From: Ardis Lu <ardisglu@gmail.com>
Date: Sun, 12 Nov 2023 04:02:22 +0000 (-0800)
Subject: Add warning about metadata validation
X-Git-Url: https://git.ardis.lu/?a=commitdiff_plain;h=abe7d899cf9668ad46b06bfbbb84691737e179ac;p=solc-metadata

Add warning about metadata validation
---

diff --git a/README.md b/README.md
index a84dfde..76501f6 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,9 @@ This is the minimum JavaScript required to fetch, extract, decode, and use the [
 
 Similar to sourcify's metadata playground ([website](https://playground.sourcify.dev/), [GitHub](https://github.com/sourcifyeth/metadata-playground)) but reduced to the bare minimum code.
 
+> [!WARNING]<br>
+> This tool does not validate the source code retrieved from the bytecode metadata. You **MUST** recompile the source code and match it with the on-chain bytecode to confirm the metadata is correct.
+
 ## Fetch
 
 By default, the Solidity compiler appends metadata to the end of a smart contract's runtime bytecode. A smart contract's runtime bytecode may be fetched from any Ethereum node using the standard JSON-RPC method [`eth_getCode`](https://ethereum.org/en/developers/docs/apis/json-rpc/#eth_getcode).