Cross-Function Reentrancy Scanner

WHAT IT DOES

This tool connects to your EVM wallet and scans smart contract source code for cross-function reentrancy patterns. It analyzes function interactions, shared state variables, and external call sequences to identify potential vulnerabilities where one function can be reentered through another. The tool detects suspicious patterns like state changes before external calls, cross-function call sequences, and shared state modifications that could lead to reentrancy attacks across multiple functions.

HOW TO USE

Connect your Web3 wallet using the Connect button. Paste your contract source code in the Contract Source Code field. Click "Scan for Reentrancy" to analyze the code for cross-function reentrancy patterns. Click "Load Sample" to populate fields with an example vulnerable contract. Results appear in the Results card with a summary of functions found, cross-function calls detected, and risk level (High, Medium, Low), followed by a detailed breakdown of suspicious patterns and cross-function call relationships.

TECHNICAL MECHANISM: CROSS-FUNCTION REENTRANCY PATTERN DETECTION

The tool uses regular expression pattern matching to analyze contract source code. It extracts all function names and their visibility modifiers. It then identifies cross-function call patterns where one function calls another. The tool detects state changes that occur before external calls, which is a key indicator of reentrancy vulnerability. It also identifies shared state variables modified across multiple functions. Each suspicious pattern is categorized and displayed with context. The risk level is determined by the presence of state-changing external calls without proper reentrancy guards or checks-effects-interactions ordering.

WHAT IT CANNOT SEE

This tool cannot dynamically test for cross-function reentrancy vulnerabilities—it performs static analysis only. It cannot detect reentrancy that depends on complex state interactions across multiple contracts—the tool analyzes only the provided source code. It cannot guarantee that flagged patterns are actual vulnerabilities—some patterns may be safe in specific contexts. It relies on source code parsing and may produce false positives or miss complex patterns. It cannot analyze contracts with obfuscated or highly optimized code—the tool works best with readable source code. It cannot detect vulnerabilities that require specific execution contexts or cross-contract interactions.

PLEASE NOTE

This is a read-only tool—it never signs transactions. All data is processed in-memory and never persists. The tool supports EVM chains only—Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche, Base, and Fantom. The scanner performs static analysis and should be used as a starting point for security review, not as a final audit. Cross-function reentrancy is a complex vulnerability—always conduct thorough testing and consult security professionals.