[GH-ISSUE #2388] [Feature] Solidity: inspect bytecode CBOR metadata losslessly and bind supplied metadata files #796

New issue

Open

opened 2026-10-15 18:28:33 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:33 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2388

Analyst question and current gap

REA retains EVMole-reported terminal metadata in raw_result, but its JS binding leaves integer precision and non-text-key coverage unknown. A Solidity analyst needs a lossless account of the actual trailer and whether a supplied metadata JSON belongs to it.

Proposed outcome

Parse the terminal length and bounded CBOR region from exact selected bytecode; retain decoded-byte offsets, raw bytes and carrier identity.
Preserve integer precision, byte strings, unknown keys and unsupported CBOR values without converting them into guessed text. Report malformed, absent and ambiguous trailers distinctly.
Decode admitted solc version representations, retaining release versus prerelease/unknown forms and raw values.
Optionally bind a caller-selected local metadata JSON to the bytecode metadata commitment using the exact admitted content-addressing algorithm. Preserve unavailable or mismatched associations.
Treat source URLs/hashes as metadata; do not retrieve IPFS/Swarm/source content implicitly or call inferred metadata verified original source.

Acceptance and verification

Compiler-pinned owned fixtures cover metadata present, appendCBOR=false and bytecodeHash=none.
Synthetic trailers cover reordered/unknown/non-text keys, large integers, truncated CBOR and invalid terminal lengths.
Wrong supplied metadata and unknown commitment schemes stay mismatched/unverified.
CLI/MCP retain the same fields and source ranges; parsing bounds, cancellation and legacy EVM results remain intact.
Define one feature specification, one implementation plan and incremental tasks under docs/specs/solidity/cbor-metadata/ before implementation.

Scope and relationships

Offline caller-selected artifact inspection. Existing EVM interface recovery (PR #1051), retained delivery (PR #2308) and roadmap #972 are the foundations; this feature is independently scoped and does not reopen the entire roadmap. Parent language tracker: #2383. Use self-owned compiler fixtures and preserve provider/version provenance. New provider choices, if needed, follow CONTRIBUTING.md before substantial integration work.

Primary references

Solidity contract metadata

Originally created by @matbrgz on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2388 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Blockchain RE](https://img.shields.io/badge/domain-blockchain_RE-orange.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Analyst question and current gap REA retains EVMole-reported terminal metadata in raw_result, but its JS binding leaves integer precision and non-text-key coverage unknown. A Solidity analyst needs a lossless account of the actual trailer and whether a supplied metadata JSON belongs to it. ## Proposed outcome - Parse the terminal length and bounded CBOR region from exact selected bytecode; retain decoded-byte offsets, raw bytes and carrier identity. - Preserve integer precision, byte strings, unknown keys and unsupported CBOR values without converting them into guessed text. Report malformed, absent and ambiguous trailers distinctly. - Decode admitted solc version representations, retaining release versus prerelease/unknown forms and raw values. - Optionally bind a caller-selected local metadata JSON to the bytecode metadata commitment using the exact admitted content-addressing algorithm. Preserve unavailable or mismatched associations. - Treat source URLs/hashes as metadata; do not retrieve IPFS/Swarm/source content implicitly or call inferred metadata verified original source. ## Acceptance and verification - [ ] Compiler-pinned owned fixtures cover metadata present, appendCBOR=false and bytecodeHash=none. - [ ] Synthetic trailers cover reordered/unknown/non-text keys, large integers, truncated CBOR and invalid terminal lengths. - [ ] Wrong supplied metadata and unknown commitment schemes stay mismatched/unverified. - [ ] CLI/MCP retain the same fields and source ranges; parsing bounds, cancellation and legacy EVM results remain intact. - [ ] Define one feature specification, one implementation plan and incremental tasks under docs/specs/solidity/cbor-metadata/ before implementation. ## Scope and relationships Offline caller-selected artifact inspection. Existing EVM interface recovery (PR #1051), retained delivery (PR #2308) and roadmap #972 are the foundations; this feature is independently scoped and does not reopen the entire roadmap. Parent language tracker: #2383. Use self-owned compiler fixtures and preserve provider/version provenance. New provider choices, if needed, follow CONTRIBUTING.md before substantial integration work. ## Primary references - [Solidity contract metadata](https://docs.soliditylang.org/en/latest/metadata.html)

bsakaguchi added the

area: domain

enhancement

P2: medium

labels

2026-10-15 18:28:33 +00:00

bsakaguchi commented

2026-10-15 18:28:34 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 12, 2026):

Implementation & Triage Status Update

Summary (ELI5):
Extract and verify Solidity compiler metadata appended at the end of runtime/creation bytecode via CBOR encoding without data loss or heuristics.

Current State & Validation:

Branch feat/solidity-cbor-metadata contains:
- Lossless CBOR decoder parsing compiler-embedded payloads (ipfs, bzzr0, bzzr1, solc).
- Unit test suite (src/evm/SolidityMetadata.test.ts) verifying CBOR boundary lengths, version extraction across legacy (0.4.x - 0.5.x) and modern (0.8.x+) bytecodes.
- Exact offset isolation to prevent trailing swarm hashes from distorting opcode disassembly or instructions coverage.
Next Step:
- Format canonical spec under docs/specs/evm/cbor-metadata/{spec.md,plan.md,tasks.md} and submit the formal PR.

@matbrgz commented on GitHub (Oct 12, 2026): ### Implementation & Triage Status Update **Summary (ELI5):** Extract and verify Solidity compiler metadata appended at the end of runtime/creation bytecode via CBOR encoding without data loss or heuristics. **Current State & Validation:** 1. Branch `feat/solidity-cbor-metadata` contains: - Lossless CBOR decoder parsing compiler-embedded payloads (`ipfs`, `bzzr0`, `bzzr1`, `solc`). - Unit test suite (`src/evm/SolidityMetadata.test.ts`) verifying CBOR boundary lengths, version extraction across legacy (0.4.x - 0.5.x) and modern (0.8.x+) bytecodes. - Exact offset isolation to prevent trailing swarm hashes from distorting opcode disassembly or instructions coverage. 2. Next Step: - Format canonical spec under `docs/specs/evm/cbor-metadata/{spec.md,plan.md,tasks.md}` and submit the formal PR.

bsakaguchi referenced this issue

2026-10-16 21:16:18 +00:00

[PR #802] [CLOSED] fix(reconstruction): preserve unknown graph limitations #2252

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:42 +00:00