Preparing your repository

The one rule

The worker must be able to produce, from your repository at one commit, the exact runtime bytecode that is on the chain. Everything on this page is in service of that.

Foundry projects

The common case, and the easiest.

• foundry.toml can be at the root or in a subfolder up to three levels down (contracts/, packages/core/). The nearest one wins.
• Dependencies as git submodules are fetched at the commit your repository pins, from GitHub, three levels deep. A submodule hosted elsewhere stops the review with a message naming it; vendor it into the tree.
• The compiler version, optimizer settings and via_ir are read from foundry.toml. They must be the ones the deployment was built with. If you deployed with forge script from this repository, they are.
• The build runs offline (forge build --offline). A foundry.toml that needs to download a compiler works, because the compiler is downloaded by version and Foundry's cache in the worker holds the common ones; an unusual version may need a first run to fetch it.
• remappings.txt is honoured.

Hardhat and Remix projects

If there is no foundry.toml, the worker writes a minimal one:

[profile.default]
src = "contracts"        # or "src", or ".", whichever holds .sol files
out = "out"
libs = ["node_modules", "lib"]
remappings = ["@openzeppelin/=node_modules/@openzeppelin/", ...]

with one remapping per @scope folder found in node_modules. This means node_modules must be committed for the build to see your dependencies, or the dependencies must be vendored under lib/. The worker does not run npm install.

The optimizer settings are then Foundry's defaults (optimizer on, 200 runs, the latest compiler that satisfies your pragma). If your Hardhat config used different settings, the bytecode will not match. The fix is to add a foundry.toml to your repository with the same settings Hardhat used:

[profile.default]
src = "contracts"
libs = ["node_modules"]
solc = "0.8.24"
optimizer = true
optimizer_runs = 200
via_ir = false

What must not be in the tree

Nothing is forbidden, but the build runs with no network and executes nothing but the compiler. A foundry.toml with ffi = true has no effect. Scripts are not run. Tests are not run.

What the review reads

The review reads your project's own .sol files: everything except paths under node_modules/, lib/, out/, cache/, test/, tests/, script/, scripts/, and files ending in .t.sol or .s.sol. Keep your contracts in the usual places and the review sees exactly them.

Size

The review reads up to 350 kB of your own source. Larger projects get their eight answers and a seal without a review, and the seal says why.

Private repositories

Work the same as public ones. The grant is what lets the worker read; the repository's visibility is not consulted and not recorded.

Checklist

• Compiles with forge build from a fresh clone with submodules, or with the generated foundry.toml above.
• Compiler version and optimizer settings match the deployment.
• Submodules are on GitHub.
• Hardhat: node_modules committed or dependencies vendored, and a foundry.toml mirroring your settings.
• The contract you name is in this repository at this commit.