Cross-Repo Dependency Graph Generator

WHAT IT DOES

This tool generates a visual dependency graph showing how deployed smart contracts depend on external code from different repositories and organizations. By analyzing verified source code, it extracts import statements and external references—such as OpenZeppelin libraries, Uniswap interfaces, or other npm packages—and maps each contract to its source repository using GitHub metadata. The result is a comprehensive view of cross-repo dependencies, revealing which contracts share common libraries, which repositories are most depended upon, and the overall ecosystem structure. This is essential for developers managing upgrade dependencies, auditors assessing supply chain risks, and teams planning repository migrations or library updates across multiple contracts.

HOW TO USE

Connect your wallet (read-only, no transaction required) and select the target network. Enter a list of contract addresses (one per line) in the text area. Provide an Etherscan API key for source code verification and optionally a GitHub token for repository metadata enrichment. Click "generate dependency graph" and the tool will fetch bytecode and source code for each contract, parse import statements to identify external dependencies, and cross-reference with GitHub data to map contracts to their source repositories. Results display as an interactive graph with nodes representing contracts and edges showing dependency relationships, alongside a detailed table showing each contract's dependencies and associated repositories.

TECHNICAL MECHANISM

The analyzer uses ethers.js v5.7.2 to fetch contract bytecode via eth_getCode for each provided address. It then interfaces with block explorer verification APIs (e.g., Etherscan) to retrieve the verified source code for each contract. The source code is parsed to identify import statements and external references, extracting repository URLs, package names, and version information. These imports are resolved to known repositories using a combination of npm package registries and GitHub API lookups (when a GitHub token is provided). The tool constructs a directed graph where nodes represent contracts (identified by address and repository) and edges represent dependency relationships. Dependencies are categorized as internal (within the same repository) or cross-repo (spanning different repositories or organizations), with cross-repo dependencies highlighted for supply chain analysis. The implementation processes contracts in parallel batches (4-6 concurrent) to optimize API usage while respecting rate limits, with visible progress updates during the graph generation process.

WHAT IT CANNOT SEE

This tool cannot detect dependencies that are not verified or do not have source code available on block explorers, as source code is required for import analysis. It is limited by API rate limits for block explorer and GitHub APIs, which may restrict the number of contracts that can be analyzed in a single session. It cannot analyze contracts that import libraries via DELEGATECALL without explicit source references, as the dependency relationship is not captured in import statements. It cannot detect dependencies that are resolved through IPFS or other decentralized storage without on-chain references. The accuracy of results depends on the completeness and reliability of the underlying source code verification and repository mapping data, including the presence of correct GitHub URLs in the source code metadata. It cannot detect dependencies between private repositories or unverified source code, as these are not accessible through public APIs. It is limited by the RPC provider's rate limits for bytecode fetching, which may slow down analysis of many contracts.

PLEASE NOTE

This is a read‑only analytics tool—it never submits transactions or signs anything. It is designed for EVM‑compatible chains. For best results, provide a valid Etherscan API key and GitHub token to maximize data accuracy and reduce rate limiting. The graph is generated based on the best available source code at the time of analysis; contract source may change after verification. Cross-repo dependency detection is heuristic and may not capture all external references in complex codebases.