Function Selector Clash Checker

WHAT IT DOES

Function Selector Clash Checker is a read-only security tool that analyzes EVM smart contract bytecode to detect function selector collisions—a vulnerability where two or more functions share the same 4-byte identifier (the first 4 bytes of the keccak256 hash of the function signature). Such clashes can cause ambiguous function dispatch, where the EVM cannot determine which function to execute, potentially leading to unexpected behavior, denial of service, or exploited attack vectors. The tool extracts all function selectors from the bytecode, groups them by their 4-byte identifier, identifies duplicates, and provides severity ratings (critical, high, medium) along with actionable recommendations for resolving conflicts.

HOW TO USE

Connect your EVM-compatible wallet via the BGWallet bridge and select the network where your contract is deployed. Enter the contract address and click "Check for Clashes". The tool fetches the bytecode, scans for PUSH4 opcodes (0x63) to extract function selectors, attempts to match selectors to known function signatures, identifies duplicate selectors, and generates a comprehensive report. Results include the total number of selectors found, a detailed list of detected clashes with affected functions, severity classifications, and recommendations for remediation. The tool also displays all unique selectors found and highlights those involved in clashes. All analysis is read-only—no signatures or transactions are submitted.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 to fetch contract bytecode via provider.getCode(address), then performs static bytecode analysis using opcode pattern recognition. It scans the entire bytecode hex string for the PUSH4 opcode pattern (0x63) followed by the 4-byte selector value (8 hex characters), extracting all unique selectors from the contract. Each extracted selector is then attempted to be mapped to a function signature by comparing against a database of common function signatures including transfer, transferFrom, approve, balanceOf, totalSupply, allowance, deposit, withdraw, mint, burn, swap, addLiquidity, removeLiquidity, stake, unstake, claim, setOwner, pause, unpause, upgrade, initialize, and others. The tool then detects duplicates by grouping selectors into buckets—any selector that appears more than once indicates a clash. Clashes are assigned severity: critical (3+ functions sharing selector), high (2 functions with unknown or conflicting names), or medium (2 functions with similar names). The analysis is purely static and does not execute any contract functions.

WHAT IT CANNOT SEE

This tool has fundamental limitations that users must understand. It cannot detect selector clashes with functions that are not in the bytecode or ABI—private functions, internal functions, or functions removed during compilation by the optimizer are invisible to static analysis. It cannot analyze dynamic function dispatch mechanisms like fallback functions (receive() or fallback()) that handle arbitrary selectors not declared in the bytecode. It cannot predict selector collisions with future functions or external contracts not included in the analysis—a contract may be safe today but clash with a future upgrade or external integration. It cannot detect clashes caused by overloaded function names with same selector but different parameter types without full ABI information—the tool relies on heuristics and may misclassify overloaded functions. It cannot analyze contracts with no bytecode or contracts that use assembly-level dispatch logic that bypasses standard PUSH4 patterns. The tool's function signature mapping is heuristic and may produce false positives or miss clashes if selectors are obfuscated. It cannot detect clashes in proxy contracts where the implementation logic is stored separately—analysis is limited to the proxy's minimal bytecode.

PLEASE NOTE

This tool only supports EVM-compatible blockchains (Ethereum, Polygon, BSC, Avalanche C-Chain, Optimism, Arbitrum, and their testnets). Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. The tool is free, open-source, requires no API keys, and uses the wallet's native provider for all read operations. Resolving selector clashes typically requires renaming functions, adjusting parameter order, or using different function names to ensure unique selectors—always test changes thoroughly in a development environment before deploying to production.