Delegatecall Target Auditor

WHAT IT DOES

This tool connects to your EVM wallet and audits smart contracts for delegatecall usage and target safety. It reads contract source code to identify delegatecall patterns and extract target addresses. Optionally, it reads deployed contract bytecode to verify delegatecall implementations and checks target contract bytecode for unsafe patterns such as selfdestruct, delegatecall chains, and suspicious opcodes. The tool provides a comprehensive risk assessment of delegatecall usage in your contracts.

HOW TO USE

Connect your Web3 wallet using the Connect button. Paste your contract source code in the Contract Source Code field. Optionally, enter a target contract address in the Target Contract Address field for on-chain verification. Click "Audit Source" to analyze the source code for delegatecall patterns. Click "Verify Target" to check the on-chain bytecode of a target contract for unsafe patterns. Click "Load Sample" to populate fields with an example contract. Results appear in the Results card with a summary of delegatecalls found, targets identified, and risk level, followed by a detailed breakdown of each call.

TECHNICAL MECHANISM: DELEGATECALL PATTERN DETECTION AND TARGET VERIFICATION

The tool uses regular expression pattern matching to detect delegatecall usage in contract source code, identifying both explicit .delegatecall() calls and calls that may involve delegatecall through variables. It extracts target addresses from the surrounding context where possible. For on-chain verification, the tool uses ethers.js to fetch bytecode from deployed contracts via provider.getCode(address). It then scans the bytecode for known unsafe patterns including selfdestruct opcodes (0xff), delegatecall opcodes (0xf4), and other suspicious patterns. The tool categorizes findings by severity (Critical for delegatecall, Low for regular calls) and provides context for each detected call.

WHAT IT CANNOT SEE

This tool cannot determine whether delegatecall targets are malicious without runtime context—delegatecall may be used legitimately in proxy patterns. It cannot detect dynamically computed delegatecall targets that depend on runtime state—the tool only analyzes static source code. It cannot verify that target contracts remain unchanged after audit—target contracts can be upgraded after verification. It cannot analyze contracts with obfuscated or highly optimized code—the tool works best with readable source code. It relies on source code parsing and may miss delegatecalls in libraries or inherited contracts. It cannot guarantee that a delegatecall target is safe even if no immediate issues are found.

PLEASE NOTE

This is a read-only tool—it never signs transactions. All data is processed in-memory and never persists. The tool supports EVM chains only—Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche, Base, and Fantom. Delegatecall is a powerful but dangerous pattern—always review delegatecall usage carefully. The tool performs static analysis and should be used as a starting point for security review, not as a final audit.