# Bazarr ERC-1155 factory source code

This package contains `ZoraCreator1155FactoryImpl`, its UUPS proxy and every Solidity dependency needed to reproduce and verify the deployed Bazarr ERC-1155 factory. It does not contain the Bazarr application or unrelated launchpad contracts.

**Status:** source, compiler output, deployment transaction inputs, active EIP-1967 implementation, constructor immutables, implementation runtime and proxy runtime are verified against Quai mainnet. The reproducible proof is in `reference/onchain-verification.json` and can be rerun with `npm run verify:onchain`.

## Contents

- `sources/`: 53 exact source files extracted from the factory and proxy metadata, preserving import names and SPDX headers.
- `COPYING`: the complete AGPL-3.0 license.
- `LICENSES/` and `THIRD_PARTY_NOTICES.md`: third-party licenses and attribution.
- `compiler-settings.json`: Solidity compiler settings.
- `source-manifest.json`: source paths, SHA-256 checksums and original metadata keccak256 hashes.
- `reference/`: factory and proxy artifacts, immutable offsets, local verification and mainnet verification evidence.
- `deployment/mainnet.json`: public addresses, constructor arguments, transaction evidence and Quai grinding salts.
- `scripts/verify.cjs`: compilation and byte-for-byte comparison with the references.
- `scripts/verify-onchain.cjs`: read-only verification of the active mainnet deployment.
- `scripts/prepare-deployment.cjs` and `scripts/prepare-upgrade.cjs`: reproducible deployment input and upgrade calldata generation without signing or broadcasting.
- `DEPLOYMENT.md`: deployment, verification and upgrade workflow.

## Licensing

The combined factory build includes Solmate under AGPL-3.0-only and is provided under AGPL-3.0-only. MIT files retain their original licenses and copyright notices. This package's license does not automatically apply to the separate Bazarr frontend, backend, indexer or other independent components.

You may study, modify and redistribute the covered code under the included licenses. When distributing covered code or making modified network versions available, comply with the applicable AGPL requirements, including provision of Corresponding Source. No warranty is provided. See `COPYING` and `THIRD_PARTY_NOTICES.md`.

## Reproduce the build

Node.js 18 or later and npm are required. Solidity dependencies are included; no wallet, RPC connection or private key is needed.

```sh
npm ci --ignore-scripts
npm run verify
npm run prepare:deployment
npm run verify:onchain
```

The build uses exactly solc-js **0.8.17+commit.8df45f5f**, optimizer runs 50, viaIR, EVM London and literal metadata with an IPFS hash. The script writes the standard JSON compiler input, compilation results and verification report to `build/`. It checks source SHA-256 hashes, factory and proxy ABI, metadata, creation bytecode, runtime bytecode and immutable offsets. Changing a source file causes verification to fail. To build your own modified version, use `standard-input.json` with your changes and do not present it as the original release.

For offline verification with an existing solc 0.8.17 installation, set `SOLC_MODULE` to its absolute module path and run `node scripts/verify.cjs`. This override is not needed for the standard npm installation.

## Mainnet verification

The factory constructor takes four addresses: the collection implementation `zora1155Impl`, `merkleMinter`, `fixedPriceMinter` and `redeemMinterFactory`. These are stored as immutables, so deployed runtime bytecode differs from the template's zero placeholders. The verifier inserts the published constructor values at the compiler-provided immutable offsets and requires an exact match with the active implementation runtime.

The verifier independently reads the EIP-1967 implementation slot from the proxy, verifies both deployment transaction inputs and receipts, checks exact implementation and proxy runtime bytecode, and calls the public owner, dependency, name and version getters. The committed mainnet configuration includes every public value needed to repeat those checks. See `DEPLOYMENT.md`.

## Provenance and changes

The base package is Zora ERC-1155 2.13.2. Included Solidity sources match the deployed artifacts' literal metadata; Solidity code was not edited during packaging. The build used Quai-specific compiler settings and `quais` 1.0.0-alpha.36 address grinding. Release structure, manifest, documentation and verification/preparation scripts were added on September 30, 2026. Version numbers provide context; the included files, hashes, transaction evidence and compiler settings are authoritative for this release.

## Public availability

The source package, download and license information are available at [Bazarr Contract source](https://launchpad.bazarr.xyz/contract-source), without authentication. Keep source releases available for the corresponding implementations. A source page should identify the covered contract and release and provide downloads, licenses, build instructions and the on-chain verification status.

The source page identifies the deployed proxy and implementation and provides the source, licenses, build instructions, deployment inputs and repeatable on-chain verification. Keep this release available for as long as the corresponding object code is offered. Legal conclusions about components outside these contracts require a separate review.