Initializer Function Reentrancy Guard Checker

WHAT IT DOES

This tool connects to your EVM wallet and checks initializer functions for proper reentrancy guards. It reads contract source code to identify initializer functions (initialize, init, __init_*), detects reentrancy guard patterns including nonReentrant and initializer modifiers, and identifies external call patterns within initializer functions. The tool flags initializers that lack guards, especially those containing external calls, to help prevent reentrancy vulnerabilities in upgradeable contracts.

HOW TO USE

Connect your Web3 wallet using the Connect button. Paste your contract source code in the Contract Source Code field. Enter the contract name (optional). Click "Check Guards" to analyze the contract for initializer functions and guard patterns. Click "Load Sample" to populate fields with an example contract containing various guard scenarios. Results appear in the Results card with a summary of initializers found, guarded vs. unguarded count, and status, followed by a detailed breakdown of each initializer with its guard status and context.

TECHNICAL MECHANISM: INITIALIZER DETECTION AND GUARD ANALYSIS

The tool uses regular expression pattern matching to parse contract source code. It identifies initializer functions by looking for functions named initialize, init, or those starting with __init_ with a modifier. For each detected initializer, it checks the surrounding context for the presence of reentrancy guard modifiers: nonReentrant (OpenZeppelin), initializer (OpenZeppelin Initializable), onlyInitializing, and reentrancyGuard. The tool also detects external call patterns within initializer functions using .call(), .delegatecall(), .transfer(), and .send(). Each initializer is categorized as guarded or unguarded, with severity flagged higher for unguarded initializers that contain external calls.

WHAT IT CANNOT SEE

This tool cannot dynamically test for reentrancy vulnerabilities—it performs static analysis only. It cannot detect reentrancy that depends on complex state interactions or cross-contract calls—the tool analyzes only the provided source code. It cannot guarantee that flagged patterns are actual vulnerabilities—some unguarded initializers may be safe in specific contexts. It relies on source code parsing and may produce false positives or miss complex patterns. It cannot analyze contracts with obfuscated or highly optimized code—the tool works best with readable source code. It cannot detect vulnerabilities that require specific execution contexts—the tool only performs structural analysis.

PLEASE NOTE

This is a read-only tool—it never signs transactions. All data is processed in-memory and never persists. The tool supports EVM chains only—Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche, Base, and Fantom. Initializer functions in upgradeable contracts are particularly sensitive—always ensure they are properly guarded. The tool performs static analysis and should be used as a starting point for security review, not as a final audit. OpenZeppelin's Initializable and ReentrancyGuard patterns are recommended for upgradeable contracts.