Verifying Proxy Contracts

Works on: Virtual Environments and public networks (mainnets and testnets). The same plugin handles both; point it at the right network in hardhat.config.ts.

This guide will walk you through proxy contract verification using @tenderly/hardhat-tenderly.

Requirements

Automatic proxy verification works out of the box on @tenderly/hardhat-tenderly:

>= 1.10.0 (Ethers 5 line)
>= 2.1.0 (Ethers 6 line)

npm update @tenderly/hardhat-tenderly

It only works when you deploy proxies with @openzeppelin/hardhat-upgrades. Hardhat Ignition is not supported for proxy verification yet. If you’re on a lower plugin version and can’t upgrade, use the manual workaround below.

Automatic verification

The plugin verifies three proxy patterns: TransparentUpgradeableProxy, UUPSUpgradeableProxy, and BeaconProxy.

Workaround for lower versions

When using @tenderly/hardhat-tenderly at versions < 1.10.0 and < 2.1.0, this workaround will enable automatic verification. You need to verify the following:

The proxy contract (e.g. OpenZeppelin’s proxies)
Implementation behind the proxy
Any dependencies the implementation has
New implementation instances deployed with upgrades

The verification process varies depending on the proxy contract type and the implementation.

Overview

In this guide, we’ll use an example Hardhat project and the @tenderly/hardhat-tenderly plugin to demonstrate the verification of OpenZeppelin’s UUPSUpgradeable, TransparentUpgradeableProxy, and BeaconProxy alternatives.

Proxy contracts need to be verified manually. Turn off automatic verification like so:

example.ts

// use manual verification
tenderly.setup({ automaticVerifications: false });

To obtain the address of the deployed implementation, use the @openzeppelin/upgrades-core package and getImplementationAddress function. Verifying the proxy implementation is usually straightforward; verify it just like any other contract.

example.ts

await tenderly.verify({
  // the new implementation contract
  name: 'VaultV2',
  // the address where implementation is deployed
  address: await getImplementationAddress(ethers.provider, await proxy.getAddress()),
});

To verify the proxy instance, you need to complete these two preliminary steps:

Load the exact smart contract of the proxy depending on the type of proxy you’re using, so it gets compiled. You’ll need to import the proxy contracts through the compiler by creating a dummy .sol file.
Modify hardhat.config.ts to specify the settings OpenZepplin contracts were compiled with.

Once these steps are completed, you can proceed to verify the proxy just as you would any other contract.

example.ts

await tenderly.verify({
  name: 'ERC1967Proxy', // or TransparentUpgradeableProxy or BeaconProxy
  address: await proxy.getAddress(),
});

Verify by proxy type

These code samples show how to verify the implementation and the proxy for OpenZeppelin’s three proxy patterns. The examples use a proxied Vault contract that references an ERC-20 token (TToken).

UUPS proxy

To verify the UUPS proxy and the underlying information, call the hardhat-tenderly plugin twice:

To verify the implementation, you need to provide the following:

name of your proxied contract (in our case Vault)
Address where the contract was deployed using the getImplementationAddress method from @openzeppelin/upgrades-core.

To verify the proxy, provide the following:

ERC1967Proxy as the proxy contract name
Address of the proxy proxy.address

example.ts

await tenderly.verify(
  {
    name: 'Vault',
    address: await getImplementationAddress(ethers.provider, await proxy.getAddress()),
  },
  {
    name: 'ERC1967Proxy',
    address: await proxy.getAddress(),
  },
);

Complete Code Sample

Here’s a complete Hardhat test that does the following:

Deploys the TToken (needed for the vault)
Deploys Vault as a proxy, initialized with the TToken contract
Verifies the proxy (ERC1967Proxy) instance deployed at await proxy.getAddress()
Verifies the implementation instance Vault, deployed at getImplementationAddress(ethers.provider, await proxy.getAddress())
Upgrades the proxy to VaultV2

example.ts

describe('Vault', () => {
  it('uups proxy deployment and verification', async () => {
    const VaultFactory = await ethers.getContractFactory('Vault');
    const TokenFactory = await ethers.getContractFactory('TToken');

    let token = await ethers.deployContract('TToken');
    token = await token.waitForDeployment();
    const tokenAddress = await token.getAddress();

    await tenderly.verify({
      name: 'TToken',
      address: tokenAddress,
    });

    let proxy = await upgrades.deployProxy(VaultFactory, [tokenAddress], {
      kind: 'uups',
    });
    await proxy.waitForDeployment();
    const proxyAddress = await proxy.getAddress();

    console.log('Deployed UUPS ', {
      proxy: proxyAddress,
      implementation: await getImplementationAddress(ethers.provider, proxyAddress),
    });

    await tenderly.verify(
      {
        name: 'Vault',
        address: await getImplementationAddress(ethers.provider, proxyAddress),
      },
      {
        name: 'ERC1967Proxy',
        address: proxyAddress,
      },
    );

    // upgrade
    const vaultV2Factory = await ethers.getContractFactory('VaultV2');
    proxy = (await upgrades.upgradeProxy(proxy, vaultV2Factory, {
      kind: 'uups',
    })) as Vault;

    await proxy.waitForDeployment();

    console.log('Upgraded UUPS ', {
      proxy: proxyAddress,
      implementation: await getImplementationAddress(ethers.provider, proxyAddress),
    });

    await tenderly.verify({
      name: 'VaultV2',
      address: await getImplementationAddress(ethers.provider, proxyAddress),
    });
  });
});

Transparent proxy

To verify the UUPS proxy and the underlying information, call hardhat-tenderly while passing two contracts: Vault for the implementation, and TransparentUpgradeableProxy for the proxy itself.

example.ts

await tenderly.verify(
  {
    name: 'Vault',
    address: await getImplementationAddress(ethers.provider, await proxy.getAddress()),
  },
  {
    name: 'TransparentUpgradeableProxy',
    address: await proxy.getAddress(),
  },
);

To verify the implementation, provide the following:

name of your proxied contract (in our case Vault)
Address where the contract was deployed, using the getImplementationAddress method from @openzeppelin/upgrades-core.

To verify the proxy, provide the following:

TransparentUpgradeableProxy as the proxy contract name
Address of the proxy await proxy.getAddress()

Complete Code Sample

example.ts

describe('Vault', () => {
  it('transparent upgradable proxy deployment and verification', async () => {
    const VaultFactory = await ethers.getContractFactory('Vault');
    const TokenFactory = await ethers.getContractFactory('TToken');

    let token = await ethers.deployContract('TToken');
    token = await token.waitForDeployment();
    const tokenAddress = await token.getAddress();

    await tenderly.verify({
      name: 'TToken',
      address: tokenAddress,
    });

    let proxy = await upgrades.deployProxy(VaultFactory, [tokenAddress], {
      kind: 'transparent',
    });
    await proxy.waitForDeployment();
    const proxyAddress = await proxy.getAddress();

    console.log('Deployed transparent', {
      proxy: proxyAddress,
      implementation: await getImplementationAddress(ethers.provider, proxyAddress),
    });

    await tenderly.verify(
      {
        name: 'Vault',
        address: await getImplementationAddress(ethers.provider, proxyAddress),
      },
      {
        name: 'TransparentUpgradeableProxy',
        address: proxyAddress,
      },
    );

    // upgrade
    const vaultV2Factory = await ethers.getContractFactory('VaultV2');

    proxy = (await upgrades.upgradeProxy(proxy, vaultV2Factory, {
      kind: 'transparent',
    })) as Vault;

    await proxy.waitForDeployment();

    console.log('Upgraded transparent ', {
      proxy: proxyAddress,
      implementation: await getImplementationAddress(ethers.provider, proxyAddress),
    });

    await tenderly.verify({
      name: 'VaultV2',
      address: await getImplementationAddress(ethers.provider, proxyAddress),
    });
  });
});

Beacon proxy

To verify the Beacon proxy and the underlying information, you have to verify two contracts: the Vault (implementation) and OpenZepplin’s UpgradableBeacon:

example.ts

await tenderly.verify(
  {
    name: 'Vault',
    address: await getImplementationAddressFromBeacon(ethers.provider, await beacon.getAddress()),
  },
  {
    name: 'UpgradeableBeacon',
    address: await beacon.getAddress(),
  },
);

Complete Code Sample

example.ts

describe('Vault', () => {
  it('beacon proxy deployment and verification', async () => {
    const VaultFactory = await ethers.getContractFactory('Vault');
    const TokenFactory = await ethers.getContractFactory('TToken');

    let token = await ethers.deployContract('TToken');
    token = await token.waitForDeployment();
    const tokenAddress = await token.getAddress();

    await tenderly.verify({
      name: 'TToken',
      address: tokenAddress,
    });

    let beacon = (await upgrades.deployBeacon(VaultFactory)) as UpgradeableBeacon;

    await beacon.waitForDeployment();
    const beaconAddress = await beacon.getAddress();

    let vault = await upgrades.deployBeaconProxy(beacon, VaultFactory, [tokenAddress], {
      initializer: 'initialize',
    });
    await vault.waitForDeployment();

    console.log('Deployed beacon ', {
      proxy: beaconAddress,
      implementation: await getImplementationAddressFromBeacon(ethers.provider, beaconAddress),
      beacon: beaconAddress,
    });

    await tenderly.verify(
      {
        name: 'Vault',
        address: await getImplementationAddressFromBeacon(ethers.provider, beaconAddress),
      },
      {
        name: 'UpgradeableBeacon',
        address: beaconAddress,
      },
    );

    const vaultV2Factory = await ethers.getContractFactory('VaultV2');

    // upgrade
    vault = await upgrades.deployBeaconProxy(beacon, vaultV2Factory, [tokenAddress]);

    await upgrades.upgradeBeacon(beaconAddress, vaultV2Factory, {});

    console.log('Upgraded beacon ', {
      proxy: beaconAddress,
      implementation: await getImplementationAddressFromBeacon(ethers.provider, beaconAddress),
      beacon: beaconAddress,
    });

    await tenderly.verify({
      name: 'VaultV2',
      address: await getImplementationAddressFromBeacon(ethers.provider, beaconAddress),
    });
  });
});

Getting Started

Simulator

Console

Monitor

Node RPC

Account & Settings

Verifying Proxy Contracts

Requirements

Automatic verification

Workaround for lower versions

Overview

Verify by proxy type

UUPS proxy

Complete Code Sample

Transparent proxy

Complete Code Sample

Beacon proxy

Complete Code Sample

​Requirements

​Automatic verification

​Workaround for lower versions

​Overview

​Verify by proxy type

​UUPS proxy

​Complete Code Sample

​Transparent proxy

​Complete Code Sample

​Beacon proxy

​Complete Code Sample

Requirements

Automatic verification

Workaround for lower versions

Overview

Verify by proxy type

UUPS proxy

Complete Code Sample

Transparent proxy

Complete Code Sample

Beacon proxy

Complete Code Sample