How can I prove a deployment matches the source code?
“Matches” is a spectrum. Be honest about what you checked.
1. The problem
Teams say “this repo is what’s on chain.” Reviewers need a re-checkable link: network, address, code present, and preferably bytecode or explorer verification — not only a screenshot.
2. What QPF-style verification does
- Confirm network identity
- Confirm code at claimed addresses
- Label documentation match vs drift
- Mark full formal source-to-bytecode audit as out of scope unless expanded
Labels: verified · unverified · gated · unknown. Unknown is allowed.
3. Real example
QPF publishes addresses and a public portal. You can re-run eth_chainId and eth_getCode without trusting marketing.