Verification

Every deployed Hookr contract holds verified source on Blockscout, and every one is a full match: the explorer recompiles the source and gets the deployed bytes back, CBOR metadata trailer included. None is a partial match, which is what the explorer reports when the code agrees and the trailer does not. Sourcify holds the same 16 addresses on chain 4663 as exact matches, creation and runtime bytecode both (https://sourcify.dev/server/v2/contract/4663/<address>).

The build is Solidity v0.8.26+commit.8a97fa7a through via-IR, the optimizer at 200 runs, evm_version = cancun, bytecode_hash = ipfs, CBOR metadata appended. The contract repository's foundry.toml is that profile, with its ten remappings written out rather than detected, because a contract's metadata records them and the metadata is hashed into the trailer.

To rebuild and compare a contract against its address:

git submodule update --init --recursive
forge build
cast code <address> --rpc-url https://rpc.mainnet.chain.robinhood.com

out/<file>.sol/<Contract>.json holds the runtime object to compare. For a contract that links libraries, write the addresses from the linked-library table into the placeholders that deployedBytecode.linkReferences locates; pinning the addresses in the compiler profile instead changes the metadata and the trailer stops matching. Zero the spans in deployedBytecode.immutableReferences on both sides, because those hold values fixed at construction rather than compiled bytes.

The last four rows predate the rest and carry the metadata of a build that embeds the source text instead of its hash, so reproducing their trailers takes use_literal_content = true. Their code is identical either way. The single immutable in each of the three libraries is its own address, which is how a library refuses a direct call.