Deployed bytecode matches signed release tag
A post-deploy hygiene & change mgmt factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor checks whether the protocol's currently deployed runtime bytecode corresponds to a signed git tag in the protocol's public repository. The verification process compares the on-chain bytecode hash against the compiled artifact from the tagged commit, using the protocol's declared compiler settings. A match means the deployed code is traceable to a specific point in the public version history; a mismatch means the deployed code was compiled from a state that is not publicly verifiable.
Why it matters
Bytecode-to-release-tag correspondence is the foundational transparency requirement for any post-audit assurance claim. When an audit references a specific commit, users need to know that the deployed bytecode corresponds to that commit — or to a subsequent tagged release that documents what changed. Without this correspondence, an audit report cannot be meaningfully linked to the production system. The synthesis notes that "audited protocol, unaudited upgrade" is a recurring failure mode: release tag correspondence would catch the case where the deployed bytecode diverges from the audited commit without a documented release entry.
Green / Yellow / Red
Green is assigned when all production contracts have their bytecode verified against a signed release tag that is publicly accessible and the compiler settings are reproducible. Yellow covers cases where a tag exists but is unsigned, or where the correspondence is established for major contracts but not peripheral ones. Red is assigned when the deployed bytecode does not match any tagged release in the public repository, or when the repository has no tagged releases and the deploy commit is not documented.
Common gray cases
This factor is grayed when the protocol repository is private and no public artifact verification path exists, or when the protocol operates on a chain where deterministic compilation tooling is not yet mature.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Determine whether the deployed runtime bytecode corresponds to a signed git tag in the protocol's repository.