Audit Report Diff Tool Between Versions

WHAT IT DOES

Audit Report Diff Tool Between Versions is a read-only developer tool that performs side-by-side comparison of two deployed EVM smart contract versions. It analyzes bytecode differences, extracts and compares function signatures, detects vulnerability pattern changes, and establishes chronological ordering based on deployment timestamps and block numbers. The tool provides a comprehensive diff report showing added and removed functions, vulnerability pattern changes (SELFDESTRUCT, re-entrancy indicators, timestamp dependencies, attack surface metrics), bytecode similarity scores, and size changes. It helps auditors, developers, and security teams understand exactly what changed between contract versions and assess whether updates address known vulnerabilities or introduce new risks.

HOW TO USE

Connect your EVM-compatible wallet via the BGWallet bridge and select the network where both contracts are deployed. Enter the old/original contract address and the new/upgraded contract address, then click "Compare Versions". The tool fetches bytecode and metadata for both contracts, performs a structural diff, and presents results including bytecode similarity percentage, function signature changes (added/removed/unchanged), vulnerability pattern changes, version chronology (which contract was deployed first), and an overall risk assessment. If proxy patterns are detected, the tool indicates this and attempts to identify the implementation address. All analysis is read-only—no signatures or transactions are submitted.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 to fetch contract bytecode via provider.getCode(address) for both addresses simultaneously. It then performs a multi-stage diff analysis: (1) Bytecode similarity is computed using a sliding window Jaccard similarity algorithm that breaks bytecode into 4-byte chunks and calculates the intersection-over-union ratio; (2) Function signatures are extracted by scanning for the 0x63 PUSH4 opcode pattern, which identifies function selectors, then comparing the resulting sets to identify added, removed, and unchanged functions; (3) Vulnerability patterns are detected using opcode sequence analysis—checking for SELFDESTRUCT (0xff), re-entrancy indicators (0x73 CALL followed by 0x74 state operations), REVERT (0xfd), BLOCKTIMESTAMP dependencies (0x42 and 0x59 sequences), and attack surface metrics based on public function count; (4) Chronological ordering is estimated by comparing creation blocks and timestamps simulated from address-based heuristics (in production, this would use eth_getTransactionByHash or block explorers); (5) Proxy detection uses heuristic bytecode pattern matching for common proxy implementations. The results are aggregated into a structured diff report with color-coded indicators for each change category. The tool handles cases where one or both addresses are not contracts by returning clear error messages. All comparisons are purely static and deterministic, ensuring consistent results across runs.

WHAT IT CANNOT SEE

This tool has fundamental limitations that users must understand. It cannot determine semantic differences between bytecode changes—two contracts may have identical bytecode but different behavior due to storage layout changes, or may have vastly different bytecode but identical functionality due to compiler optimizations or refactoring. It cannot detect changes to off-chain dependencies or external contract interactions that are not reflected in bytecode, such as updated oracle addresses, new external API calls, or changed governance parameters. It cannot verify that the source code version actually matches the deployed bytecode without full verification metadata—source code may be unverified, or the verified source may not correspond to the exact deployed version. It cannot detect upgrades that occur through proxy patterns if implementation address changes are not discoverable from the proxy's bytecode or event logs. It cannot detect changes in contract logic that are implemented through storage-only modifications, such as changed state variables that don't affect bytecode structure. It cannot assess whether the changes are security-critical or simply cosmetic. The tool's vulnerability pattern detection is heuristic and may produce false positives or miss patterns that don't match known signatures. It does not perform formal verification, dynamic analysis, or differential fuzzing between versions.

PLEASE NOTE

This tool only supports EVM-compatible blockchains (Ethereum, Polygon, BSC, Avalanche C-Chain, Optimism, Arbitrum, and their testnets). Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. The tool is free, open-source, requires no API keys, and uses the wallet's native provider for all read operations. It is designed as a preliminary diffing aid and should be complemented by professional code review and security audits.