From abe7d899cf9668ad46b06bfbbb84691737e179ac Mon Sep 17 00:00:00 2001 From: Ardis Lu Date: Sat, 11 Nov 2023 20:02:22 -0800 Subject: [PATCH] Add warning about metadata validation --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index a84dfde..76501f6 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,9 @@ This is the minimum JavaScript required to fetch, extract, decode, and use the [ Similar to sourcify's metadata playground ([website](https://playground.sourcify.dev/), [GitHub](https://github.com/sourcifyeth/metadata-playground)) but reduced to the bare minimum code. +> [!WARNING]
+> This tool does not validate the source code retrieved from the bytecode metadata. You **MUST** recompile the source code and match it with the on-chain bytecode to confirm the metadata is correct. + ## Fetch By default, the Solidity compiler appends metadata to the end of a smart contract's runtime bytecode. A smart contract's runtime bytecode may be fetched from any Ethereum node using the standard JSON-RPC method [`eth_getCode`](https://ethereum.org/en/developers/docs/apis/json-rpc/#eth_getcode). -- 2.47.3