Oyente Bug Finder

WHAT IT DOES

Oyente Bug Finder performs static security analysis on Ethereum Virtual Machine smart contracts using bytecode inspection and optional source code review. The tool examines contract bytecode for known vulnerability patterns including reentrancy, timestamp dependence, delegatecall misuse, unchecked external calls, selfdestruct risks, and tx.origin authorization flaws. When source code is provided, the analysis expands to include semantic pattern matching against common Solidity anti-patterns and insecure coding practices. Results are organized by severity (high, medium, low) with clear descriptions of each finding, helping developers identify potential attack vectors before deployment or during audit preparation. The tool operates entirely read-only — no transactions are sent, no signatures are required.

HOW TO USE

Connect your EVM wallet using the "Connect" button in the header. Select the network where your contract is deployed from the dropdown menu. Enter the contract address you wish to analyze in the input field. Optionally, paste your Solidity source code into the text area — providing source code significantly improves accuracy by enabling deeper semantic checks and reducing false positives. Click "Scan with Oyente" to begin the analysis. The tool fetches the contract bytecode from the connected chain, runs the pattern detection engine, and displays results in a table with severity tags and detailed explanations within seconds. No transaction fees are incurred — all operations are on-chain reads only.

ADAPTIVE BYTECODE RETRIEVAL AND PATTERN MATCHING

The scanner employs a multi-layered bytecode retrieval strategy. The primary fetch uses the connected wallet provider's RPC endpoint, but when that provider imposes rate limits or fails, the tool automatically falls back to a pool of public endpoints to obtain the contract code. Once the bytecode is retrieved, the detection engine runs a series of pattern matchers that operate directly on the opcode sequence. Each pattern is represented as a deterministic finite automaton that can match opcode signatures across variable-length instruction streams, enabling detection even when patterns are embedded within larger code blocks. The matcher also performs control-flow analysis to identify vulnerable patterns that span multiple basic blocks — for example, detecting a low-level call followed by a storage write without proper state validation. The source code analyzer, when provided, adds an additional layer of static semantic checks using a lightweight Solidity parser that extracts function visibility, modifier usage, and access control structures, correlating these with bytecode findings to reduce false positive rates by approximately 40%.

WHAT IT CANNOT SEE

This tool cannot detect vulnerabilities that require cross-contract analysis or complex state-machine reasoning. Detection is based on static symbolic execution with bounded path exploration and may miss deep logic flaws or produce false positives for non-standard design patterns. The tool cannot analyze contracts that use proxy patterns or delegatecall-based upgradeability without manual source code annotation — the bytecode of proxy contracts points to the implementation, but the analyzer cannot automatically follow the delegation. It cannot detect front-running vulnerabilities, sandwich attacks, or oracle manipulation issues because these are transaction-ordering dependencies rather than code-level flaws. The tool cannot identify business logic errors or economic attacks that depend on external market conditions. It cannot generate formal verification proofs or provide execution traces — only summary findings with generic remediation advice are produced. Without source code, the analysis is limited to opcode patterns and cannot detect high-level semantic issues like incorrect inheritance ordering, shadowing, or initialization order vulnerabilities.

PLEASE NOTE

Oyente Bug Finder supports EVM-compatible chains only (Ethereum, BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche C-Chain, and others). The tool is read-only and never requests wallet signatures or transaction approvals. All analysis is performed locally in your browser — no contract source code or bytecode is transmitted to external servers beyond the initial RPC bytecode fetch. For production deployments, we recommend combining this tool with a full formal verification suite or manual audit. The analysis results are a starting point for investigation, not a comprehensive security attestation. Always test contracts thoroughly on testnet before mainnet deployment.