Extension Contract Risk Explainer

WHAT IT DOES

Extension Contract Risk Explainer is a read-only tool that analyzes extension contracts in modular base systems, generating AI-powered plain-language explanations of what an extension does, what permissions it has, who installed it, and the risks of those permissions. It reads extension contract address, base/host contract address, extension registration status, extension permissions, access control lists, function signatures, extension dependencies, upgrade history, host owner address, privileged function signatures, event logs, transaction history, extension activation and deactivation status, governance proposals, extension version, and extension interface compatibility. The tool then presents this data alongside an AI-generated analysis of the extension's permissions and risks, identifying potential threats such as privileged access, state corruption, and governance bypass — helping you understand the trustworthiness of an extension before interacting with it.

HOW TO USE

Connect your wallet using the BGWallet bridge and select your target network. Enter the extension contract address you want to analyze. Optionally enter the base or host contract address for context. Click "Analyze extension risk" to read on-chain contract data. The tool displays the extension address, base contract address, registration status, permissions type, and extension risk level (Low/Medium/High). Detailed information includes installed by, base owner, access control type, function signatures, dependencies, activation status, extension version, upgrade history, privileged functions, governance proposals, and interface compatibility. A risk assessment box provides a summary risk evaluation. An AI explanation appears below the on-chain data, explaining what the extension does in the base contract, what permissions it has, who installed or approved it, and the risks of those permissions before you interact with the extension or its functions. The wallet's own signature step still protects you — this explanation is informational only and does not replace reviewing what you approve in your wallet.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 with the provider from the BGWallet bridge to read on-chain contract data. No hardcoded contract addresses are used — you are always in control of which contract you trust. When analyzing extension risks, the tool reads the extension contract address from the user input, reads the base contract address from the user input (if provided), checks extension registration status via the base's extension registry (e.g., isExtensionRegistered()), reads extension permissions via the base's permission management functions, reads access control lists via the base's access control functions, reads function signatures from the extension's ABI or bytecode, reads extension dependencies via the base's dependency management, reads upgrade history by scanning event logs (e.g., ExtensionAdded, ExtensionUpgraded), reads base owner address via the base's owner() function, reads privileged function signatures by analyzing function selectors, reads event logs by scanning for extension-related events, reads transaction history via provider.getTransactionCount(base), reads extension activation and deactivation status via the base's extension management functions, reads governance proposals via the governance contract (if available), reads extension version via the base's version tracking, and reads extension interface compatibility by analyzing the extension's interface against the base's expected interface. The tool fetches event logs by walking backwards in chunks and halving chunk size on failure, ensuring logs are properly read despite varying RPC limitations. The data is formatted and passed to the AI bridge via BGAI.generate() with a structured prompt that includes all the on-chain data read. The AI is instructed to explain what the extension does in the base contract, what permissions it has, who installed or approved it, and the risks of those permissions — while stating plainly that it cannot detect if an extension's registered permissions are being used maliciously beyond the on-chain configuration, cannot detect off-chain social engineering attacks or governance manipulation, and cannot guarantee that an extension's permissions will not be changed in a future upgrade. The AI response is capped at 1,024 tokens to ensure concise, focused extension risk assessments. All computed values are guarded against negative numbers — if a permission count or function count appears invalid, the tool flags it rather than displaying nonsensical values.

WHAT IT CANNOT SEE

This tool cannot detect if an extension's registered permissions are being used maliciously beyond the on-chain configuration. It cannot detect off-chain social engineering attacks or governance manipulation. It cannot guarantee that an extension's permissions will not be changed in a future upgrade. It cannot detect extensions that are registered but have hidden or off-chain functionality. The AI explanation is generated from on-chain data only and cannot detect hidden extension functionality, off-chain actions, or social engineering attacks. It cannot predict whether an extension's permissions will be changed or revoked in the future. The tool does not continuously monitor extension risks; each analysis is a snapshot at the time of the lookup. It cannot detect delayed permission changes, hidden extensions, or off-chain factors. The tool does not store any data persistently; all state is in-memory and resets on reload. The AI explanation is informational and does not constitute financial advice, legal advice, or a guarantee of extension safety or permission correctness.

PLEASE NOTE

Extension Contract Risk Explainer works exclusively with EVM-compatible chains. It requires a Web3 wallet (MetaMask or similar) and the BGWallet bridge. Explanations are AI-generated from data the app reads on-chain — always review what you are actually signing in your wallet before approving it. Extension permissions carry significant risk including privileged access, state corruption, and governance bypass. Use this tool as a guide only; always cross-check with independent sources and contract audits for critical decisions. This is experimental software; use at your own risk.