Deployed bytecode matches signed release tag

Evidence summary #

Cannot verify — aggregator and perps programs are closed-source binaries. jup-ag/metis-binary shows binary releases but no signed git tags linking binary to source commit hash. Jupiter Lend (open-source) has a Code4rena competition snapshot at a fixed commit, which is more verifiable. Cannot confirm for the core closed-source programs that deployed bytecode matches any signed release.

Sources #

Methodology #

Determine whether the deployed runtime bytecode corresponds to a signed git tag in the protocol's repository.

See the full factor methodology and distribution across all protocols →