Recursive Call Detector and Depth Limiter Tester

WHAT IT DOES

This tool detects recursive call patterns and tests depth limiter effectiveness by analyzing transaction traces and call hierarchies. It scans historical transaction data to identify recursive call patterns—where a function calls itself directly or indirectly—and evaluates the depth of these call chains against configurable depth limits. The detector flags recursive patterns that exceed safe depth thresholds, identifying potential stack overflow risks. Results are presented as a detailed report showing each recursive call path, its depth, gas usage, and a status indicator (ok/warn/bad) based on the configured depth limit. This is essential for developers identifying recursion vulnerabilities, auditors assessing stack safety, and teams ensuring contracts are protected against unbounded recursion attacks.

HOW TO USE

Connect your wallet (read-only, no transaction required) and select the target network. Enter the contract name and address, set the depth limit threshold (warn > this, bad > 2x), and set the lookback blocks for call analysis. Click "detect recursive calls" and the tool will verify the contract, fetch transaction traces and logs, and analyze call patterns for recursion. Results display a summary with total call paths, recursive call count, and a status badge, detailed call cards showing each call path with depth, gas usage, recursion status, and a table of all analyzed calls. Use the report to identify dangerous recursive patterns, validate depth limiter implementations, and prioritize fixes for high-risk recursion.

TECHNICAL MECHANISM

The analyzer uses ethers.js v5.7.2 to perform a multi-stage recursive call detection. First, it calls eth_getCode to verify the contract is deployed and uses block explorer APIs to fetch verification status and ABI. The tool then retrieves transaction data and traces using debug_traceTransaction (when available) and eth_getLogs across the specified block range. It constructs call trees from the trace data, identifying function call relationships including direct and indirect recursion. A recursive call is detected when a function appears multiple times in a single call path, indicating self-reference or mutual recursion with other functions. For each call path, the tool computes the maximum recursion depth, tracks gas consumption at each level, and evaluates whether the observed depth exceeds the user-defined threshold. The tool also analyzes call patterns for depth limiter effectiveness, checking whether recursive calls are bounded or could theoretically continue indefinitely. Each call path is assigned a status: ok (depth below threshold), warn (depth between threshold and 2x threshold), or bad (depth exceeds 2x threshold). Results are compiled into a structured report with detailed call path information, recursion detection, and depth analysis.

WHAT IT CANNOT SEE

This tool cannot detect recursive calls that are not captured in transaction traces, such as those that occur in transactions outside the analyzed range or in transactions that did not execute (reverted). It is limited by the RPC provider's rate limits and availability of debug_traceTransaction, which may be restricted on some providers (e.g., rate-limited, disabled, or only available for archival nodes). It cannot test depth limiter functionality without executing transactions—it only analyzes existing call patterns. The analysis relies on the accuracy and completeness of transaction trace data and contract verification; incomplete traces or missing transaction data may produce incomplete results. It cannot analyze contracts that are not verified or have opaque implementation details where recursion patterns are not distinguishable. The tool is limited to the specific transactions and contract instances that are accessible via RPC. It cannot guarantee detection of all possible recursive patterns without exhaustive transaction analysis across a large number of transactions. It cannot verify that depth limiters actually prevent stack overflow without actual execution testing—the tool provides analysis based on observed patterns, not active testing.

PLEASE NOTE

This is a read‑only analytics tool—it never submits transactions or modifies contract state. It is designed for EVM‑compatible chains and works best with verified contracts and providers that support debug_traceTransaction. The detection results are for informational and security audit purposes only and should not be considered a comprehensive guarantee of recursion safety. Always verify recursive patterns against actual contract behavior and test depth limiters in a safe environment. The depth limit thresholds are configurable and may need adjustment based on your specific contract's call patterns and the EVM's stack depth limit (1024).