Implementation Contract Verifier

WHAT IT DOES

Implementation Contract Verifier is a read-only tool that analyzes implementation contracts for proxy patterns, verifying their authenticity and identifying potential risks, generating AI-powered plain-language explanations of verification status. It reads proxy contract address, implementation address, contract bytecode of implementation, source code verification status, verified source code, ABI, function signatures, storage layout, compiler version, optimization settings, contract creation code, deployment transaction, chain ID, block explorer metadata, upgrade history, privileged function signatures, and proxy admin address. The tool then presents this data alongside an AI-generated analysis of whether the implementation contract is verified, comparing its bytecode against known sources, identifying potential discrepancies, and explaining the risks of using an unverified or suspicious implementation — helping you understand the trustworthiness of a proxy contract before interacting with it.

HOW TO USE

Connect your wallet using the BGWallet bridge and select your target network. Enter either the proxy contract address (to auto-detect the implementation) or the implementation contract address directly. Optionally enter the other address for cross-reference. Click "Verify implementation" to read on-chain contract data. The tool displays the contract address, proxy admin, verification status (Verified/Partial/Unverified), and bytecode hash. Detailed information includes compiler version, optimization settings, function signatures, storage layout, creation block, deployment transaction, upgrade history, privileged functions, and discrepancies. A risk assessment box provides a summary risk level. An AI explanation appears below the on-chain data, verifying whether the implementation contract is verified, comparing its bytecode against known sources if available, identifying discrepancies or suspicious patterns, and explaining the risks of using an unverified or suspicious implementation before you interact with the proxy. The wallet's own signature step still protects you — this explanation is informational only and does not replace reviewing what you approve in your wallet.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 with the provider from the BGWallet bridge to read on-chain contract data. No hardcoded contract addresses are used — you are always in control of which contract you trust. When verifying implementation contracts, the tool reads the proxy contract address from the user input, auto-detects the implementation address from the proxy's EIP-1967 storage slot (if a proxy is provided), reads the contract bytecode of the implementation via provider.getCode(implementation), checks source code verification status via block explorer metadata (simulated), reads the verified source code (if available), reads the ABI from the verified source code, reads function signatures by analyzing the ABI or bytecode, reads the storage layout by analyzing the bytecode and storage slots, reads the compiler version and optimization settings from the contract metadata, reads the contract creation code from the deployment transaction, reads the deployment transaction via provider.getTransactionReceipt(implementation), reads the chain ID via provider.getNetwork(), reads block explorer metadata via API (simulated), reads upgrade history by scanning event logs (e.g., Upgraded events), reads privileged function signatures by analyzing function selectors, and reads the proxy admin address from the proxy storage slot. The tool fetches event logs by walking backwards in chunks and halving chunk size on failure, ensuring logs are properly read despite varying RPC limitations. The data is formatted and passed to the AI bridge via BGAI.generate() with a structured prompt that includes all the on-chain data read. The AI is instructed to verify whether the implementation contract is verified, compare its bytecode against known sources, identify any discrepancies or suspicious patterns, and explain the risks of using an unverified or suspicious implementation — while stating plainly that it cannot verify that the on-chain bytecode matches the stated source code if the contract is not verified on a block explorer, cannot detect intentional malicious code that is obscured or obfuscated, and cannot guarantee that the implementation contract's behavior matches expectations based solely on bytecode analysis. The AI response is capped at 1,024 tokens to ensure concise, focused verification assessments. All computed values are guarded against negative numbers — if a bytecode hash or block number appears invalid, the tool flags it rather than displaying nonsensical values.

WHAT IT CANNOT SEE

This tool cannot verify that the on-chain bytecode matches the stated source code if the contract is not verified on a block explorer. It cannot detect intentional malicious code that is obscured or obfuscated. It cannot guarantee that the implementation contract's behavior matches expectations based solely on bytecode analysis. It cannot detect off-chain logic or social engineering attacks. The AI explanation is generated from on-chain data only and cannot detect hidden malicious code, off-chain verification status, or social engineering attacks. It cannot predict whether an unverified implementation contains malicious logic. The tool does not continuously monitor verification status; each analysis is a snapshot at the time of the lookup. It cannot detect delayed verification updates, hidden proxy upgrades, or off-chain factors. The tool does not store any data persistently; all state is in-memory and resets on reload. The AI explanation is informational and does not constitute financial advice, legal advice, or a guarantee of contract safety or implementation trustworthiness.

PLEASE NOTE

Implementation Contract Verifier works exclusively with EVM-compatible chains. It requires a Web3 wallet (MetaMask or similar) and the BGWallet bridge. Explanations are AI-generated from data the app reads on-chain — always review what you are actually signing in your wallet before approving it. Unverified implementation contracts carry significant risk including malicious code, hidden backdoors, and loss of funds. Use this tool as a guide only; always cross-check with block explorers and independent sources for critical decisions. This is experimental software; use at your own risk.