verify/: bytecode-proven deployment verification reports

.github/workflows/deployed-code-verification.yml

@@ -0,0 +1,61 @@
+name: Deployed Code Verification
+
+on:
+  pull_request:
+    paths:
+      - 'addresses/**'
+      - 'verify/**'
+  workflow_dispatch:
+
+jobs:
+  deployed-code-verification:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/checkout@v4
+        with:
+          repository: euler-xyz/euler-verifier
+          # Engine pinned by commit SHA; bump deliberately via PR.
+          ref: 534dcf9eda294a46c208c7b8767fdd76dfc2fd29
+          path: .verifier
+
+      - uses: pnpm/action-setup@v4
+        with:
+          package_json_file: .verifier/package.json
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: .verifier/pnpm-lock.yaml
+      - uses: foundry-rs/foundry-toolchain@v1
+
+      - run: pnpm install --frozen-lockfile
+        working-directory: .verifier
+
+      - name: Validate manifests (schema, SHA-only pins, audits integrity)
+        run: pnpm tsx src/validate-manifests.ts --manifest $GITHUB_WORKSPACE/verify/manifest.json --audits $GITHUB_WORKSPACE/verify/audits.json
+        working-directory: .verifier
+
+      - name: Completeness (every deployed address has a manifest entry)
+        run: pnpm tsx src/check-completeness.ts --manifest $GITHUB_WORKSPACE/verify/manifest.json --addresses $GITHUB_WORKSPACE/addresses
+        working-directory: .verifier
+
+      - name: Determine changed entries
+        id: changed
+        run: |
+          git fetch --no-tags --depth=1 origin $GITHUB_BASE_REF
+          CHAINS=$(git diff --name-only origin/$GITHUB_BASE_REF...HEAD -- addresses verify/manifest.json | grep -oE 'addresses/[0-9]+' | grep -oE '[0-9]+' | sort -u | paste -sd, -)
+          echo "chains=$CHAINS" >> $GITHUB_OUTPUT
+          echo "changed chains: ${CHAINS:-none}"
+
+      - name: Bytecode-verify changed chains
+        if: steps.changed.outputs.chains != ''
+        env:
+          CHAINS: ${{ steps.changed.outputs.chains }}
+        run: |
+          set -e
+          for c in ${CHAINS//,/ }; do
+            pnpm verify --manifest $GITHUB_WORKSPACE/verify/manifest.json --addresses $GITHUB_WORKSPACE/addresses --chain "$c" --no-explorer
+          done
+        working-directory: .verifier

README.md

@@ -0,0 +1,42 @@
+# euler-interfaces
+
+Canonical addresses, ABIs, and interface definitions for the deployed Euler
+protocol contracts across all supported chains.
+
+## ✅ Deployed Code Verification
+
+Every security-relevant Euler contract is **verified at the bytecode level**:
+the on-chain runtime code is proven equal to a build of an exact, recorded
+source commit — block explorers are never in the trust path — and each
+deployment is diffed against its component's most recent **audited baseline**,
+so any code beyond audited revisions is visible as a real diff.
+
+**[Browse the per-chain verification reports →](verify/README.md)**
+
+- [`verify/manifest.json`](verify/manifest.json) — source provenance for every
+  contract (repo + commit SHA + build profile), bytecode-proven
+- [`verify/audits.json`](verify/audits.json) — the audit registry backing the
+  baselines
+- [`verify/baselines.json`](verify/baselines.json) — one audited baseline per
+  component, with derivations
+- Reports are named by chain ID (e.g. [`verify/1.md`](verify/1.md) for
+  Ethereum mainnet) and are regenerated by CI whenever addresses or
+  verification inputs change; verification is a required gate on such PRs.
+
+Anyone can reproduce the proofs with [euler-verifier](https://github.com/euler-xyz/euler-verifier)
+using only public RPC endpoints — no API keys or secrets required.
+
+## Layout
+
+| Path | Contents |
+|------|----------|
+| `addresses/<chainId>/` | Deployed contract addresses per chain |
+| `abis/` | Contract ABIs |
+| `interfaces/` | Solidity interface definitions |
+| `verify/` | Bytecode verification reports and provenance manifests |
+| `EulerChains.json`, `chains.js` | Supported chain metadata |
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for the disclosure policy, and the
+[verification reports](verify/README.md) for what is deployed where.