Read-Only Reentrancy Vulnerability Scanner

WHAT IT DOES

Read-Only Reentrancy Vulnerability Scanner helps developers and auditors detect a subtle but dangerous class of reentrancy that affects view and pure functions. Unlike traditional reentrancy that modifies state, read-only reentrancy occurs when a view function makes an external call that re-enters the contract and changes state before the view function completes its read. This can lead to stale or manipulated data being returned, which may break price oracles, governance checks, or access control decisions. The scanner analyzes your contract source to identify view/pure functions that combine external calls with state reads, flagging potential read-only reentrancy vectors.

HOW TO USE

Paste your Solidity contract source into the input area. Click "scan for read-only reentrancy". The tool analyzes each view and pure function, looking for external calls (call, delegatecall, staticcall) followed by state reads (mapping lookups, balance checks, msg/block access). Results are categorized by severity: Critical (state read after external call), High (external call with state reads), Medium (cross-function calls or require after external call), or Low/None. Each finding includes a description and recommendation for remediation. Use this to audit your view functions before deployment or during code review.

THE REAL MECHANISM

The scanner parses the contract source line by line to extract function definitions, bodies, and visibility modifiers. It distinguishes view/pure functions from state‑modifying ones. For each view function, it checks for external calls using patterns like .call(), .delegatecall(), and .staticcall(). It then tracks whether the function reads state after the external call — using heuristics like mapping lookups (balances[user]), balance checks (.balance), and global variables (msg.sender, block.timestamp). If state reads occur after an external call, the scanner flags a critical finding. It also detects cross‑function calls within the same contract and requires after external calls, which may indicate conditional reentrancy vectors. All analysis is static and does not execute the code.

WHAT IT CANNOT SEE

The tool cannot detect all read‑only reentrancy paths, determine if read‑only reentrancy is exploitable without full execution, handle complex cross‑contract read‑only reentrancy, detect read‑only reentrancy through delegatecall (which changes the execution context), verify that view/pure functions are safe, or detect read‑only reentrancy that depends on block context or transaction ordering. The analysis is heuristic — it may produce false positives or miss subtle vulnerabilities. Always combine with manual code review and dynamic testing.

PLEASE NOTE — EVM CHAINS ONLY

This tool is designed for Solidity contracts on Ethereum Virtual Machine (EVM) compatible chains. It relies on EVM‑specific patterns and semantics. All processing occurs in your browser; no contract data is stored or transmitted.