Source verification on AERE is a Sourcify-style bytecode and metadata comparison. This page says what a result actually proves, because "verified" is a word that carries more weight than it earns.
How the comparison works
- The runtime bytecode at the address is fetched with
eth_getCode. - The published Solidity source is compiled with the recorded compiler version and settings.
- The two are compared byte for byte, with constructor immutables and library links masked.
- The metadata hash embedded at the end of the bytecode is compared separately.
The three results
| Result | What it means |
|---|---|
| Full match | The executable bytecode and the embedded metadata hash are byte-identical to the compiled artifact. This proves the exact source and compiler settings in the repository were deployed. |
| Partial match | The executable bytecode is byte-identical, but the trailing metadata hash differs. The deployed logic is this source, recompiled with slightly different metadata, for example a different set of surrounding source files, file paths, or comments in the compilation unit. |
| No match | The executable bytecode itself differs. The deployed code is not this source. |
A partial match is not a weaker claim about the logic. The logic is proven identical. What differs is the compilation context recorded alongside it.
What a verified list does not prove
Absence from the list is not a failure, and it is not a pass either. A contract that has not been checked has not been checked. A "no match" count of zero is a statement about the rows that were examined, and nothing at all about the ones that were not.
The published results page states its own coverage for this reason: how many contracts hold live runtime code, how many of those appear in the table, and how many are known not to reproduce from the public repository. Read that paragraph before reading the table.
Where the results are
Verified contracts carries the current table, the coverage statement and the compiler settings used for each row.
Verifying one yourself
Everything needed is public: the addresses are in the SDK's address registry, the sources are in the public repositories, and eth_getCode is available on any endpoint or on your own node. The comparison needs no permission from us, which is the only property that makes it worth anything.