Access Control Matrix Generator from Contract Source

WHAT IT DOES

This tool connects to your EVM wallet and generates access control matrices from smart contract source code. It analyzes contract source to identify access control modifiers (onlyOwner, role-based guards), function visibility (public, external, internal, private), and role-based access control patterns. The tool extracts function definitions, detects role constants (bytes32 role declarations), identifies modifier usage, and presents a clear matrix showing which functions are protected by which access controls.

HOW TO USE

Connect your Web3 wallet using the Connect button. Paste your contract source code in the Contract Source Code field. Enter the contract name in the Contract Name field (optional). Click "Generate Matrix" to analyze the source code and produce the access control matrix. Click "Load Sample Contract" to populate fields with an example contract featuring Ownable, role-based access, and ReentrancyGuard. Results appear in the Results card with a summary of the contract name, number of functions, and roles detected, followed by a detailed function access matrix table.

TECHNICAL MECHANISM: SOURCE CODE PARSING AND PATTERN MATCHING

The tool uses regular expression pattern matching to parse contract source code. It identifies function declarations using a regex that captures function name, parameters, visibility modifiers (public, external, internal, private), state mutability (view, pure, payable), and return types. For each function, it extracts modifiers by scanning the code immediately following the function signature, filtering out reserved keywords. Role detection uses regex to find bytes32 public role constant declarations. The tool also detects the presence of nonReentrant modifiers and other security-related patterns. The generated matrix displays each function with its visibility, detected modifiers, and whether it is owner-protected.

WHAT IT CANNOT SEE

This tool cannot execute contracts or test access control dynamically—it only performs static analysis of source code. It cannot detect access control that depends on complex logic or external state—the tool does not evaluate runtime conditions. It cannot verify that access control is correctly implemented in all execution paths—the tool does not perform path analysis. It relies on source code parsing and may not detect access control in compiled bytecode—bytecode analysis is limited. It cannot analyze contracts without source code—source code is required. It cannot guarantee that identified roles correspond to actual permissions at runtime—roles may be misconfigured or unused.

PLEASE NOTE

This is a read-only tool—it never signs transactions. All data is processed in-memory and never persists. The tool supports EVM chains only—Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche, Base, and Fantom. The generated matrix is based on static analysis and should be verified against actual contract behavior. Access control is a critical security concern—always conduct thorough testing and audits.