Add mainnet cWBTC token-aggregation indexing, supply proof, and Etherscan verify scripts.

Wire live 0x2BBe3c… address into canonical tokens, pool catalog merge from mesh health, and bridge/cWBTC explorer verification helpers.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deployment/verify-all-networks-explorers.sh

@@ -42,6 +42,7 @@ else
 fi
 
 step "Ethereum Mainnet CCIP bridges" bash "$SCRIPT_DIR/verify-mainnet-etherscan.sh" || true
+step "Ethereum Mainnet CWMultiTokenBridgeL2" bash "$SCRIPT_DIR/verify-mainnet-cw-bridge-etherscan.sh" || true
 step "Ethereum Mainnet cW* (CompliantWrappedToken)" bash "$SCRIPT_DIR/verify-mainnet-cw-etherscan.sh" || true
 step "Multichain cW* (all CW*_* except MAINNET)" bash "$SCRIPT_DIR/verify-multichain-cw-etherscan.sh" || true
 step "Avalanche + Arbitrum WETH/CCIP bridges" bash "$SCRIPT_DIR/verify-deployed-contracts.sh" || true

scripts/deployment/verify-mainnet-cw-bridge-etherscan.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Verify Ethereum Mainnet CWMultiTokenBridgeL2 (CW_BRIDGE_MAINNET) on Etherscan.
+#
+# Constructor: (sendRouter, receiveRouter, feeToken) — read from chain if unset.
+#
+# Usage:
+#   cd smom-dbis-138 && ./scripts/deployment/verify-mainnet-cw-bridge-etherscan.sh
+#   ./scripts/deployment/verify-mainnet-cw-bridge-etherscan.sh --dry-run
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+DRY_RUN=false
+for a in "$@"; do
+  case "$a" in
+    --dry-run) DRY_RUN=true ;;
+  esac
+done
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT}"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi
+
+[[ -n "${ETHERSCAN_API_KEY:-}" ]] || {
+  echo "ETHERSCAN_API_KEY not set" >&2
+  exit 1
+}
+
+RPC="${ETHEREUM_MAINNET_RPC:-${ETH_MAINNET_RPC_URL:-https://ethereum-rpc.publicnode.com}}"
+BRIDGE="${CW_BRIDGE_MAINNET:-0x2bF74583206A49Be07E0E8A94197C12987AbD7B5}"
+
+fetch_creation_ctor() {
+  python3 - "$BRIDGE" "$ETHERSCAN_API_KEY" <<'PY'
+import json, sys, urllib.request
+bridge, api_key = sys.argv[1:3]
+url = (
+    "https://api.etherscan.io/v2/api?chainid=1&module=contract&action=getcontractcreation"
+    f"&contractaddresses={bridge}&apikey={api_key}"
+)
+with urllib.request.urlopen(url, timeout=30) as resp:
+    doc = json.load(resp)
+rows = doc.get("result") or []
+if not rows:
+    raise SystemExit("Etherscan getcontractcreation returned no rows")
+creation = (rows[0].get("creationBytecode") or "").lower().removeprefix("0x")
+if len(creation) < 192:
+    raise SystemExit("creationBytecode too short")
+# constructor args are last 3 x 32-byte words
+args_hex = creation[-192:]
+words = [args_hex[i : i + 64] for i in range(0, 192, 64)]
+for w in words:
+    print("0x" + w[-40:])
+PY
+}
+
+SEND="${CW_BRIDGE_MAINNET_SEND_ROUTER:-}"
+RECV="${CW_BRIDGE_MAINNET_RECEIVE_ROUTER:-}"
+FEE="${CW_BRIDGE_MAINNET_FEE_TOKEN:-}"
+if [[ -z "$SEND" || -z "$RECV" || -z "$FEE" ]]; then
+  mapfile -t _CTOR_ADDRS < <(fetch_creation_ctor 2>/dev/null || true)
+  if [[ ${#_CTOR_ADDRS[@]} -eq 3 ]]; then
+    SEND="${_CTOR_ADDRS[0]}"
+    RECV="${_CTOR_ADDRS[1]}"
+    FEE="${_CTOR_ADDRS[2]}"
+    echo "Using deployment-time constructor args from Etherscan creation tx"
+  else
+    SEND="$(cast call "$BRIDGE" 'sendRouter()(address)' --rpc-url "$RPC")"
+    RECV="$(cast call "$BRIDGE" 'receiveRouter()(address)' --rpc-url "$RPC")"
+    FEE="$(cast call "$BRIDGE" 'feeToken()(address)' --rpc-url "$RPC")"
+    echo "WARN: using live on-chain router fields (may differ from deploy immutables)" >&2
+  fi
+fi
+
+CTOR="$(cast abi-encode 'constructor(address,address,address)' "$SEND" "$RECV" "$FEE")"
+
+echo "=== Verify CWMultiTokenBridgeL2 (CW_BRIDGE_MAINNET) ==="
+echo "  bridge=$BRIDGE"
+echo "  sendRouter=$SEND"
+echo "  receiveRouter=$RECV"
+echo "  feeToken=$FEE"
+
+export FOUNDRY_SRC="contracts/bridge,contracts/interfaces"
+export FOUNDRY_OUT="out/scopes/bridge"
+export FOUNDRY_CACHE_PATH="cache/scopes/bridge"
+
+if $DRY_RUN; then
+  echo "forge verify-contract --chain-id 1 --num-of-optimizations 200 --via-ir \\"
+  echo "  --constructor-args \"$CTOR\" --etherscan-api-key \"\$ETHERSCAN_API_KEY\" \\"
+  echo "  \"$BRIDGE\" contracts/bridge/CWMultiTokenBridgeL2.sol:CWMultiTokenBridgeL2"
+  exit 0
+fi
+
+bash "$PROJECT_ROOT/scripts/forge/scope.sh" build bridge -q
+
+set +e
+out="$(forge verify-contract \
+  --chain-id 1 \
+  --num-of-optimizations 200 \
+  --via-ir \
+  --constructor-args "$CTOR" \
+  --etherscan-api-key "$ETHERSCAN_API_KEY" \
+  "$BRIDGE" \
+  "contracts/bridge/CWMultiTokenBridgeL2.sol:CWMultiTokenBridgeL2" 2>&1)"
+rc=$?
+set -e
+echo "$out"
+if [[ $rc -eq 0 ]] || echo "$out" | grep -qiE 'already verified|Contract source code already verified'; then
+  echo "OK: https://etherscan.io/address/$BRIDGE#code"
+  exit 0
+fi
+exit "$rc"

scripts/deployment/verify-mainnet-cwbtc-etherscan.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Verify mainnet cWBTC (CompliantWrappedToken) on Etherscan and write status JSON.
+#
+# Usage:
+#   cd smom-dbis-138 && ./scripts/deployment/verify-mainnet-cwbtc-etherscan.sh
+#   ./scripts/deployment/verify-mainnet-cwbtc-etherscan.sh --dry-run
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PROXMOX="$(cd "$PROJECT_ROOT/.." && pwd)"
+REPORT="${PROXMOX}/reports/status/cwbtc-mainnet-etherscan-verify-latest.json"
+cd "$PROJECT_ROOT"
+
+DRY_RUN=false
+for a in "$@"; do
+  case "$a" in
+    --dry-run) DRY_RUN=true ;;
+  esac
+done
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT}"
+fi
+
+ADDR="${CWBTC_MAINNET:-0x2BBe3c809386FA5349EB2da31E0848ee9f54EE59}"
+ADMIN="${CW_VERIFY_ADMIN:-}"
+if [[ -z "$ADMIN" && -n "${PRIVATE_KEY:-}" ]]; then
+  ADMIN="$(cast wallet address --private-key "$PRIVATE_KEY")"
+fi
+[[ -n "${ETHERSCAN_API_KEY:-}" ]] || { echo "ETHERSCAN_API_KEY required" >&2; exit 1; }
+[[ -n "$ADMIN" ]] || { echo "CW_VERIFY_ADMIN or PRIVATE_KEY required" >&2; exit 1; }
+
+CTOR="$(cast abi-encode 'constructor(string,string,uint8,address)' 'Wrapped cBTC' 'cWBTC' 8 "$ADMIN")"
+
+echo "=== Verify cWBTC on Etherscan ==="
+echo "  address=$ADDR admin=$ADMIN"
+
+export FOUNDRY_SRC="contracts/tokens,contracts/interfaces"
+export FOUNDRY_OUT="out/scopes/tokens"
+export FOUNDRY_CACHE_PATH="cache/scopes/tokens"
+
+if $DRY_RUN; then
+  echo "forge verify-contract --chain-id 1 --num-of-optimizations 200 --via-ir \\"
+  echo "  --constructor-args \"$CTOR\" --etherscan-api-key \"\$ETHERSCAN_API_KEY\" \\"
+  echo "  \"$ADDR\" contracts/tokens/CompliantWrappedToken.sol:CompliantWrappedToken"
+  exit 0
+fi
+
+bash "$PROJECT_ROOT/scripts/forge/scope.sh" build tokens -q
+
+status="failed"
+msg=""
+set +e
+out="$(forge verify-contract \
+  --chain-id 1 \
+  --num-of-optimizations 200 \
+  --via-ir \
+  --constructor-args "$CTOR" \
+  --etherscan-api-key "$ETHERSCAN_API_KEY" \
+  "$ADDR" \
+  "contracts/tokens/CompliantWrappedToken.sol:CompliantWrappedToken" 2>&1)"
+rc=$?
+set -e
+echo "$out"
+if [[ $rc -eq 0 ]] || echo "$out" | grep -qiE 'already verified|Contract source code already verified'; then
+  status="verified"
+  msg="ok"
+else
+  msg="${out:0:500}"
+  exit "$rc"
+fi
+
+mkdir -p "$(dirname "$REPORT")"
+python3 - "$REPORT" "$ADDR" "$ADMIN" "$status" "$msg" <<'PY'
+import datetime, json, sys
+path, addr, admin, status, msg = sys.argv[1:6]
+doc = {
+    "generatedAt": datetime.datetime.utcnow().replace(microsecond=0).isoformat() + "Z",
+    "chainId": 1,
+    "symbol": "cWBTC",
+    "address": addr,
+    "constructorAdmin": admin,
+    "etherscanUrl": f"https://etherscan.io/address/{addr}",
+    "etherscanCodeUrl": f"https://etherscan.io/address/{addr}#code",
+    "verifyStatus": status,
+    "message": msg,
+    "tokenLists": [
+        "token-lists/lists/ethereum-mainnet.tokenlist.json",
+        "smom-dbis-138/services/token-aggregation/config/token-lists/ethereum-mainnet.tokenlist.json",
+    ],
+}
+open(path, "w", encoding="utf-8").write(json.dumps(doc, indent=2) + "\n")
+print(path)
+PY
+
+echo "Published status: $REPORT"
+echo "Etherscan: https://etherscan.io/address/$ADDR#code"