How to add my project to the Ethereum Contracts List?

Submit a form via the GitHub issue template or send a pull request to update JSON files, ensuring they match the schemas. For future automation, add a `@custom:security-contact` natspec tag and verify on Sourcify.

Ethereum Contracts List vs Etherscan labels – which is better for security contacts?

Etherscan provides real-time on-chain labels, but the Contracts List focuses on community-verified project mappings with dedicated security emails, making it more reliable for vulnerability disclosure purposes.

What chains does the contracts list support?

It uses EIP155 chain IDs, so it supports any EVM-compatible network listed on chainlist.org, including Ethereum, Polygon, and Arbitrum, as organized in the contracts folder by chain ID.

How to find security contact info for a contract address?

Look up the contract by chain ID and address in the JSON files, which map to a project entry containing the `contacts.security` email. Tools can integrate this data for easier access.

Can I contribute to the contracts list as a developer?

Yes, by submitting pull requests to update JSON files or helping maintain the repository. Ensure contributions follow the schemas and include proof of project representation if needed.

Is the contracts list updated automatically with new deployments?

Not currently; automatic import from natspec tags is planned but not implemented, so updates rely on manual submissions by project teams or community members.

Open-Awesome

Smart Contract Security Registry

A public registry mapping Ethereum contract addresses to their projects and security contacts for transparency and vulnerability disclosure.

GitHub

139 stars40 forks0 contributors

What is Smart Contract Security Registry?

Ethereum Contracts List is a public registry that maps deployed smart contract addresses to their originating projects and security contacts. It solves the problem of anonymous contract interactions by providing transparency about which project a contract belongs to and how to contact them for security issues. The project aims to improve ecosystem security by facilitating responsible vulnerability disclosure.

Target Audience

Ethereum project teams who want to register their contracts for transparency and security purposes, and blockchain developers/users who need to identify contract ownership and security contacts.

Value Proposition

It provides a standardized, community-maintained alternative to proprietary contract labeling services, with a focus on security contact information that's critical for vulnerability reporting. The project is backed by major ecosystem players like OpenZeppelin and Dune Analytics.

Overview

List of contracts from known projects (work in progress)

Use Cases

Best For

Identifying which project a contract address belongs to during blockchain interactions
Finding security contact information for responsible vulnerability disclosure
Projects wanting to register their deployed contracts for transparency
Automatically adding security contacts via Solidity natspec tags
Building tools that need contract-to-project mapping data
Researchers analyzing contract deployments across Ethereum projects

Not Ideal For

Applications requiring real-time, on-chain verification of contract ownership without external registry lookups
Teams preferring proprietary, curated contract databases over community-sourced data
Projects needing a fully automated, zero-configuration solution for contract registration and updates

Pros & Cons

Pros

Standardized Security Contacts

Each project entry includes a dedicated `contacts.security` email in the JSON schema, as shown in the Uniswap example, ensuring a clear path for vulnerability disclosure.

Multi-Chain EVM Support

Organizes contracts by EIP155 chain IDs, covering Ethereum and other EVM-compatible networks, which allows broad ecosystem coverage as per the data format section.

Automated Registration Path

Supports future automatic addition via Solidity natspec tags (`@custom:security-contact`) and Sourcify verification, though the README notes this is not yet implemented.

Rich Project Metadata

Stores comprehensive details like websites, social links, and token information in project JSON files, enhancing transparency beyond just addresses.

Cons

Evolving Schema Risk

The README explicitly states the data schema may still change as it's a work in progress, which can break integrations and require frequent updates for dependent tools.

Manual Update Burden

Projects must actively submit info via GitHub forms or pull requests, and automatic import from natspec tags is not yet live, leading to potential data gaps and maintenance overhead.

Incomplete Automation

The promised automated registration via Sourcify is not implemented, so reliance on manual processes limits real-time data freshness and scalability.

Frequently Asked Questions

Related Projects

Building Secure Contracts

Guidelines and training material to write secure smart contracts

Stars2,478

Forks391

Last commit4 months ago

Simple Security Toolkit

A collection of practical security-focused guides and checklists for smart contract development

Stars1,235

Forks183

Last commit2 years ago

Solidity Patterns

A compilation of patterns and best practices for the smart contract programming language Solidity

Stars0

Forks0

Last commit

Security Pattern for Ethereum and Solidity

Google Sheets Checklists