Identity Contract Risk Explainer

WHAT IT DOES

Identity Contract Risk Explainer takes an identity contract address (e.g., ENS identity, Sismo vault, Ceramic IDX, or custom on-chain identity) and provides a comprehensive risk assessment of its ownership, configuration, and operational state. On-chain identities store ownership, verification status, recovery guardians, and metadata that can be used across applications. If the identity is revoked, expired, paused, or lacks adequate recovery mechanisms, it may be unsafe to use, transfer, or rely upon. This tool reads the contract's state via public view functions—owner, controller, guardians, isVerified, isRevoked, expiry, name, metadata, canTransfer, and isPaused. It fetches the current block timestamp and computes whether the identity has expired (if time-bound). Historical identity events (IdentityCreated, IdentityUpdated, IdentityRevoked, ControllerChanged, GuardianAdded, GuardianRemoved) are fetched using chunked, backoff‑aware log scanning to provide context on past changes. The output includes the owner, controller, list of guardians, verification status, revocation status, expiry date and time remaining, pause state, transferability, a visual risk level badge, and a plain‑language risk assessment with recommended actions.

HOW TO USE

Paste an identity contract address into the input field, select the network, and click "Assess identity". The tool connects to your wallet via the EVM bridge (read‑only; it never signs or sends anything) to fetch the identity state. It attempts multiple common identity function signatures to maximize compatibility with different implementations (ENS identity, Sismo, Ceramic, and custom identity contracts). It fetches the current block timestamp for expiry calculations. Historical events are fetched in chunks (500 blocks per request) with automatic backoff and halving on failure to avoid public RPC caps. The AI layer generates a plain‑English risk assessment: the owner and controller, guardians count, verification/revocation/expiry status, pause state, transferability, and the overall risk level. You can click on the owner or controller addresses to view them on the block explorer.

CHUNKED LOG SCANNING WITH BACKOFF FOR IDENTITY EVENTS

Identity events (IdentityCreated, IdentityUpdated, IdentityRevoked, ControllerChanged, GuardianAdded, GuardianRemoved) are essential for confirming identity history, controller changes, and guardian management. However, public RPCs aggressively cap eth_getLogs block ranges; a full‑range request over 10,000 blocks will fail with a "block range too large" error. This tool automatically chunks log requests into 500‑block slices to stay within safe limits for all major RPC providers. If a chunk fails (due to timeout or provider‑specific caps), it halves that chunk and retries recursively—ensuring that even with aggressive caps, the tool reliably retrieves all relevant identity events. The tool also filters logs by the specific contract address and relevant event topics to minimize data transfer and processing time. For non‑standard identity contracts, it attempts to read the most common functions while gracefully falling back when specific functions are not available.

WHAT IT CANNOT SEE

This tool cannot detect identity risks that depend on off‑chain state (e.g., identities that are verified by an off‑chain attestation service, or identities that rely on external data sources for verification). It cannot predict future controller changes, revocations, or expiry events that might occur before the transaction is mined—the risk assessment reflects the current state, not the future. It cannot verify that the sender intended to transfer or interact with the identity—the tool reads what is on‑chain, not the user's intent. It cannot detect risks for identities that use non‑standard patterns (e.g., custom verification logic not exposed via view functions, or identities managed by a multisig with complex validation). It cannot guarantee that a transfer or update transaction will succeed even if the sender appears to be the owner, as other conditions (e.g., paused state, guardian approvals, or expiry) may also need to be met. It cannot detect if the identity is blacklisted or flagged by external services (e.g., blocklists, sanctions lists). It cannot detect if the identity contract is a proxy pointing to an implementation that may have been upgraded with different logic, which could change the behavior of transfer or verification functions. It also cannot detect if the identity's metadata URI points to a valid or accessible off‑chain resource, or if the stored metadata has been tampered with off‑chain.

PLEASE NOTE

This tool works only for EVM‑compatible chains (Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche, etc.) and relies on standard identity interface functions (owner, controller, guardians, isVerified, isRevoked, expiry, name, metadata, canTransfer, isPaused). It does not support custom identity logic that does not expose these functions as public view methods. All explanations are AI‑generated from data the app reads on‑chain—the AI synthesizes the identity state, verification status, guardian configuration, event history, and transaction context into plain English, but it does not have special access to private contract logic or off‑chain data. Always review what you are actually signing in your wallet before approving any transaction; an identity risk assessment does not replace your own verification of the transaction details, including the target contract, the function you are calling, and the addresses involved. This tool is provided free of charge, with no warranty of accuracy or completeness.