Oracle Manipulation Vulnerability Scanner

WHAT IT DOES

Oracle Manipulation Vulnerability Scanner is a security-focused tool that scans Solidity contracts for oracle manipulation vulnerabilities, particularly in price feed integrations. It takes contract source code from the user and analyzes it for oracle usage patterns, price feed validation, and data integrity checks. The tool identifies critical patterns including Chainlink price feed usage, latestRoundData() calls without validation, unvalidated price assignments, stale price checks, round ID validation, and function logic using price data. Each finding is classified by severity (critical, high, medium, low, or info) based on the potential for oracle manipulation. The tool provides detailed descriptions of each vulnerability, the exact location in the source code, and actionable recommendations for remediation. This enables developers to identify and fix oracle manipulation vulnerabilities before deployment.

HOW TO USE

Paste your Solidity contract source code into the input area. Click "Scan for oracle vulnerabilities" to analyze the code. The tool will display a summary showing counts of critical, high, medium, and low severity issues. Each vulnerability entry includes the name, severity, description, location (line number and context), and a recommendation for fixing the issue. The scan report can be copied or downloaded as JSON for further analysis.

TECHNICAL NOTE: ORACLE PATTERN DETECTION AND VALIDATION ANALYSIS

The tool uses regex-based pattern matching to detect oracle manipulation vulnerabilities in Solidity source code. It scans for Chainlink AggregatorV3Interface usage, latestRoundData() calls, price validation patterns, staleness checks, round ID validation, and price getter functions. Each pattern is mapped to a severity level based on the potential for manipulation: critical for unvalidated latestRoundData() calls and price assignments without validation, high for price feed usage without proper validation checks, medium for price getter functions without validation, and low for informational findings about imports and feed initialization. The tool also detects if price feed data is used in contract logic without proper validation.

WHAT IT CANNOT SEE

The tool cannot detect all oracle manipulation issues without context; some patterns may be safe depending on the specific application logic and oracle setup. It is limited to the accuracy of the source code analysis; syntax variations may cause false positives or negatives. It cannot detect issues in external contracts or libraries that are imported into the contract. It cannot verify if an oracle manipulation vulnerability is actually exploitable in the specific deployment environment. The tool is limited by the parser's ability to handle Solidity syntax variations, including newer language features. It cannot scan for oracle manipulation on non-EVM chains.

PLEASE NOTE

This tool is designed exclusively for Solidity contracts on EVM-compatible chains. It does not support other smart contract languages. The scan results are based on static analysis and may produce false positives or miss some issues. Always verify the findings with manual review and testing. The tool is read-only and does not modify any state. The tool provides no warranty that the scan results are complete or accurate; users are responsible for validating all findings and implementing appropriate fixes.