Flash Loan Attack Vector Scanner

WHAT IT DOES

Flash Loan Attack Vector Scanner is a security-focused tool that scans Solidity contracts for flash loan attack vectors and vulnerabilities. It takes contract source code from the user and analyzes it for flash loan integrations, callback functions, validation patterns, price manipulation risks, and reentrancy vulnerabilities. The tool identifies critical patterns including flash loan callback functions (executeOperation), initiator and asset validation, price oracle usage, swap/exchange operations, reentrancy protection, and token transfers. Each finding is classified by severity (critical, high, medium, low, or info) based on the potential for exploitation. The tool provides detailed descriptions of each vulnerability, the exact location in the source code, and actionable recommendations for remediation. This enables developers to identify and fix flash loan attack vectors before deployment, protecting against common DeFi exploits.

HOW TO USE

Paste your Solidity contract source code into the input area. Click "Scan for flash loan vectors" to analyze the code. The tool will display a summary showing counts of critical, high, medium, and low severity issues. Each vulnerability entry includes the name, severity, description, location (line number and context), and a recommendation for fixing the issue. The scan report can be copied or downloaded as JSON for further analysis.

TECHNICAL NOTE: FLASH LOAN ATTACK PATTERN DETECTION

The tool uses regex-based pattern matching to detect flash loan attack vectors in Solidity source code. It scans for flash loan integrations (Aave, Uniswap, etc.), callback function definitions, sender validation, initiator validation, price oracle usage, swap/exchange operations, reentrancy guards, and token transfer patterns. Each pattern is mapped to a severity level based on the potential for exploitation: critical for flash loan callbacks without validation or reentrancy protection, high for price-sensitive operations without slippage protection, medium for balance checks and token transfers in callbacks, and low for informational findings about flash loan integrations.

WHAT IT CANNOT SEE

The tool cannot detect all flash loan attack vectors without context; some patterns may be safe depending on the specific application logic and external contract interactions. It is limited to the accuracy of the source code analysis; syntax variations may cause false positives or negatives. It cannot detect issues in external contracts or libraries that are imported into the contract. It cannot verify if a flash loan attack vector is actually exploitable in the specific deployment environment. The tool is limited by the parser's ability to handle Solidity syntax variations, including newer language features. It cannot scan for flash loan attack vectors on non-EVM chains.

PLEASE NOTE

This tool is designed exclusively for Solidity contracts on EVM-compatible chains. It does not support other smart contract languages. The scan results are based on static analysis and may produce false positives or miss some issues. Always verify the findings with manual review and testing. The tool is read-only and does not modify any state. The tool provides no warranty that the scan results are complete or accurate; users are responsible for validating all findings and implementing appropriate fixes.