Reentrancy Pattern Scanner

WHAT IT DOES

This tool connects to your EVM wallet and scans smart contracts for reentrancy patterns and potential vulnerabilities. It reads contract source code and analyzes function signatures, control flow structures, and external call patterns to identify risks. The tool detects low-level .call(), send(), transfer(), and other external call patterns that may indicate reentrancy vulnerabilities. It also looks for common security patterns like nonReentrant modifiers and checks-effects-interactions ordering, providing a risk assessment and detailed findings.

HOW TO USE

Connect your Web3 wallet using the Connect button. Enter the contract address in the Contract Address field (optional) and/or paste the contract source code in the Source Code field. Click "Scan for Reentrancy" to analyze the contract. Click "Load Sample Pattern" to load a vulnerable contract example for testing. Results appear in the Results card with a summary including the contract identifier, number of findings, and risk level (High, Medium, Low, or None Detected), followed by a detailed breakdown of each detected pattern.

TECHNICAL MECHANISM: PATTERN-BASED SOURCE CODE ANALYSIS

The tool uses regular expression pattern matching to scan contract source code for known reentrancy indicators. It searches for low-level calls via .call(), .send(), and .transfer() methods, particularly when used in external functions. It looks for patterns where external calls are made before state updates (checks-effects-interactions violations). The tool also detects the presence of reentrancy guards like nonReentrant modifiers and positive security patterns. Each finding is categorized by severity (High, Medium, Info, Good) and displayed with the matching pattern. Risk level is determined by the presence of high-severity findings, with high-severity patterns indicating the most concerning vulnerabilities.

WHAT IT CANNOT SEE

This tool cannot execute contracts or test for reentrancy dynamically—it relies on static analysis only. It cannot detect reentrancy that depends on complex state interactions or cross-contract calls—the tool does not analyze cross-contract relationships. It cannot guarantee that flagged patterns are actual vulnerabilities—pattern matches may be false positives. It relies on pattern matching and may produce false positives or miss patterns not in the detection list. It cannot analyze contracts with obfuscated or highly optimized bytecode—the tool works best with human-readable source code. It cannot detect vulnerabilities that require specific execution contexts or sequences of transactions.

PLEASE NOTE

This is a read-only tool—it never signs transactions. All data is processed in-memory and never persists. The tool supports EVM chains only—Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche, Base, and Fantom. The scanner is a pattern-matching tool and does not replace professional security audits. Findings should be reviewed by security experts. The presence or absence of patterns does not guarantee contract safety. Always conduct thorough security reviews before deploying smart contracts.