Verify a Smart Contract

[fabrice]

@bara

For security reasons it suffices to check the application code hash with an expected one?

Yes, both for approval and clear program

@bara

I would prefer to do something more like this: use a stateless contract to sign my applications and then accept only signed applications from the indexer, but I don’t know if it makes sense compared to checking the application code.

I see three options:

• create a single big smart contract where each trip is actually a fresh new account that is rekeyed to the application account and that stores trip details. So now you have two types of accounts with local storage: the trip ones that are rekeyed to the application account (and used instead of global storage), and the current local storage account you’re using. See [NFT marketplace] general smart contract architecture question - #2 by fabrice
• create a stateless contract (in contract account mode: Modes of use - Algorand Developer Portal) that would actually be the creator of the application and issue the application creation transaction. The stateless contract would verify the hash in the application transaction. You would then just need to check the creator of the application. Since the application creation transaction increases minimum balance and cost a transaction fee, the stateless smart contract can require to be called with a transaction paying for the above.
• create a factory stateful smart contract: smart contracts can now issue any inner transaction and hence can create smart contracts from their application account (not to be confused with contract account that exists only for stateless contract). It works very similarly to the option above but you may hit size limits of code.