Depicted code hash is not the contract code hash

[cmichi]

The value which is shown as Code Hash is not actually the code hash, but instead the contract's Wasm bytecode.

This is what the UI shows:

This is how the contract bundle looks:

$ cat target/ink/delegator.contract | jq .                                     
{                                                                                                                                                              
  "metadataVersion": "0.1.0",                                                                                                                                  
  "source": {                                                                                                                                                  
    "hash": "0xfa28de816b7ca333f5258a60b5ee37404174609eb629265cfcf770f0d5c0688a",                                                                              
    "language": "ink! 3.0.0-rc3",                                                                                                                              
    "compiler": "rustc 1.53.0-nightly",                                                                                                                        
    "wasm": "0x0061736d…",
  },
  …
}

So using source.hash instead of source.wasm would be the fix.

(Note: In an ideal world the Canvas UI would compute the hash source.wasm by itself and assert hash(source.wasm) == source.hash.)

[statictype]

@cmichi @kwingram25 this happens in polkadot.js/api-contract and apparently has been always the case. should we change it for Canvas or in general?

[cmichi]

Could be that this field was not always available, but now it is, so yeah we should in general change it to always display the actual contract hash and not an excerpt of the contracts Wasm bytecode.

It would be even better to not use the source.hash field from the .contract file, but rather compute hash(source.wasm) and display the result of that. This way a user could be sure that the displayed hash always corresponds to what is to be submitted to the chain.

But I'm not sure if it is possible to do that, since AFAIU the type of hash which is used by the chain is generic and could be an arbitrary hashing algorithm. But maybe there is already some polkadot-js function for computing the hash?

But anyway, the easy fix would be to just use source.hash from the contract file.