Retrieve ABI from sourcify / metadata

Since you, @krzkaczor , mentioned that you would like to retrieve the ABI directly from the metadata as well instead of from etherscan, I just want to quickly explain the steps. We are working on an npm package to maybe do part of this, but it’s really not complicated (pseudocode):

code = eth.getCodeAt(addr).hexToBytes()
metadataSize = code[-2] * 0x100 + code[-1]
metadataCBOR = cbor.decode(code[-metadataSize - 2:-2])
ipfsLink = metadataCBOR['ipfs']
// the link is binary-encoded, you might have to base58-encode it, depending on the
// way you access ipfs
metadata = ipfs.retrieve(ipfsLink)
abi = metadata['output']['abi']

This is the recommended decentralized way to do it. You can either use ipfs “directly” or through an http gateway. My experience with http gateways (at least the cloudfront one) is that they will also pin data that is retrieved through them, which is nice.

The access via ipfs only works if contracts are fully verified on sourcify (including the correct metadata hash). This guarantees that neither the source nor the ABI have been modified after deployment.

There is a centralized http interface to sourcify that also allows you to access partially verified contract’s abis: https://github.com/ethereum/sourcify/blob/master/docs/api/server/getByChainAndAddress.md

If you have further questions, you can also come to our gitter / matrix channel: https://gitter.im/ethereum/source-verify

[krzkaczor]

Basic support for sourcify got released in: https://github.com/dethcrypto/eth-sdk/releases/tag/%40dethcrypto%2Feth-sdk%400.2.2

Currently, it uses sourcify API (backend), we could migrate to IPFS once npm package is done and exposes a simple interface for us to use.

[kuzdogan]

I’m not in Lisbon but @chriseth is there so you might bump into each other. I think it’s more or less clear and seems to be quite parallel with what we want to build. I will be letting you know about the progress, thanks!