Why bytecode does not match
The message says no contract in the repository compiles to the code on the chain. Here is every reason it happens, most common first.
The match compares the compiled runtime with the on-chain runtime, byte for byte, after setting aside the metadata block and the immutable slots. Any other difference is a mismatch. In order of how often each one is the cause:
1. Wrong commit
The branch moved since deployment. Name the exact commit you deployed from, in the ref field. If you tagged the release, use the tag.
2. Compiler version
0.8.24 and 0.8.26 produce different code from the same source. The version in foundry.toml (solc = "…") or the one Foundry picked for your pragma must be the one used at deployment. Check the metadata on the explorer, or your deployment logs.
3. Optimizer settings
optimizer_runs = 200 versus 1000000, or via_ir = true versus false, change most of the bytecode. Hardhat projects: the worker's generated foundry.toml uses Foundry's defaults; add your own foundry.toml mirroring the Hardhat settings.
4. Wrong contract
The repository compiles fine, but the token you deployed is TokenV2 and the repository's main file is Token. The worker tries every compiled contract with runtime code, so this only fails if the deployed one is not in the tree at that commit at all.
5. Different source
A line changed after deployment and was committed. Even a comment does not matter (comments are not in bytecode), but any code change does. Use the deployment commit.
6. Missing dependency
A submodule that is not on GitHub, or a Hardhat project without node_modules. This usually fails at the build step with a clearer message, but a project that half-compiles can reach the match with the wrong contracts.
7. Linked libraries
External libraries (library with public functions, deployed separately) are linked by address at deployment. The worker does not link, so the placeholder bytes differ from the chain. Inline your libraries (internal functions) or wait for library linking, which is on the list.
8. A proxy
The address you gave is a proxy. Its runtime is a few hundred bytes of DELEGATECALL, matching nothing in your repository. Seal the implementation address instead, and note that the seal will then fail check 06 on the proxy if you seal that too.
9. Pasted creation bytecode
For undeployed contracts: you pasted bytecode (creation) instead of deployedBytecode (runtime). The runtime is a suffix of the creation code and is what eth_getCode will return after deployment.
10. Immutables at unusual positions
The worker blanks immutable slots using the compiler's immutableReferences. This is reliable for Solidity ≥ 0.6.5. Very old compilers or Vyper are not supported.
Checking locally
forge build
cast code <address> --rpc-url https://rpc.mainnet.chain.robinhood.com > onchain.hex
jq -r .deployedBytecode.object out/Token.sol/Token.json > local.hex
Strip the last 2 + 2*len hex characters (where len is the value of the last two bytes) from both, blank the immutables, and compare. Or simply: if forge verify-contract against Blockscout succeeds with your settings, the zkCheck match will too.