Owner Function Enumeration Tool from Source

WHAT IT DOES

This tool reads the Solidity source code you provide and enumerates all functions that are protected by owner-only access controls. It scans for common modifiers like onlyOwner, ownerOnly, isOwner, and onlyRole, as well as inline require statements that check msg.sender against the owner variable. It also flags functions with names containing "owner", "admin", or "governor" even if no explicit modifier is found, as these may represent privileged entry points. The output lists each function signature and the specific mechanism that appears to restrict it. This makes it easy to audit a contract's privileged surface area before deployment or interaction.

HOW TO USE

Connect your wallet via the BGWallet bridge — this provides the RPC endpoint for optional on-chain bytecode verification. Select the network where your contract is deployed. Enter the contract address and paste the full Solidity source code into the text area. Click "Enumerate owner functions". The tool cleans the source by stripping comments and strings, then uses regular expressions to locate function definitions and scan their bodies for access-control patterns. It also attempts to fetch the on-chain bytecode to confirm that a contract exists at the address you provided (it does not perform a full compilation match, but it does verify that code is present). Results are displayed in a table showing each function, its signature, and the modifier or check that was detected.

ONE TECHNICAL SECTION

The enumeration is performed using a lightweight parser that operates entirely in the browser. It first removes comments (both single-line and multi-line) and string literals to avoid false positives from commented-out code or string content. Then it scans for function definitions using a regular expression that captures the function name, parameters, and the function body. For each function body, it searches for occurrences of "onlyOwner", "ownerOnly", "isOwner", or "onlyRole" as well as common require patterns like "require(msg.sender == owner)" or "require(owner == msg.sender)". Functions that match any of these are flagged as owner-only. Additionally, functions whose names contain "owner", "admin", or "governor" but lack any detected modifier are listed separately as "possible" owner functions. The tool also attempts to fetch the bytecode from the provided address via eth_getCode, and shows a snippet of the code to confirm the contract exists. This approach does not require compiling the source or performing any cryptographic verification — it is a fast, heuristic analysis that runs client-side.

WHAT IT CANNOT SEE

This tool cannot verify that the source code you paste actually matches the on-chain bytecode — it does not compile the source or compare the deployed bytecode. It cannot detect runtime code changes introduced by proxy patterns (e.g., upgradeable contracts) unless the proxy's implementation address is manually provided and analyzed separately. It cannot assess the security of the owner address itself — a function may be owner-only, but the tool cannot tell you whether the owner address is a hardware wallet, a multi-sig, or a vulnerable EOA. It cannot detect owner-like functions that use non-standard access-control patterns, such as custom modifiers with different names, inline checks that do not follow the exact patterns we search for, or functions that check a role other than DEFAULT_ADMIN_ROLE without using the "onlyRole" keyword. It also cannot identify functions that are restricted in a different way (e.g., by a time lock or by a specific whitelist) unless they follow the exact patterns above.

PLEASE NOTE

This tool works exclusively with Solidity source code on EVM-compatible chains. It does not support Vyper or other smart-contract languages. The on-chain bytecode check is optional and will fail if the contract is on a different network than your wallet is connected to, or if the address is not a contract. The enumeration is regex-based and may produce false positives or miss edge cases — always manually review the source code and use a proper security audit for critical contracts. This tool is read-only and does not sign or send any transactions.