Deployed bytecode reproducibility

Evidence summary #

dYdX v4 is fully open-source Go (AGPLv3). In principle, anyone with same Go version and build environment can reproduce the binary from tagged source. However, Go compilation is not fully deterministic by default across OS/toolchain versions. No explicit reproducible-build attestation (e.g., goreleaser --reproducible) was confirmed in release notes. Yellow: broadly reproducible from public source; formal reproducible-build attestation not confirmed.

Sources #

Methodology #

Determine whether anyone can independently reproduce the deployed bytecode from the repo and declared build toolchain.

See the full factor methodology and distribution across all protocols →