Cyclomatic Complexity Reporter for Contracts

WHAT IT DOES

This tool reports cyclomatic complexity for smart contract functions by analyzing verified source code and control flow patterns. It calculates the cyclomatic complexity metric—a quantitative measure of the number of linearly independent paths through a function's source code—for each function in a deployed contract. The tool analyzes function bodies, counting decision points (if statements, loops, case statements, and logical operators) to compute complexity scores. Results are presented as a detailed complexity report with function-by-function metrics, complexity levels (low/medium/high), line counts, and actionable recommendations for reducing complexity. This is essential for developers identifying overly complex functions, auditors assessing code maintainability, and teams optimizing contract code quality.

HOW TO USE

Connect your wallet (read-only, no transaction required) and select the target network. Enter the contract name and address. Click "report cyclomatic complexity" and the tool will verify the contract, fetch its source code, and analyze each function's control flow. Results display a summary with contract details, complexity distribution (low/medium/high counts), and overall complexity level, detailed complexity cards showing each function's name, complexity score, level, lines of code, and improvement recommendations, and a table of all functions with their complexity scores. Use the report to identify functions that need refactoring, prioritize code quality improvements, and maintain manageable code complexity.

TECHNICAL MECHANISM

The reporter uses ethers.js v5.7.2 to perform a multi-stage complexity analysis. First, it calls eth_getCode to verify the contract is deployed and uses block explorer APIs (Etherscan, Sourcify) to fetch verified source code and ABI. The tool parses the source code to identify function definitions and their bodies, using a combination of regex-based pattern matching and AST-inspired analysis to extract control flow structures. For each function, it calculates cyclomatic complexity using the standard formula: complexity = 1 + number of decision points (where decision points include: if, else if, for, while, do-while, switch case, &&, ||, ternary operators, and catch statements). The tool also counts lines of code per function and provides a complexity level classification: low (1-4), medium (5-8), high (9+). Each function receives a recommendation based on its complexity level—low complexity functions are considered well-structured, medium complexity functions may benefit from splitting, and high complexity functions should be refactored. Results are compiled into a structured report with detailed function metrics, complexity classifications, and improvement recommendations.

WHAT IT CANNOT SEE

This tool cannot report complexity for contracts that are not verified or have opaque implementation details where source code is not available. It is limited by the availability and completeness of source code verification—if the source code is not fully verified or is obfuscated, the analysis may be incomplete. It cannot analyze contracts that use inline assembly, preprocessor directives, or complex patterns that obscure control flow (e.g., dynamic dispatch via fallback functions). The analysis relies on the accuracy and completeness of source code parsing and control flow analysis; syntax errors or non-standard patterns may produce inaccurate results. It cannot analyze contracts that are not deployed or have been self-destructed. The tool is limited to the specific contract instances and source code versions that are accessible via RPC and block explorer APIs. It cannot guarantee that complexity metrics reflect actual runtime behavior or gas costs—the metric is a static code quality measure, not a performance indicator.

PLEASE NOTE

This is a read‑only analytics tool—it never submits transactions or modifies contract state. It is designed for EVM‑compatible chains and works best with verified contracts that have clean, parsable source code. The complexity report is for informational and code quality purposes only and should not be considered a comprehensive security audit. Always review complexity metrics in the context of your specific contract logic and requirements. The tool's recommendations are heuristic—use them as a guide for code review and refactoring decisions.