Summary
When a contract is verified on Sourcify (which supports Arc Mainnet, chain 5042, natively), Sourcify attempts to push the verified result to the chain's Blockscout instance at explorer.arc.io. That push is blocked by the Cloudflare WAF with a 403 response, so the Arc explorer never receives the verification data automatically.
Steps to reproduce
- Deploy any Solidity contract to Arc Mainnet (chain 5042).
- Verify it on Sourcify:
POST https://sourcify.dev/server/v2/verify/metadata/5042/{address} with the compiler metadata and source files.
- Sourcify returns
{"verificationStatus":"perfect"} — the contract is verified on Sourcify.
- Inspect the job result via
GET https://sourcify.dev/server/v2/verify/{verificationId}:
{
"isJobCompleted": true,
"externalVerifications": {
"blockscout": {
"error": "Explorer verification request failed (403): <!DOCTYPE html>...<title>Just a moment...</title>..."
}
}
}The Just a moment... page is a Cloudflare managed-challenge response.
Impact
forge verify-contract --verifier blockscout fails silently (returns Cloudflare HTML, parses as JSON error).forge verify-contract --verifier sourcify submits successfully to Sourcify but the Arc explorer never syncs the contract name — contracts display as raw addresses.- Every developer deploying to Arc Mainnet hits this wall. The workaround (manual browser verification via the explorer UI) works but breaks CI/CD pipelines.
Suggested fix
Allow Sourcify's outbound IPs to reach explorer.arc.io/api through the Cloudflare WAF, or configure the Arc Blockscout instance to poll Sourcify on a schedule (pull instead of push) for chain 5042 contracts. Sourcify's pull-based sync is described in their docs.
Environment
- Arc Mainnet chain ID: 5042
- Sourcify server:
https://sourcify.dev/server (v2.1.0)
- Explorer:
https://explorer.arc.io
- Cloudflare Ray IDs observed:
a3c9ec44ed2831f9, a3c9edf82be631f9
Summary
When a contract is verified on Sourcify (which supports Arc Mainnet, chain 5042, natively), Sourcify attempts to push the verified result to the chain's Blockscout instance at
explorer.arc.io. That push is blocked by the Cloudflare WAF with a 403 response, so the Arc explorer never receives the verification data automatically.Steps to reproduce
POST https://sourcify.dev/server/v2/verify/metadata/5042/{address}with the compiler metadata and source files.{"verificationStatus":"perfect"}— the contract is verified on Sourcify.GET https://sourcify.dev/server/v2/verify/{verificationId}:{ "isJobCompleted": true, "externalVerifications": { "blockscout": { "error": "Explorer verification request failed (403): <!DOCTYPE html>...<title>Just a moment...</title>..." } } }The
Just a moment...page is a Cloudflare managed-challenge response.Impact
forge verify-contract --verifier blockscoutfails silently (returns Cloudflare HTML, parses as JSON error).forge verify-contract --verifier sourcifysubmits successfully to Sourcify but the Arc explorer never syncs the contract name — contracts display as raw addresses.Suggested fix
Allow Sourcify's outbound IPs to reach
explorer.arc.io/apithrough the Cloudflare WAF, or configure the Arc Blockscout instance to poll Sourcify on a schedule (pull instead of push) for chain 5042 contracts. Sourcify's pull-based sync is described in their docs.Environment
https://sourcify.dev/server(v2.1.0)https://explorer.arc.ioa3c9ec44ed2831f9,a3c9edf82be631f9