How verification works

What the explorer checks, what you need to provide, and what BugCrawl stores.

Source verification answers one question: does this source, compiled with these exact settings, produce the bytecode deployed at this address? The explorer does the compiling and comparing. BugCrawl prepares the request, relays it, polls for the result and then re-reads the explorer to record what it publicly shows.

What you need

The network and the deployed address.
The full compiler build, e.g. v0.8.30+commit.73712a01. A version number alone is not enough.
Either the standard-JSON input your build tool used (recommended: it includes every file and every setting), or a single flattened source file plus optimizer runs and EVM version.
Constructor arguments, ABI-encoded. If you leave them out, the explorer tries to detect them from the creation transaction.
Addresses of any linked libraries.

An address on its own can never be verified. If BugCrawl only has the address, it can tell you whether the explorer already has source, and nothing more.

Statuses

Source verified	Exact match reported by the explorer.
Partial match	Bytecode matches but the metadata hash differs (comments, file paths).
Unverified	Contract exists; no source published.
Verification failed	The last submission did not match.
No explorer	The network has no verification provider (e.g. a local chain).
Status unknown	The explorer could not be reached. BugCrawl never guesses “verified”.

What BugCrawl stores

For each submission: the network, address, contract name, compiler version, settings, the explorer's job id and messages, and a keccak-256 hash of the submitted text (not the text itself). After a pass, it stores an evidence digest computed as

keccak256(abi.encode(
  keccak256("bugcrawl.evidence.source-bundle.v1"),
  chainId, address, keccak256(compilerVersion), keccak256(submittedInput)
))

The same formula is implemented on-chain in EvidenceHashLib, so a verifier can anchor it in VerificationEvidenceStore.

From the command line

BugCrawl verifies its own contracts with the same adapter the website uses:

npm run verify:testnet -w @bugcrawl/contracts
# optional: anchor results on-chain (needs VERIFIER_ROLE)
REPORT_ONCHAIN=1 npm run verify:testnet -w @bugcrawl/contracts