Contract Auditing Tool

WHAT IT DOES

Contract Auditing Tool provides a preliminary security assessment of any deployed EVM contract. Enter a contract address, and the tool fetches the bytecode, performs pattern-based analysis for common security issues, detects function signatures from the bytecode, and optionally decodes functions from a provided ABI. It scans for dangerous patterns including selfdestruct, delegatecall, low-level call.value, and proxy patterns, and flags them with severity levels (Critical, High, Medium, Low, Info). The tool displays the contract type (Contract or EOA), bytecode size, detected functions, and a detailed list of findings with severity badges. This is essential for developers and security researchers performing initial contract reviews before engaging in a full professional audit.

HOW TO USE

Connect your wallet using the BGWallet bridge (MetaMask or any Web3 wallet). Ensure you are on the network where the contract is deployed — Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, Base, or any EVM chain. Enter the contract address in the input field. Optionally, paste the contract's ABI as a JSON array to enable function name detection from the ABI (if not provided, the tool will attempt to detect standard function signatures from the bytecode). Click "Run audit" to start the analysis. The tool fetches the bytecode, performs pattern matching against a list of known suspicious patterns, detects function signatures, and displays the results with severity-coded findings. Each finding includes the issue name, severity badge, and additional detail. The tool also shows the total number of functions detected and the total issues found.

TECHNICAL MECHANISM

The tool uses ethers.js to fetch contract bytecode via provider.getCode(contractAddress). If the bytecode is "0x", the address is identified as an EOA; otherwise, it's a contract with the returned bytecode. The bytecode size is calculated in bytes. For pattern-based analysis, the tool maintains a list of regex patterns for known security concerns — selfdestruct, delegatecall, call.value, send(0), transfer with address param, and proxy patterns. Each pattern has an associated severity level. The tool scans the bytecode string for each pattern and records matches as findings. For function detection, the tool maintains a map of standard function signatures (4-byte selectors) to human-readable function names, and checks if the bytecode contains each signature. If an ABI is provided, it parses the JSON and extracts function names from the ABI definition. The results are sorted by severity (critical to info) and displayed in a table format with color-coded badges for quick visual assessment.

WHAT IT CANNOT SEE

The tool cannot perform static analysis or detect vulnerabilities beyond basic pattern matching — it does not understand contract logic, control flow, or data dependencies. It cannot verify that the source code matches the deployed bytecode without manual comparison (e.g., using a block explorer's verification). It cannot detect complex reentrancy attacks, logic errors, access control issues, or arithmetic overflow/underflow bugs without full symbolic execution or formal verification. It cannot audit contracts with proxy patterns or upgradeable logic automatically — the tool may flag proxies but cannot analyze the underlying implementation. It cannot provide a formal security guarantee or certification — this is a preliminary screening tool, not a replacement for a professional audit. It cannot analyze contracts that are not deployed or that have no bytecode. The tool is read-only and does not sign any transactions.

PLEASE NOTE

This tool works exclusively on EVM-compatible chains (Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, Base, Avalanche C-Chain, Fantom, and others). Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. The pattern detection is based on simple regex matching and may produce false positives or miss novel vulnerabilities. A clean audit result does not mean the contract is secure — it only means no known patterns were detected. Always follow up with a professional security audit before deploying or using contracts with real funds. The tool does not store any data — all reads happen live from the blockchain through your wallet provider. The tool is provided as-is with no warranty or liability. This is not a substitute for professional security review.