Contract Dependency Version Auditor

WHAT IT DOES

Contract Dependency Version Auditor is a security-focused tool that audits the dependencies of Solidity contracts by parsing import directives and comparing versions against a curated vulnerability database. It takes contract source code as input, extracts all import statements, and identifies the packages being used. The tool optionally accepts a package.json manifest to determine the exact versions of dependencies. For each detected dependency, it checks against the known vulnerability database, providing a status classification: safe, warning, critical, or unknown. The tool displays dependency names, versions, status indicators, vulnerability descriptions, and recommendations for remediation. This enables developers to quickly identify vulnerable dependencies in their smart contract projects before deployment.

HOW TO USE

Paste the Solidity source code into the "Contract source code" text area. Optionally, paste a package.json or dependency manifest into the "Package manifest" text area to provide version information. Click "Audit dependencies" to analyze the imports and check against the vulnerability database. The tool will display a summary including total dependencies found, safe, warning, critical, and unknown counts, along with a detailed list of each dependency with its version, status, and any vulnerabilities or recommendations.

TECHNICAL NOTE: IMPORT PARSING AND VULNERABILITY DATABASE

The tool uses regex-based parsing to extract import directives from Solidity source code. It extracts both scoped packages (@scope/package) and unscoped packages from import paths. When a manifest is provided, the tool parses JSON to extract dependency versions. The tool maintains a curated knowledge base of common smart contract dependencies including OpenZeppelin Contracts, OpenZeppelin Upgradeable, Hardhat, Chainlink Contracts, Uniswap V2/V3 Core, Aave V3 Core, and Morpho Utils. For each known dependency, the database includes latest version, safe versions, vulnerable versions, and specific vulnerability descriptions. Dependencies not in the database are flagged as unknown and require manual verification.

WHAT IT CANNOT SEE

The tool cannot automatically detect dependencies without source code or manifest files. It cannot verify that reported versions are the actual versions used in deployment; the analysis is based on the provided source and manifest. The tool is limited to the accuracy of the vulnerability database; it may not include all vulnerabilities or dependencies. It cannot detect custom or private dependencies that are not publicly known. It cannot audit dependencies that are not listed in the provided manifest. It cannot verify that library versions are compatible with the compiler version. The tool is limited by the accuracy of import parsing and may not detect dependencies imported with non-standard syntax. It cannot detect dependencies on non-EVM chains.

PLEASE NOTE

This tool is designed exclusively for Solidity contracts on EVM-compatible chains. The vulnerability database is curated and may not include all known vulnerabilities. The audit results are based on the provided source code and manifest; they do not constitute a comprehensive security audit. Always verify dependency versions against official sources and use additional security tools. The tool provides no warranty that the audit results are complete or accurate; users are responsible for verifying all dependencies and versions.