Hardcoded Address Risk Explainer

WHAT IT DOES

Hardcoded Address Risk Explainer is a read-only tool that identifies and analyzes hardcoded addresses in contracts, generating AI-powered plain-language explanations of what each address is (if known), flagging suspicious or potentially malicious addresses, and assessing the overall risk of trusting these addresses. It reads contract bytecode, hardcoded address literals, address usage patterns, function signatures using hardcoded addresses, contract ownership, proxy pattern detection, upgradeable contract status, event logs, transaction history, privileged function signatures, known address databases, and address labels from block explorers. The tool then presents this data alongside an AI-generated analysis of hardcoded addresses, identifying suspicious or potentially malicious addresses and assessing the risk of trusting these addresses — helping you understand the trustworthiness of a contract's hardcoded dependencies before interacting with or relying on it.

HOW TO USE

Connect your wallet using the BGWallet bridge and select your target network. Enter the contract address you want to analyze. Optionally enter a contract name for reference. Click "Analyze hardcoded addresses" to read on-chain contract data. The tool displays the contract address, number of hardcoded addresses, the addresses list, suspicious addresses count, and hardcoded address risk level (Low/Medium/High). Detailed information includes address labels, usage patterns, contract ownership, proxy pattern, upgradeable status, privileged functions, function signatures, and event logs. A risk assessment box provides a summary risk evaluation. An AI explanation appears below the on-chain data, identifying all hardcoded addresses in the contract, explaining what each address is if known, flagging suspicious or potentially malicious addresses, and assessing the overall risk of trusting these addresses before you interact with or rely on the contract. The wallet's own signature step still protects you — this explanation is informational only and does not replace reviewing what you approve in your wallet.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 with the provider from the BGWallet bridge to read on-chain contract data. No hardcoded contract addresses are used — you are always in control of which contract you trust. When analyzing hardcoded addresses, the tool reads the contract bytecode via provider.getCode(contract), scans for hardcoded address literals (20-byte values that appear as constants in the bytecode), analyzes address usage patterns by examining how addresses are used (e.g., transfer, approve, swap), identifies function signatures that use hardcoded addresses, reads contract ownership via the contract's owner() function or storage slot, detects proxy patterns by scanning for known proxy opcode patterns and storage slots, detects upgradeable contract status by checking for proxy patterns and upgrade functions, reads event logs by scanning for address-related events, reads transaction history via provider.getTransactionCount(contract), reads privileged function signatures by analyzing function selectors, checks known address databases for address labels and classifications, and reads address labels from block explorer metadata. The tool fetches event logs by walking backwards in chunks and halving chunk size on failure, ensuring logs are properly read despite varying RPC limitations. The data is formatted and passed to the AI bridge via BGAI.generate() with a structured prompt that includes all the on-chain data read. The AI is instructed to identify all hardcoded addresses in the contract, explain what each address is if known, flag suspicious or potentially malicious addresses, and assess the overall risk — while stating plainly that it cannot detect hardcoded addresses that are computed at runtime via assembly or off-chain sources, cannot guarantee that a hardcoded address is safe or legitimate, and cannot detect hardcoded addresses in contracts that use inline assembly or non-standard patterns. The AI response is capped at 1,024 tokens to ensure concise, focused hardcoded address risk assessments. All computed values are guarded against negative numbers — if an address count or usage pattern appears invalid, the tool flags it rather than displaying nonsensical values.

WHAT IT CANNOT SEE

This tool cannot detect hardcoded addresses that are computed at runtime via assembly or off-chain sources. It cannot guarantee that a hardcoded address is safe or legitimate. It cannot detect hardcoded addresses in contracts that use inline assembly or non-standard patterns. It cannot detect malicious intent behind hardcoded addresses beyond bytecode and known address analysis. The AI explanation is generated from on-chain data only and cannot detect runtime-computed addresses, off-chain sources, or social engineering attacks. It cannot predict whether a hardcoded address will be used maliciously in the future. The tool does not continuously monitor hardcoded addresses; each analysis is a snapshot at the time of the lookup. It cannot detect delayed attacks, hidden addresses, or off-chain factors. The tool does not store any data persistently; all state is in-memory and resets on reload. The AI explanation is informational and does not constitute financial advice, legal advice, or a guarantee of address safety or contract trustworthiness.

PLEASE NOTE

Hardcoded Address Risk Explainer works exclusively with EVM-compatible chains. It requires a Web3 wallet (MetaMask or similar) and the BGWallet bridge. Explanations are AI-generated from data the app reads on-chain — always review what you are actually signing in your wallet before approving it. Hardcoded addresses carry significant risk including malicious contract interactions, fund theft, and unexpected behavior. Use this tool as a guide only; always cross-check with independent sources and contract audits for critical decisions. This is experimental software; use at your own risk.