Is the WASM blob created from ink! contract always deterministic

Question

The contract's source code is provided during the contract verification on a block explorer (or some other source verifier). The block explorer needs to compile that source and verify if the generated code is the same as the one deployed on the blockchain. Is it reasonable to expect that cargo-contract will build the same wasm blob regardless the compile environment?

Answer 1

Currently we don't persist the information necessary to have a deterministic build. There is this GitHub issue for it: https://github.com/paritytech/cargo-contract/issues/525.

The underlying issue is that for deterministic builds you need to set up your build environment exactly as it was during the original build.

In order to always get the same Wasm blob as a result of cargo contract build you need to know:

• The Rust version which was used for the build.
• The cargo-contract version.
• If it was a release or a debug build (i.e. if --release was submitted to cargo-contract or not).
• The supplied cargo features.
• The wasm-opt version, this tool is used to optimized the resulting Wasm blob.

If you have all this information + the contract with its Cargo.toml you can re-execute cargo contract build with those settings. You can the compare the result of cat target/ink/flipper.contract | jq -r .source.hash with the hash of the Wasm blob that you have.

We're actively working on the issue I linked above and it should be done somewhen in the first two weeks of June.

After this issue has been implemented all of this information will be stored in a custom section of the Wasm. This means the information will be available on-chain and a block explorer can extract this info from the Wasm contract blob. If someone then uploads e.g. a lib.rs and Cargo.toml to the block explorer with the claim that this is the source code, the block explorer can build this contract with the environmental information stored in this custom Wasm section.