Deployed bytecode matches signed release tag

Evidence summary #

Bridge2 source is on GitHub (verified on Arbiscan) but no signed release tags exist for Bridge2.sol — repository uses master-branch model without tagged releases. Bytecode-to-commit matching not verifiable without signed release tags. L1 binary is closed-source — no reproducibility possible.

Sources #

Methodology #

Determine whether the deployed runtime bytecode corresponds to a signed git tag in the protocol's repository.

See the full factor methodology and distribution across all protocols →