Bytecode Analyzer

WHAT IT DOES

Bytecode Analyzer gives you a structural and behavioral analysis of any EVM contract bytecode. Paste bytecode or provide a contract address, and the tool scans the bytecode to determine its size, extract function selectors, and detect potentially dangerous instruction patterns such as SELFDESTRUCT, DELEGATECALL, CALL, CREATE, and CREATE2. It presents the results with clear severity labels (danger, warning, info) so you can quickly identify contracts that may contain risky operations. This is essential for security researchers, developers auditing third-party contracts, or anyone who wants a quick sanity check on unknown bytecode.

HOW TO USE

Connect your EVM wallet (optional—the tool works read-only). Select the network from the dropdown. Enter a contract address to fetch its bytecode, or paste bytecode directly into the bytecode field (address takes priority if both are provided). Click "analyze" to run the analysis. The tool displays the bytecode size, a count of function selectors found, a list of detected patterns with severity badges, and a preview of the bytecode. The function selectors are extracted and displayed as a list for reference. Use the "clear" button to reset all fields. No signing or approvals required.

TECHNICAL MECHANISM

The tool uses a heuristic approach to analyze bytecode. It first validates that the bytecode is a hex string starting with 0x. The size is calculated as (bytecode.length - 2) / 2. Function selectors are extracted by scanning the bytecode for 4-byte (8 hex character) sequences that appear as valid selectors, filtering out common padding values (0x00000000, 0xffffffff, 0x00000001) and avoiding duplicates. Suspicious patterns are detected by searching for specific opcode bytes: 0xFF for SELFDESTRUCT, 0xF4 for DELEGATECALL, 0xF1 for CALL, 0xF0 for CREATE, and 0xF5 for CREATE2. These are displayed with severity levels—danger for selfdestruct, warning for delegatecall and call, and info for create operations.

WHAT IT CANNOT SEE

This tool cannot decompile bytecode to source code or recover function names—it only extracts raw selectors. It cannot detect logical vulnerabilities or business logic flaws—only structural instruction patterns. It cannot analyze contracts with obfuscated or encrypted bytecode, as the patterns become unreadable. It cannot provide a complete security audit—this is a surface-level analysis tool. It cannot detect events or errors from bytecode. It cannot verify that the bytecode is safe—the presence of these patterns is not necessarily malicious, but indicates areas that require manual review. The tool is limited by the accuracy of pattern detection and the complexity of the bytecode.

PLEASE NOTE

Works exclusively on EVM-compatible chains: Ethereum Mainnet, Goerli, Sepolia, Polygon, Arbitrum, and Optimism. Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. This is a read-only, free security analysis tool—use it for initial contract inspection and to identify areas that warrant deeper review. The presence of dangerous opcodes does not automatically mean a contract is malicious—some contracts legitimately use these patterns for specific functionality. Always perform a full security audit before interacting with any contract.