skills.rest
OriginProtocol
OriginProtocolOFFICIAL
Explore all skills by this author →
Website𝕏@originprotocolGitHub

verify-deployment-pr

Audits executed smart-contract deployment PRs against on-chain explorer data and Foundry scripts.

152|115|Updated Aug 3, 2020
Search Tags:#code audit#smart contracts#foundry#etherscan#deployment verification#governance proposal#sol2uml
One-click install
npx skills add https://github.com/OriginProtocol/origin-dollar --skill verify-deployment-pr-originprotocol
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: verify-deployment-pr
Source: https://github.com/OriginProtocol/origin-dollar/tree/main/.claude/skills/verify-deployment-pr
Command: npx skills add https://github.com/OriginProtocol/origin-dollar --skill verify-deployment-pr-originprotocol

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sol2uml.

What problem does it solve? Reviewing an already-executed mainnet deployment PR requires manually cross-checking deployed addresses, verified source code, constructor arguments, initialize transactions, and governance proposals against the Foundry deploy script — a slow, error-prone process where a single mismatch can mean a misconfigured contract on-chain. ## Core Features & Use Cases - On-chain source verification: Diffs explorer-verified contract source (and dependencies) against the local codebase using sol2uml diff per deployed address. - Constructor and initialize validation: Compares constructor arguments and post-deploy initialize(...) transaction calldata against the Foundry deploy script's _execute() logic. - Governance proposal matching: Reads the on-chain GovernorSix proposal via getActions and verifies targets, signatures, and calldatas match the script's _buildGovernanceProposal() actions. - Use Case: A reviewer is asked to sign off on PR #142 which deployed new OUSD strategy contracts to mainnet. The skill checks out the PR branch, enumerates every _recordDeployment in the deploy script, diffs each address's verified source, validates constructor args and the governance proposal, and emits a VERIFIED or BLOCKERS FOUND report. ## Quick Start Ask the assistant to run /verify-deployment-pr with the PR number, for example: verify deployment PR 142 against the on-chain deployment.

Frequently Asked Questions about verify-deployment-pr

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify a smart contract deployment PR on GitHub?▼

Run the skill with the PR number after checking out the PR branch. It enumerates deployed contracts from the Foundry script, diffs verified on-chain source with sol2uml, and validates constructor args, initialize transactions, and the governance proposal.

How to compare on-chain verified contract source with local Solidity code?▼

Use sol2uml diff with the contract address, local path, network flag, and Etherscan API key. It downloads the explorer-verified source and its dependencies and reports any file differences against the local checkout.

Does this work for proxy contract deployments?▼

Yes, but proxy addresses must be diffed against the proxy contract source, not the implementation source. Proxies typically have no constructor arguments, and their initialize transaction calldata is checked against the deploy script.

Why does the verification fail with a wrong branch error?▼

Every check diffs on-chain deployments against local code, so the checkout must match the PR head branch or contain its merge commit. A wrong branch or dirty working tree silently produces meaningless diffs, so the skill stops and asks you to check out the PR.

What are the limitations of this deployment verification?▼

It is strictly read-only and cannot judge whether the PR's stated intent matches the on-chain effect, which remains a human responsibility. It also cannot run without an Etherscan API key, and smoke tests after fork execution are skipped by project decision.

Related Skills

Explore More Software Engineering Skills→
MolcajeteAIMolcajeteAI
2

deployment

Deploy Solidity smart contracts to testnets and mainnets using Foundry and Hardhat.

Official
Advanced
Brave-LabsBrave-Labs

Dev10x-gh-pr-triage

Classify GitHub PR review comments into verdicts with evidence.

Official
Advanced
dangvu008dangvu008
1

rune-watchdog

Runs post-deploy HTTP health checks and generates structured smoke test reports.

Community
Intermediate
aaronjmarsaaronjmars
714

tx-explain

Decodes Base transactions into plain-English summaries of token movements and approval risks.

Community
Intermediate