1

The dapp review sites often list the contract names a dapp is using. I see that this is added by whoever has added that dApp into the review site.

But is there a verifiable way (through an explorer or using some API) we can figure that a particular contract is indeed used in a certain dApp for sure.

0

If the contract is open source you can clone it and compile it locally and deploy the contract to some accountname. Then you can cleos get code accountname and compare the hashes. Same goes with the ABI file.

If the contract code is not open source, the only way you can tell a contract code has not changed is to get the code hash prior to using the contract each time.

Unfortunately this burden is on the user, but I suspect there are groups working to create more robust solutions for users that are less technical.

| improve this answer | |
  • Understood. However my question was more primitive. That feature you discribed is only useful once we're sure that the contract they say is indeed the one they use. How can be sure that the contract is the one the dapp is actually calling. If there's a mechanism for it, dApp devs can independently verify it with reputed verifiers (without revealing the source to the entire internet) and the cycle of trust will be complete. – mixdev Jul 25 '19 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.