Verify our contracts

1. GM custody

GMContractCustodyV5 — holds the draw funds and implements commitment, settlement and the bound Pons integrations.

Deployed address

0x9f54c5b7372f4920368ed165f00de643bf5f5d73 ↗

Deployed runtime

8,155 bytes · Captured runtime hex

SHA256 of decoded runtime bytes

4413a71eeeb5212c58c1c4684f8c7abe541e2df3c0f1daafba85149ff8e50ee3

Deployment transaction · block 64454830

0x630bc658e63e5a28b5b2970020dcc9b1b2f78eae4b3fb039bf85ba787a7ebb6a ↗

Source

GMContractCustodyV5.sol + GMContractCustody.sol

The rebuild fills 41 exact compiler slots across 10 immutable groups from the declared bindings, then compares the entire runtime. It does not ignore immutable regions. Exact immutable values · ABI, creation code, runtime templates and compiler slot map.

2. Drand quicknet verifier

GMDrandQuicknetVerifier — the stateless BLS verifier called by custody, with the quicknet key and chain hash in source. It has no immutable slots.

Deployed address

0x567a4a4e8aae79f4068fd65495e4fc465fe1c856 ↗

Deployed runtime

4,456 bytes · Captured runtime hex

SHA256 of decoded runtime bytes

e207cf195489a91e23ef50bd7ea6b4106ac086b5a7e42aa2e42871651da02815

Source & dependency

GMDrandQuicknetVerifier.sol, BLS2.sol and Precompiles.sol

bls-solidity commit 9e10df92d631fab9c46f0ce9cd5c445f857bedcb · MIT license · Original provenance. The BLS dependency is experimental and unaudited. Source matching is not a cryptography audit.

Reproduce the build

Solidity 0.8.34+commit.80d5c536, optimizer 200 runs, EVM cancun. Exact standard JSON settings, source names and embedded sources: solc-input.json. Compiler provenance: frozen official build entry.

Requires Python 3.9+ and the exact Linux x86-64 solc binary (not bundled); live reads also use curl. No pip/npm packages. The README includes compiler acquisition and independent provenance checks. A fresh-machine installation is not claimed.

In the extracted gm-contract-verification-kit directory, with your pinned compiler path:

python3 -I -B verify.py --solc /path/to/solc-0.8.34

This recompiles the sources and checks the included captured runtimes. Live chain: Not checked in offline mode. To compare against your own chain-4663 HTTPS RPC, set GM_RPC_URL locally, then run:

python3 -I -B verify.py --solc /path/to/solc-0.8.34 --rpc-env GM_RPC_URL

Only read calls are allowed. Wrong chain, corrupt source/input, wrong compiler, changed immutable value, any runtime-byte mismatch or unavailable RPC means failure (exit 1), not a partial pass. A successful live run prints the actual block number/hash checked.

The included snapshot was read at block 64473663 on 2026-09-16 at 11:29 UTC. It is historical evidence, not a continuously refreshed live badge. The provider's block hash was re-read; provider responses are not independent consensus proofs.

What the immutable bindings mean

The “SAFE” names do not establish multisig/Safe implementation or key control. Read all exact addresses and values.

What this does not prove

• Size is not proof. Byte count alone says nothing about correctness. The CLI checks exact rebuilt bytes, not just size.
• A same-origin hash is not independent trust. Someone controlling this website could replace its source, kit, script and checksum together. Review the source and compiler provenance independently and compare with providers you trust.
• Verified source/runtime is not a guarantee of no bugs. It does not certify safe economics, permissions, cryptography, production readiness, current balances or operator state. External Pons/USDG implementations are not audited by this kit.
• No full holder eligibility proof. This does not establish every eligible holder was included or certify any particular draw. Per-round verification is separate and has its own limits.

Explorer links are navigation, not explorer verification badges. The drand verifier is identified by exact address/runtime here, not an asserted original deployment receipt. Source and license notices.