Seal a Pons launch before the reveal
Get the badge on your launch page before anyone has seen the code, then keep it after deployment.
The most common use: you are about to launch a token on Pons, you do not want to publish the source, and you want buyers to see eight answers before they buy.
1. Build the token
Write it to pass. Passing the checks is the list; the fixture worker/test/fixtures/clean/src/Clean.sol is a passing starting point. Commit it to a private repository on GitHub.
2. Get the runtime bytecode
forge build
jq -r .deployedBytecode.object out/Token.sol/Token.json
This is the code that will sit at the address after deployment. Copy it.
Pons deploys your token through its own factory. If Pons compiles your source itself, the bytecode it deploys is whatever its compiler settings produce. Use the same compiler version and optimizer settings in your
foundry.toml, or deploy the token yourself and hand the address to Pons if it accepts one.
3. Review the bytecode
On /seal: connect GitHub, install the app on the private repository, pick it and the commit. Choose Bytecode, not deployed and paste the runtime. Name the token. Send.
The worker compiles your repository, checks that it produces the bytecode you pasted, and runs checks 01 to 06 and 08. Check 07 is not run (nothing is deployed). You get a seal with 7 of 8 and the review, at /seals/<hash>.
4. Put the link in the launch
The seal page is public and the source is not. Put the link in the Pons description, the tweet, the Telegram. Anyone can see the seven answers, the evidence, the review and the auditor. Nobody can see the code.
5. Launch, then complete the seal
Deploy. Once at least one wallet holds the token, go back to /seal, same repository, same commit, but this time Deployed on Robinhood Chain with the address. The match is identical (same source, same bytecode), so the seal is rewritten at the same hash with check 07 answered: 8 of 8, and the post goes out on X.
6. Keep it
The seal follows the bytecode. Do not upgrade (you cannot; check 06), do not redeploy with a change (new hash, new review). The badge stays as long as the code does.
If step 3 fails on the match
The bytecode you pasted does not come from the repository at that commit with those settings. Why bytecode does not match: nine times out of ten it is the compiler version or optimizer runs.