[Contract Verification] Sophon Mainnet contract verification problem. The SafeL2 contract could not be verified.

[DenSmolonski]

Team or Project

Protofire Safe

Environment

Mainnet

Block Explorer

https://explorer.zksync.io/

Issue Type

• Plugin
• Block Explorer

Contract Address

0x610fcA2e0279Fa1F8C00c8c2F71dF522AD469380

Compiler Type

Multi-part contract

zkSolc Version

1.5.4

Solc Version

0.7.6

Contract Name

SafeL2.sol

Contract Code

// SPDX-License-Identifier: LGPL-3.0-only
pragma solidity >=0.7.0 <0.9.0;

import "./Safe.sol";

/**
 * @title SafeL2 - An implementation of the Safe contract that emits additional events on transaction executions.
 * @notice For a more complete description of the Safe contract, please refer to the main Safe contract `Safe.sol`.
 * @author Stefan George - @Georgi87
 * @author Richard Meissner - @rmeissner
 */
contract SafeL2 is Safe {
    event SafeMultiSigTransaction(
        address to,
        uint256 value,
        bytes data,
        Enum.Operation operation,
        uint256 safeTxGas,
        uint256 baseGas,
        uint256 gasPrice,
        address gasToken,
        address payable refundReceiver,
        bytes signatures,
        // We combine nonce, sender and threshold into one to avoid stack too deep
        // Dev note: additionalInfo should not contain `bytes`, as this complicates decoding
        bytes additionalInfo
    );

    event SafeModuleTransaction(address module, address to, uint256 value, bytes data, Enum.Operation operation);

    // @inheritdoc Safe
    function execTransaction(
        address to,
        uint256 value,
        bytes calldata data,
        Enum.Operation operation,
        uint256 safeTxGas,
        uint256 baseGas,
        uint256 gasPrice,
        address gasToken,
        address payable refundReceiver,
        bytes memory signatures
    ) public payable override returns (bool) {
        bytes memory additionalInfo;
        {
            additionalInfo = abi.encode(nonce, msg.sender, threshold);
        }
        emit SafeMultiSigTransaction(
            to,
            value,
            data,
            operation,
            safeTxGas,
            baseGas,
            gasPrice,
            gasToken,
            refundReceiver,
            signatures,
            additionalInfo
        );
        return super.execTransaction(to, value, data, operation, safeTxGas, baseGas, gasPrice, gasToken, refundReceiver, signatures);
    }

    // @inheritdoc Safe
    function execTransactionFromModule(
        address to,
        uint256 value,
        bytes memory data,
        Enum.Operation operation
    ) public override returns (bool success) {
        emit SafeModuleTransaction(msg.sender, to, value, data, operation);
        success = super.execTransactionFromModule(to, value, data, operation);
    }
}

Constructor Arguments

The are no arguments

Hardhat Verify Plugin Version

^1.6.0

Repo Link (Optional)

https://github.com/safe-global/safe-smart-account

Additional Details

Hi there.

We have encountered issue during smart contract verification. The issue log below. We have tried verify contract using --suppress-errors sendtransfer without any success. Any help would be greatly appreciated!

Address - https://explorer.sophon.xyz/address/0x610fcA2e0279Fa1F8C00c8c2F71dF522AD469380#contract
Smart contract verification URL - https://verification-explorer.sophon.xyz/contract_verification

contracts/SafeL2.sol:1248:5: Warning: Function state mutability can be restricted to pure
    function getChainId() public view returns (uint256) {
    ^ (Relevant source part starts here and spans across multiple lines).

Warning: You are checking for 'tx.origin', which might lead to unexpected behavior.

ZKsync Era comes with native account abstraction support, and therefore the initiator of a
transaction might be different from the contract calling your code. It is highly recommended NOT
to rely on tx.origin, but use msg.sender instead.

Learn more about Account Abstraction at https://docs.zksync.io/build/developer-reference/account-abstraction/

You may disable this warning with:
    a. `suppressedWarnings = ["txorigin"]` in standard JSON.
    b. `--suppress-warnings txorigin` in the CLI.
     --> contracts/SafeL2.sol:1135:73
      |
 1135 |         address payable receiver = refundReceiver == address(0) ? payable(tx.origin) : refundReceiver;
      |                                                                           ^^^^^^^^^

Error: You are using '<address payable>.send/transfer(<X>)' without providing the gas amount.
Such calls will fail depending on the pubdata costs.

Please use 'payable(<address>).call{value: <X>}("")' instead, but be careful with the
reentrancy attack. `send` and `transfer` send limited amount of gas that prevents reentrancy,
whereas `<address>.call{value: <X>}` sends all gas to the callee.

In Solidity v0.4, where there is no `payable` type, this may be a false positive
if `using X for address` is used with `X` implementing its own `send` or `transfer` functions.

Learn more about reentrancy at https://docs.soliditylang.org/en/latest/security-considerations.html#reentrancy

You may disable this error with:
    1. `suppressedErrors = ["sendtransfer"]` in standard JSON.
    2. `--suppress-errors sendtransfer` in the CLI.
     --> contracts/SafeL2.sol:1139:19
      |
 1139 |             require(receiver.send(payment), "GS011");
      |                     ^^^^^^^^^^^^^^^^^^^^^^ 

[gleenai[bot]]

It appears you are encountering issues with contract verification on the Sophon Mainnet using the ZKsync block explorer. The errors and warnings you've shared indicate specific Solidity practices that might be problematic on the ZKsync Era network, particularly concerning the use of tx.origin and the .send/.transfer methods without specifying gas amounts.

Here are a few steps and recommendations to address these issues:

1. Replace tx.origin with msg.sender: As the warning suggests, relying on tx.origin can lead to unexpected behavior due to account abstraction on ZKsync Era. Update your contract to use msg.sender where applicable.

2. Modify .send/.transfer Calls: Instead of using .send or .transfer, which provide limited gas and can lead to failures, consider using the .call method with specified gas values. This change requires careful handling to avoid reentrancy attacks, as .call sends all available gas by default.

3. Suppress Specific Warnings and Errors: If you are certain that the warnings and errors can be safely ignored in your context, you can suppress them using the suppressedWarnings and suppressedErrors options in your Hardhat configuration. However, this should be done with caution as it may mask important security considerations.

4. Review and Update Contract Logic: Given the unique constraints and features of the ZKsync Era, review your contract's logic and interactions to ensure compatibility and security. Consider consulting the ZKsync Era documentation on account abstraction for more detailed guidance.

5. Reattempt Verification: After making the necessary modifications, try verifying the contract again using the Hardhat verify plugin with the updated settings.

If these steps do not resolve the issue, or if you need further assistance, consider reaching out for more specific support through the ZKsync developers discussions on Github. This platform can provide more tailored advice for your situation.

Your feedback helps us serve you better. If this fully addresses your question, please give it a thumbs up. If it doesn't, please give it a thumbs down. This will inform the community and team so we can improve our support.

[JackHamer09]

@DenSmolonski hey! More info about your issue would be helpful, for example:

• Is the log for verification and not compilation?
• Which tool are you using to verify contact? Explorer UI / hardhat / foundry

[DenSmolonski]

1. This is log for verification.
2. I used hardhat and Explorer UI

[JackHamer09]

@DenSmolonski I would also need full step-by-step reproduction scenario to help you debug this and narrow down the scope.

[uF4No]

hey @DenSmolonski
Can you confirm if the bytecode in your artifacts-zk local folder matches with the one deployed? Also, could you please try verifying with npx hardhat verify as detailed in this section of the docs?

Also, to disable the errors thrown bause of the use of tx.origin or using transfer, you can add the supressedErrors in the zksolc settings in your hardhat config file as below. More details in this page of the docs

zksolc: {
  settings: {
     suppressedErrors: ['txorigin', 'sendtransfer'], // Suppress specified errors. Currently supported: txorigin, sendtransfer
  }
}

[bxpana]

@lutr0 marking this as unanswered so that it alerts our support team that there is still an issue

[sarahschwartz]

Thanks @bxpana !

@lutr0 Can you try this config instead:

    settings: {
      suppressedErrors: ['sendtransfer'],
      suppressedWarnings: ['txorigin']
    },

sendtransfer is an error vs txorigin is just a warning

[lutr0]

Hi @sarahschwartz, thanks for your support!
Getting the same error:

yarn hardhat verify 0x610fcA2e0279Fa1F8C00c8c2F71dF522AD469380 --network sophonMainnet

Successfully compiled 55 Solidity files
Your verification ID is: 375
hardhat-zksync-verify found one or more errors during the verification process:

ZkSyncBlockExplorer:
Failed to send contract verification request
 Reason: ZkSyncVerifyPluginError: Compilation errorcontracts/Safe.sol:352:5: Warning: Function state mutability can be restricted to pure
    function getChainId() public view returns (uint256) {
    ^ (Relevant source part starts here and spans across multiple lines).

Warning: You are checking for 'tx.origin', which might lead to unexpected behavior.

ZKsync Era comes with native account abstraction support, and therefore the initiator of a
transaction might be different from the contract calling your code. It is highly recommended NOT
to rely on tx.origin, but use msg.sender instead.

Learn more about Account Abstraction at https://docs.zksync.io/build/developer-reference/account-abstraction/

You may disable this warning with:
    a. `suppressedWarnings = ["txorigin"]` in standard JSON.
    b. `--suppress-warnings txorigin` in the CLI.
    --> contracts/Safe.sol:239:73
     |
 239 |         address payable receiver = refundReceiver == address(0) ? payable(tx.origin) : refundReceiver;
     |                                                                           ^^^^^^^^^


Error: You are using '<address payable>.send/transfer(<X>)' without providing the gas amount.
Such calls will fail depending on the pubdata costs.

Please use 'payable(<address>).call{value: <X>}("")' instead, but be careful with the
reentrancy attack. `send` and `transfer` send limited amount of gas that prevents reentrancy,
whereas `<address>.call{value: <X>}` sends all gas to the callee.

In Solidity v0.4, where there is no `payable` type, this may be a false positive
if `using X for address` is used with `X` implementing its own `send` or `transfer` functions.

Learn more about reentrancy at https://docs.soliditylang.org/en/latest/security-considerations.html#reentrancy

You may disable this error with:
    1. `suppressedErrors = ["sendtransfer"]` in standard JSON.
    2. `--suppress-errors sendtransfer` in the CLI.
    --> contracts/Safe.sol:243:19
     |
 243 |             require(receiver.send(payment), "GS011");
     |                     ^^^^^^^^^^^^^^^^^^^^^^




error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

This is the full hardhat.config:

import "@nomicfoundation/hardhat-toolbox";
import type { HardhatUserConfig, HttpNetworkUserConfig } from "hardhat/types";
import "@matterlabs/hardhat-zksync-deploy";
import "@matterlabs/hardhat-zksync-solc";
import "@matterlabs/hardhat-zksync-verify";
import "@matterlabs/hardhat-zksync-ethers";
import "@matterlabs/hardhat-zksync-node";
import "hardhat-deploy";
import { getSingletonFactoryInfo } from "@safe-global/safe-singleton-factory";
import dotenv from "dotenv";
import yargs from "yargs";

const argv = yargs
    .option("network", {
        type: "string",
        default: "sophonMainnet",
    })
    .help(false)
    .version(false)
    .parseSync();

// Load environment variables.
dotenv.config();
const {
    NODE_URL,
    INFURA_KEY,
    MNEMONIC,
    ETHERSCAN_API_KEY,
    PK,
    SOLIDITY_VERSION,
    SOLIDITY_SETTINGS,
    HARDHAT_ENABLE_ZKSYNC = "0",
    HARDHAT_CHAIN_ID = 31337,
} = process.env;

const DEFAULT_MNEMONIC = "candy maple cake sugar pudding cream honey rich smooth crumble sweet treat";

const sharedNetworkConfig: HttpNetworkUserConfig = {};
if (PK) {
    sharedNetworkConfig.accounts = [PK];
} else {
    sharedNetworkConfig.accounts = {
        mnemonic: MNEMONIC || DEFAULT_MNEMONIC,
    };
}

if (["mainnet", "rinkeby", "kovan", "goerli", "ropsten", "mumbai", "polygon"].includes(argv.network) && INFURA_KEY === undefined) {
    throw new Error(`Could not find Infura key in env, unable to connect to network ${argv.network}`);
}

import "./src/tasks/local_verify";
import "./src/tasks/deploy_contracts";
import "./src/tasks/show_codesize";
import { BigNumber } from "@ethersproject/bignumber";
import type { DeterministicDeploymentInfo } from "hardhat-deploy/dist/types";

const defaultSolidityVersion = "0.7.6";
const primarySolidityVersion = SOLIDITY_VERSION || defaultSolidityVersion;
const soliditySettings = SOLIDITY_SETTINGS ? JSON.parse(SOLIDITY_SETTINGS) : undefined;

const deterministicDeployment = (network: string): DeterministicDeploymentInfo => {
    const info = getSingletonFactoryInfo(Number.parseInt(network));
    if (!info) {
        throw new Error(`
        Safe factory not found for network ${network}. You can request a new deployment at https://github.com/safe-global/safe-singleton-factory.
        For more information, see https://github.com/safe-global/safe-smart-account#replay-protection-eip-155
      `);
    }
    return {
        factory: info.address,
        deployer: info.signerAddress,
        funding: BigNumber.from(info.gasLimit).mul(BigNumber.from(info.gasPrice)).toString(),
        signedTx: info.transaction,
    };
};

const userConfig: HardhatUserConfig = {
    paths: {
        artifacts: "build/artifacts",
        cache: "build/cache",
        deploy: "src/deploy",
        sources: "contracts",
    },
    typechain: {
        outDir: "typechain-types",
        target: "ethers-v6",
    },
    solidity: {
        compilers: [{ version: primarySolidityVersion, settings: soliditySettings }, { version: defaultSolidityVersion }],
    },
    zksolc: {
        version: "1.5.4",
        settings: {
            suppressedErrors: ['sendtransfer'],
            suppressedWarnings: ['txorigin']
          },
    },
    networks: {
        // hardhat: {
        //     allowUnlimitedContractSize: true,
        //     blockGasLimit: 100000000,
        //     gas: 100000000,
        //     zksync: HARDHAT_ENABLE_ZKSYNC === "1",
        //     chainId: typeof HARDHAT_CHAIN_ID === "string" && !Number.isNaN(Number.parseInt(HARDHAT_CHAIN_ID)) ? Number.parseInt(HARDHAT_CHAIN_ID) : 31337,
        // },
        mainnet: {
            ...sharedNetworkConfig,
            url: `https://mainnet.infura.io/v3/${INFURA_KEY}`,
        },
        gnosis: {
            ...sharedNetworkConfig,
            url: "https://rpc.gnosischain.com",
        },
        goerli: {
            ...sharedNetworkConfig,
            url: `https://goerli.infura.io/v3/${INFURA_KEY}`,
        },
        mumbai: {
            ...sharedNetworkConfig,
            url: `https://polygon-mumbai.infura.io/v3/${INFURA_KEY}`,
        },
        polygon: {
            ...sharedNetworkConfig,
            url: `https://polygon-mainnet.infura.io/v3/${INFURA_KEY}`,
        },
        bsc: {
            ...sharedNetworkConfig,
            url: `https://bsc-dataseed.binance.org/`,
        },
        arbitrum: {
            ...sharedNetworkConfig,
            url: `https://arb1.arbitrum.io/rpc`,
        },
        fantomTestnet: {
            ...sharedNetworkConfig,
            url: `https://rpc.testnet.fantom.network/`,
        },
        avalanche: {
            ...sharedNetworkConfig,
            url: `https://api.avax.network/ext/bc/C/rpc`,
        },
        zkSyncMainnet: {
            ...sharedNetworkConfig,
            url: "https://mainnet.era.zksync.io",
            ethNetwork: "mainnet",
            zksync: true,
            verifyURL: "https://zksync2-mainnet-explorer.zksync.io/contract_verification",
        },
        zkSyncSepolia: {
            ...sharedNetworkConfig,
            url: "https://sepolia.era.zksync.dev",
            ethNetwork: "goerli",
            zksync: true,
            verifyURL: "https://explorer.sepolia.era.zksync.dev/contract_verification",
        },
        sophonMainnet: {
            url: "https://rpc.sophon.xyz",
            ethNetwork: "mainnet",
            verifyURL: "https://verification-explorer.sophon.xyz/contract_verification",
            browserVerifyURL: "https://explorer.sophon.xyz/",
            enableVerifyURL: true,
            zksync: true,
            accounts: [process.env.ZKSYNC_DEPLOYER_PK as string]
        },
        sophonTestnet: {
            url: "https://rpc.testnet.sophon.xyz",
            ethNetwork: "sepolia",
            verifyURL: "https://api-explorer-verify.testnet.sophon.xyz/contract_verification",
            browserVerifyURL: "https://explorer.testnet.sophon.xyz/",
            enableVerifyURL: true,
            zksync: true,
            accounts: [process.env.ZKSYNC_DEPLOYER_PK as string]
        },
    },
    deterministicDeployment,
    namedAccounts: {
        deployer: 0,
    },
    mocha: {
        timeout: 2000000,
    },
    sourcify: {
        enabled: true
    },
    etherscan: {
        enabled: false,
        apiKey: {
          sophonTestnet: process.env.ETHERSCAN_SOPHON_API_KEY as string,
          sophonMainnet: process.env.ETHERSCAN_SOPHON_API_KEY as string,
          zkSyncTestnet: process.env.ETHERSCAN_ZKSYNC_API_KEY as string,
          zkSyncMainnet: process.env.ETHERSCAN_ZKSYNC_API_KEY as string
        },
        customChains: [
          {
            network: "sophonTestnet",
            chainId: 531050104,
            urls: {
              apiURL: "https://api-testnet.sophscan.xyz/api",
              browserURL: "https://testnet.sophscan.xyz",
            },
          },
          {
            network: "sophonMainnet",
            chainId: 50104,
            urls: {
              apiURL: "https://api.sophscan.xyz/api",
              browserURL: "https://sophscan.xyz",
            },
          },
          {
            network: "zkSyncTestnet",
            chainId: 300,
            urls: {
              apiURL: "https://api-testnet-era.zksync.network/api",
              browserURL: "https://testnet-era.zksync.network",
            },
          },
        ],
      }
};
if (NODE_URL) {
    userConfig.networks!.custom = {
        ...sharedNetworkConfig,
        url: NODE_URL,
    };
}
export default userConfig;

[MexicanAce]

Interesting for me, I run into a separate error that the bytecode does not match (your updated hardhat.config.ts worked for me)... taking a closer look at contract verified on Etherscan, you see that there's a custom compiler version v0.7.6+commit.7338295f.

Unfortunately, I'm unable to verify with that specific zksolc version as there's no corresponding zkvm-solc 0.7.6+commit.7338295f-1.0.1.

I'm wondering if a path forward is to remove (or rename) the cached files on your local system and try again?

[lutr0]

Hi @MexicanAce , I'm not sure v0.7.6+commit.7338295f is relevant, it's how Etherscan was flagging the version until a recent update.

From the .env file:

# Used for compiling with different solidity testing
 # Example: '0.8.19'
SOLIDITY_VERSION=0.7.6
# For running coverage tests, `details` section of solidity settings are required, else could be removed.
# Example: '{"viaIR":true,"optimizer":{"enabled":true, "details": {"yul": true, "yulDetails": { "optimizerSteps": ""}}}}'
SOLIDITY_SETTINGS=
# Set to 1 to run hardhat in zksync mode. This will enable the ZK compiler and run the hardhat node in zksync mode.
HARDHAT_ENABLE_ZKSYNC=1
# Sets hardhat chain id. In general, you don't need this, it's only used for testing the SafeToL2Setup contract.
HARDHAT_CHAIN_ID=31337