_settings: &Metadata,
    local_settings: &Config,
) -> Vec<String> {
    let mut mismatches: Vec<String> = vec![];
    if etherscan_settings.evm_version != local_settings.evm_version.to_string().to_lowercase() {
        let str = format!(
            "EVM version mismatch: local={}, onchain={}",
            local_settings.evm_version, etherscan_settings.evm_version
        );
        mismatches.push(str);
    }
    let local_optimizer: u64 = if local_settings.optimizer == Some(true) { 1 } else { 0 };
    if etherscan_settings.optimization_used != local_optimizer {
        let str = format!(
            "Optimizer mismatch: local={}, onchain={}",
            local_settings.optimizer.unwrap_or(false),
            etherscan_settings.optimization_used
        );
        mismatches.push(str);
    }
    // The only caller reaches this with a `Config` from `load_config`, which has run
    // `normalize_optimizer_settings`, so `optimizer_runs` is always set by now.
    if let Some(local_runs) = local_settings.optimizer_runs
        && etherscan_settings.runs != local_runs as u64
    {
        let str = format!(
            "Optimizer runs mismatch: local={local_runs}, onchain={}",
            etherscan_settings.runs
        );
        mismatches.push(str);
    }

    mismatches
}

pub fn maybe_predeploy_contract(
    creation_data: Result<ContractCreationData, EtherscanError>,
) -> Result<(Option<ContractCreationData>, bool), eyre::ErrReport> {
    let mut maybe_predeploy = false;
    match creation_data {
        Ok(creation_data) => Ok((Some(creation_data), maybe_predeploy)),
        // Ref: https://explorer.mode.network/api?module=contract&action=getcontractcreation&contractaddresses=0xC0d3c0d3c0D3c0d3C0D3c0D3C0d3C0D3C0D30010
        Err(EtherscanError::EmptyResult { status, message })
            if status == "1" && message == "OK" =>
        {
            maybe_predeploy = true;
            Ok((None, maybe_predeploy))
        }
        // Ref: https://api.basescan.org/api?module=contract&action=getcontractcreation&contractaddresses=0xC0d3c0d3c0D3c0d3C0D3c0D3C0d3C0D3C0D30010&apiKey=YourAPIKey
        Err(EtherscanError::Serde { error: _, content }) if content.contains("GENESIS") => {
            maybe_predeploy = true;
            Ok((None, maybe_predeploy))
        }
        Err(e) => {
            eyre::bail!("Error fetching creation data from verifier-url: {:?}", e);
        }
    }
}

pub fn check_and_encode_args(
    artifact: &CompactContractBytecode,
    args: Vec<String>,
) -> Result<Vec<u8>, eyre::ErrReport> {
    let Some(constructor) = artifact.abi.as_ref().and_then(|abi| abi.constructor()) else {
        if args.is_empty() {
            return Ok(Vec::new());
        }
        eyre::bail!("Contract has no constructor arguments, but arguments were provided");
    };
    if constructor.inputs.len() != args.len() {
        eyre::bail!(
            "Mismatch of constructor arguments length. Expected {}, got {}",
            constructor.inputs.len(),
            args.len()
        );
    }
    encode_args(&constructor.inputs, &args).map(|args| DynSolValue::Tuple(args).abi_encode_params())
}

pub fn validate_encoded_constructor_args(
    artifact: &CompactContractBytecode,
    args: Vec<u8>,
) -> Result<Vec<u8>, eyre::ErrReport> {
    let Some(constructor) = artifact.abi.as_ref().and_then(|abi| abi.constructor()) else {
        if args.is_empty() {
            return Ok(args);
        }
        eyre::bail!("Contract has no constructor arguments, but encoded arguments were provided");
    };
    let values = constructor
        .abi_decode_input(&args)
        .map_err(|err| eyre::eyre!("Invalid ABI-encoded constructor arguments: {err}"))?;
    let encoded = constructor
        .abi_encode_input(&values)
        .map_err(|err| eyre::eyre!("Invalid ABI-encoded constructor arguments: {err}"))?;
    if encoded != args {
        eyre::bail!("Constructor arguments are not canonically ABI-encoded");
    }
    Ok(args)
}

pub fn check_explorer_args(source_code: &ContractMetadata) -> Result<Bytes, eyre::ErrReport> {
    if let Some(args) = source_code.items.first() {
        Ok(args.constructor_arguments.clone())
    } else {
        eyre::bail!("No constructor arguments found from block explorer");
    }
}

pub fn check_args_len(
    artifact: &CompactContractBytecode,
    args: &Bytes,
) -> Result<(), eyre::ErrReport> {
    if let Some(constructor) = artifact.abi.as_ref().and_then(|abi| abi.constructor())
        && !constructor.inputs.is_empty()
        && args.is_empty()
    {
        eyre::bail!(
            "Contract expects {} constructor argument(s), but none were provided",
            constructor.inputs.len()
        );
    }
    Ok(())
}

pub fn load_fork_config_and_evm_opts(config: &Config) -> Result<(Config, EvmOpts)> {
    let chain = config.chain;
    let mut fork_config = config.clone();
    fork_config.chain = None;

    let (mut fork_config, mut evm_opts) = fork_config.load_config_and_evm_opts()?;
    fork_config.chain = chain;
    if let Some(chain) = chain {
        evm_opts.env.chain_id = Some(chain.id());
    }

    Ok((fork_config, evm_opts))
}

pub async fn get_tracing_executor<FEN>(
    fork_config: &mut Config,
    fork_blk_num: u64,
    execution_blk_num: u64,
    execution_block: Option<&AnyRpcBlock>,
    evm_opts: EvmOpts,
    executor_builder: ExecutorBuilder<FEN>,
) -> Result<(EvmEnvFor<FEN>, TxEnvFor<FEN>, TracingExecutor<FEN>)>
where
    FEN: FoundryEvmNetwork,
{
    fork_config.fork_block_number = Some(fork_blk_num);

    let create2_deployer = evm_opts.create2_deployer;
    let mut fork = TracingExecutor::<FEN>::get_fork(fork_config, evm_opts).await?;
    let context = fork.context();

    fork.evm_env.block_env.set_number(U256::from(execution_blk_num));
    if let Some(block) = execution_block {
        configure_env_block::<FEN>(
            &mut fork.evm_env,
            block,
            context.chain().id(),
            context.networks(),
        );
    }
    fork.resolve_spec(fork_config, None);
    fork.extend_precompile_labels(fork_config);

    let evm_env = fork.evm_env.clone();
    let tx_env = fork.tx_env.clone();
    let executor = fork.into_executor(
        executor_builder,
        TraceRequirements::none().with_calls(true),
        create2_deployer,
        None,
    )?;

    Ok((evm_env, tx_env, executor))
}

#[cfg(all(test, feature = "monad"))]
fn resolve_runtime_spec<FEN>(
    config: &Config,
    source_chain_id: ChainId,
    endpoint_hardfork: Option<FoundryHardfork>,
    evm_env: &mut EvmEnvFor<FEN>,
) -> Option<FoundryHardfork>
where
    FEN: FoundryEvmNetwork,
{
    TracingExecutor::<FEN>::resolve_spec_for_chain(
        config,
        source_chain_id,
        endpoint_hardfork,
        evm_env,
        None,
    )
}

pub fn configure_env_block<FEN>(
    evm_env: &mut EvmEnvFor<FEN>,
    block: &AnyRpcBlock,
    source_chain_id: ChainId,
    config: NetworkConfigs,
) where
    FEN: FoundryEvmNetwork,
{
    let number = evm_env.block_env.number();
    evm_env.block_env = block_env_from_header::<BlockEnvFor<FEN>>(block.header());
    evm_env.block_env.set_number(number);
    apply_chain_and_block_specific_env_changes_for_chain::<AnyNetwork, _, _>(
        evm_env,
        block,
        source_chain_id,
        config,
    );
}

pub fn deploy_contract<FEN>(
    executor: &mut TracingExecutor<FEN>,
    evm_env: &EvmEnvFor<FEN>,
    tx_env: &TxEnvFor<FEN>,
    to: TxKind,
    chain_context: ChainFor<FEN>,
) -> Result<Address, eyre::ErrReport>
where
    FEN: FoundryEvmNetwork,
{
    // Derive the created address up front: batched transactions return the last call's result,
    // not the deployment's.
    let address = if let TxKind::Call(to) = to {
        if to != DEFAULT_CREATE2_DEPLOYER {
            eyre::bail!(
                "Transaction `to` address is not the default create2 deployer i.e the tx is not a contract creation tx."
            );
        }
        let (salt, init_code) = tx_env.input().split_at(32);
        DEFAULT_CREATE2_DEPLOYER.create2_from_code(B256::from_slice(salt), init_code)
    } else {
        let caller = tx_env.caller();
        caller.create(executor.backend_mut().basic(caller)?.map_or(0, |info| info.nonce))
    };

    let result =
        executor.transact_with_env_and_context(evm_env.clone(), tx_env.clone(), chain_context)?;
    trace!(transact_result = ?result.exit_reason);

    if result.reverted {
        let decoded_reason = RevertDecoder::new().decode(&result.result, result.exit_reason);
        eyre::bail!(
            "Failed to deploy contract on fork at block: {decoded_reason}.\n\
            This typically happens when your local bytecode differs from what was actually deployed.\n\
            Common causes:\n\
            - Your contract source is not at the same commit used during deployment\n\
            - Cached build artifacts are stale (try `forge clean && forge build`)\n\
            - Compiler settings (optimizer, evm_version, via_ir) don't match the deployment"
        );
    }
    if !result.state_changeset.get(&address).is_some_and(|account| account.is_created()) {
        eyre::bail!("Transaction did not deploy a contract at the expected address {address}");
    }

    Ok(address)
}

pub async fn get_runtime_codes<FEN>(
    executor: &mut TracingExecutor<FEN>,
    provider: &impl Provider<AnyNetwork>,
    address: Address,
    fork_address: Address,
    block: Option<u64>,
) -> Result<(Bytecode, Bytes)>
where
    FEN: FoundryEvmNetwork,
{
    let fork_runtime_code = executor
        .backend_mut()
        .basic(fork_address)?
        .ok_or_else(|| {
            eyre::eyre!(
                "Failed to get runtime code for contract deployed on fork at address {}",
                fork_address
            )
        })?
        .code
        .ok_or_else(|| {
            eyre::eyre!(
                "Bytecode does not exist for contract deployed on fork at address {}",
                fork_address
            )
        })?;

    let block_id = block.map_or_else(BlockId::latest, BlockId::number);
    let onchain_runtime_code = provider.get_code_at(address).block_id(block_id).await?;

    Ok((fork_runtime_code, onchain_runtime_code))
}

/// Returns `true` if the URL only consists of host.
///
/// This is used to check user input url for missing /api path
pub fn is_host_only(url: &Url) -> bool {
    matches!(url.path(), "/" | "")
}

/// Wraps a failed verification error with guidance when `--verifier-url` looks misconfigured for
/// the Etherscan provider. Returns `err` untouched when no hint applies.
///
/// The hint only fires when the Etherscan verifier is active: it requires an API endpoint
/// (typically `/api`). Sourcify, Blockscout, etc. accept host-only URLs, so we leave their
/// errors alone.
pub fn wrap_verifier_url_error(
    err: eyre::Error,
    verifier_url: Option<&str>,
    using_etherscan: bool,
) -> eyre::Error {
    let Some(verifier_url) = verifier_url else { return err };
    let url = match Url::parse(verifier_url) {
        Ok(mut url) => {
            let _ = url.set_username("");
            let _ = url.set_password(None);
            url.set_query(None);
            url.set_fragment(None);
            url
        }
        Err(url_err) => {
            return err.wrap_err(format!("Invalid verifier URL provided: {url_err}"));
        }
    };
    if is_host_only(&url) && using_etherscan {
        return err.wrap_err(format!(
            "Verifier `etherscan` requires an API endpoint, but `--verifier-url` is host-only: `{url}`.\n\
             Fixes (pick one):\n\
             - Append the API path, e.g. `--verifier-url {url}api`\n\
             - Switch verifier, e.g. `--verifier sourcify` (works with host-only URLs)"
        ));
    }
    err
}

/// Given any solc [Version] return a [Version] with build metadata
///
/// # Example
///
/// ```ignore
/// use semver::{BuildMetadata, Version};
/// let version = Version::new(1, 2, 3);
/// let version = ensure_solc_build_metadata(version).await?;
/// assert_ne!(version.build, BuildMetadata::EMPTY);
/// ```
pub async fn ensure_solc_build_metadata(version: Version) -> Result<Version> {
    if version.build == BuildMetadata::EMPTY {
        Ok(lookup_compiler_version(&version).await?)
    } else {
        Ok(version)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::verify::VerifierArgs;
    use alloy_json_abi::JsonAbi;
    use foundry_cli::opts::EtherscanOpts;
    use foundry_compilers::PathStyle;
    use foundry_config::NamedChain;
    use foundry_test_utils::{TestProject, util::SOLC_VERSION};

    #[cfg(feature = "monad")]
    use foundry_evm::{EvmEnv, hardforks::MonadHardfork};

    #[cfg(feature = "monad")]
    fn monad_env(timestamp: u64) -> EvmEnv<MonadHardfork> {
        let mut env = EvmEnv::<MonadHardfork>::default();
        env.cfg_env.chain_id = NamedChain::Monad as u64;
        env.block_env.set_timestamp(U256::from(timestamp));
        env
    }

    #[test]
    fn encoded_constructor_args_must_be_canonical() {
        let artifact = CompactContractBytecode {
            abi: Some(alloy_json_abi::JsonAbi::parse(["constructor(uint256 value)"]).unwrap()),
            bytecode: None,
            deployed_bytecode: None,
        };
        let args = artifact
            .abi
            .as_ref()
            .unwrap()
            .constructor()
            .unwrap()
            .abi_encode_input(&[DynSolValue::Uint(U256::ONE, 256)])
            .unwrap();

        assert_eq!(validate_encoded_constructor_args(&artifact, args.clone()).unwrap(), args);

        // Arbitrary bytes prepended to valid arguments can overlap the creation bytecode's
        // metadata and must not be accepted as part of the constructor arguments.
        let overlapping = [alloy_primitives::hex!("a1616101").as_slice(), &args].concat();
        assert!(validate_encoded_constructor_args(&artifact, overlapping).is_err());
    }

    #[test]
    fn typed_constructor_args_require_a_constructor() {
        let artifact = CompactContractBytecode {
            abi: Some(JsonAbi::new()),
            bytecode: None,
            deployed_bytecode: None,
        };

        assert!(check_and_encode_args(&artifact, vec!["1".to_string()]).is_err());
        assert_eq!(check_and_encode_args(&artifact, Vec::new()).unwrap(), Vec::<u8>::new());
    }

    #[test]
    fn dynamic_constructor_args_are_encoded_as_top_level_params() {
        let artifact = CompactContractBytecode {
            abi: Some(alloy_json_abi::JsonAbi::parse(["constructor(string value)"]).unwrap()),
            bytecode: None,
            deployed_bytecode: None,
        };

        let encoded = check_and_encode_args(&artifact, vec!["hi".to_string()]).unwrap();

        // Constructor arguments are encoded as top-level ABI parameters, so the first word is the
        // offset to the string payload.
        let expected = alloy_primitives::hex!(
            "0000000000000000000000000000000000000000000000000000000000000020"
            "0000000000000000000000000000000000000000000000000000000000000002"
            "6869000000000000000000000000000000000000000000000000000000000000"
        );
        assert_eq!(encoded, expected);
    }

    #[test]
    fn creation_code_must_end_with_constructor_args() {
        let code = alloy_primitives::hex!("6080604052348015600e575f5ffd5b50607b80601a5f395ff3fe");
        let real_args = [0x11u8; 32];
        let wrong_args = [0x22u8; 32];

        let onchain = [code.as_slice(), &real_args].concat();

        // Wrong args of the right length used to report a partial match because the tails were
        // stripped from both sides without comparing them.
        let local = [code.as_slice(), &wrong_args].concat();
        assert_eq!(match_bytecodes(&local, &onchain, &wrong_args, false, BytecodeHash::Ipfs), None);

        let local = [code.as_slice(), &real_args].concat();
        assert_eq!(
            match_bytecodes(&local, &onchain, &real_args, false, BytecodeHash::Ipfs),
            Some(VerificationType::Full)
        );

        // A valid dynamic encoding can end with another valid encoding. The suffix alone must
        // not establish that the supplied arguments match.
        let suffix_args =
            DynSolValue::Tuple(vec![DynSolValue::Bytes(real_args.to_vec())]).abi_encode();
        let deployment_args =
            DynSolValue::Tuple(vec![DynSolValue::Bytes(suffix_args.clone())]).abi_encode();
        assert!(deployment_args.ends_with(&suffix_args));

        let onchain = [code.as_slice(), deployment_args.as_slice()].concat();
        let local = [code.as_slice(), suffix_args.as_slice()].concat();
        assert_eq!(
            match_bytecodes(&local, &onchain, &suffix_args, false, BytecodeHash::Ipfs),
            None
        );
    }

    #[test]
    fn build_project_finds_artifact_by_relative_contract_path() {
        let prj = TestProject::new("verify-bytecode-relative-path", PathStyle::Dapptools);
        prj.add_source(
            "Counter.sol",
            r#"
pragma solidity ^0.8.0;

contract Counter {
    uint256 public number;
}
"#,
        );
        prj.add_source(
            "Broken.sol",
            r#"
pragma solidity ^0.8.0;

contract Broken {
    this is not valid Solidity
}
"#,
        );

        let mut config = Config::load_with_root(prj.root()).unwrap();
        config.solc = Some(SOLC_VERSION.into());
        let args = VerifyBytecodeArgs {
            address: Address::ZERO,
            contract: "src/Counter.sol:Counter".parse().unwrap(),
            block: None,
            constructor_args: None,
            encoded_constructor_args: None,
            constructor_args_path: None,
            rpc_url: None,
            network: None,
            etherscan: EtherscanOpts::default(),
            verifier: VerifierArgs::default(),
            libraries: Vec::new(),
            root: Some(prj.root().to_path_buf()),
            ignore: None,
        };

        let artifact = build_project(&args, &config).unwrap();

        assert!(artifact.bytecode.and_then(|bytecode| bytecode.into_bytes()).is_some());
    }

    #[test]
    fn load_fork_config_and_evm_opts_serializes_chain_as_id() {
        let config = Config { chain: Some(NamedChain::Mainnet.into()), ..Default::default() };

        let (fork_config, evm_opts) = load_fork_config_and_evm_opts(&config).unwrap();

        assert_eq!(fork_config.chain, Some(NamedChain::Mainnet.into()));
        assert_eq!(evm_opts.env.chain_id, Some(1));
    }

    #[test]
    #[cfg(feature = "monad")]
    fn runtime_spec_uses_monad_source_chain_timestamp() {
        let monad_nine_timestamp = foundry_evm::hardforks::MonadHardfork::MonadNine
            .mainnet_activation_timestamp()
            .unwrap();

        let before_config = Config {
            evm_version: foundry_compilers::artifacts::EvmVersion::Osaka,
            ..Default::default()
        };
        let mut before_env = monad_env(monad_nine_timestamp - 1);
        before_env.cfg_env.chain_id = NamedChain::Mainnet as u64;
        let before = resolve_runtime_spec::<foundry_evm::core::evm::MonadEvmNetwork>(
            &before_config,
            NamedChain::Monad as u64,
            None,
            &mut before_env,
        );

        assert_eq!(
            before,
            Some(FoundryHardfork::Monad(foundry_evm::hardforks::MonadHardfork::MonadEight))
        );
        assert_eq!(before_env.cfg_env.spec, foundry_evm::hardforks::MonadHardfork::MonadEight);
        assert_eq!(before_env.cfg_env.chain_id, NamedChain::Mainnet as u64);

        let after_config = Config {
            evm_version: foundry_compilers::artifacts::EvmVersion::Prague,
            ..Default::default()
        };
        let mut after_env = monad_env(monad_nine_timestamp);
        let after = resolve_runtime_spec::<foundry_evm::core::evm::MonadEvmNetwork>(
            &after_config,
            NamedChain::Monad as u64,
            None,
            &mut after_env,
        );

        assert_eq!(
            after,
            Some(FoundryHardfork::Monad(foundry_evm::hardforks::MonadHardfork::MonadNine))
        );
        assert_eq!(after_env.cfg_env.spec, foundry_evm::hardforks::MonadHardfork::MonadNine);
    }

    #[test]
    #[cfg(feature = "monad")]
    fn runtime_spec_and_labels_prefer_explicit_monad_hardfork() {
        let mut config = Config {
            hardfork: Some(foundry_evm::hardforks::MonadHardfork::MonadEight.into()),
            ..Default::default()
        };
        let mut env = monad_env(
            foundry_evm::hardforks::MonadHardfork::MonadNine
                .mainnet_activation_timestamp()
                .unwrap(),
        );
        let networks = NetworkConfigs::with_monad();

        let resolved = resolve_runtime_spec::<foundry_evm::core::evm::MonadEvmNetwork>(
            &config,
            NamedChain::Monad as u64,
            Some(foundry_evm::hardforks::MonadHardfork::MonadNine.into()),
            &mut env,
        );
        TracingExecutor::<foundry_evm::core::evm::MonadEvmNetwork>::extend_precompile_labels(
            &mut config,
            networks,
            resolved,
        );

        assert_eq!(
            resolved,
            Some(FoundryHardfork::Monad(foundry_evm::hardforks::MonadHardfork::MonadEight))
        );
        assert_eq!(env.cfg_env.spec, foundry_evm::hardforks::MonadHardfork::MonadEight);
        assert!(config.labels.values().any(|label| label == "Staking"));
        assert!(!config.labels.values().any(|label| label == "ReserveBalance"));
    }

    #[test]
    fn test_host_only() {
        assert!(!is_host_only(&Url::parse("https://blockscout.net/api").unwrap()));
        assert!(is_host_only(&Url::parse("https://blockscout.net/").unwrap()));
        assert!(is_host_only(&Url::parse("https://blockscout.net").unwrap()));
    }

    #[test]
    fn wrap_verifier_url_error_passes_through_when_no_url() {
        let err = eyre::eyre!("upstream failure");
        let wrapped = wrap_verifier_url_error(err, None, true);
        assert_eq!(wrapped.to_string(), "upstream failure");
    }

    #[test]
    fn wrap_verifier_url_error_adds_hint_for_host_only_etherscan_url() {
        let err = eyre::eyre!("upstream failure");
        let wrapped = wrap_verifier_url_error(err, Some("https://contracts.tempo.xyz"), true);
        let msg = format!("{wrapped:#}");
        assert!(msg.contains("host-only"), "message: {msg}");
        assert!(msg.contains("--verifier-url https://contracts.tempo.xyz/api"), "message: {msg}");
        assert!(msg.contains("--verifier sourcify"), "message: {msg}");
    }

    /// Sourcify and other non-etherscan verifiers accept host-only URLs; we must not emit the
    /// hint for them, otherwise we would mislead the user into editing a correct URL.
    #[test]
    fn wrap_verifier_url_error_does_not_hint_for_non_etherscan_provider() {
        let err = eyre::eyre!("upstream failure");
        let wrapped = wrap_verifier_url_error(err, Some("https://contracts.tempo.xyz"), false);
        assert_eq!(wrapped.to_string(), "upstream failure");
    }

    #[test]
    fn wrap_verifier_url_error_reports_invalid_url() {
        let err = eyre::eyre!("upstream failure");
        let wrapped = wrap_verifier_url_error(err, Some("not a url"), true);
        let msg = format!("{wrapped:#}");
        assert!(msg.contains("Invalid verifier URL"), "message: {msg}");
        assert!(!msg.contains("not a url"), "message: {msg}");
    }

    #[test]
    fn wrap_verifier_url_error_redacts_credentials_and_query() {
        let err = eyre::eyre!("upstream failure");
        let wrapped = wrap_verifier_url_error(
            err,
            Some("https://user:secret@example.com?api_key=secret"),
            true,
        );
        let msg = format!("{wrapped:#}");
        assert!(msg.contains("https://example.com/"));
        assert!(!msg.contains("user"));
        assert!(!msg.contains("secret"));
        assert!(!msg.contains("api_key"));
    }

    /// Args longer than the code at the address leave nothing to strip them from,
    /// which is a mismatch rather than a crash.
    #[test]
    fn match_bytecodes_survives_constructor_args_longer_than_bytecode() {
        let local = [0x60u8, 0x80, 0x60, 0x40];
        let onchain = [0x60u8, 0x80];
        let args = [0x11u8; 32];
        assert_eq!(match_bytecodes(&local, &onchain, &args, false, BytecodeHash::Ipfs), None);

        // Matching onchain args must not allow stripping past the local buffer.
        assert_eq!(match_bytecodes(&local, &args, &args, false, BytecodeHash::Ipfs), None);
    }
}