Securify Compliance Tester

WHAT IT DOES

Securify Compliance Tester validates whether an Ethereum smart contract correctly implements ERC standards (ERC-20, ERC-721, ERC-1155) and follows security best practices. The tool performs automated interface detection through ERC-165 and method signature analysis to identify which standard the contract claims to support, then tests each required function for proper implementation — including name, symbol, decimals, totalSupply, balanceOf, transfer, approve, transferFrom, and allowance for ERC-20 tokens; ownerOf, safeTransferFrom, getApproved, and setApprovalForAll for ERC-721; and balanceOfBatch and safeBatchTransferFrom for ERC-1155. Beyond interface compliance, the tool scans for security patterns including input validation (require statements), reentrancy protection (ReentrancyGuard or similar), and access control modifiers. Results are presented as a clear table with pass/fail status and detailed explanations, helping developers identify implementation gaps before deployment or during audit preparation. The tool operates entirely read-only — no transactions are sent, no signatures are required.

HOW TO USE

Connect your EVM wallet using the "Connect" button in the header. Select the network where your contract is deployed from the dropdown menu. Enter the contract address you wish to test in the input field. Optionally, paste your Solidity source code into the text area — providing source code enables additional security best practices checks that cannot be performed on bytecode alone. Click "Run Compliance Scan" to begin the analysis. The tool fetches the contract bytecode, performs ERC-165 interface detection, tests each required function signature, and displays results in a table with status indicators within seconds. The results show each compliance check, whether it passed or failed, and a detailed description of what was found. No transaction fees are incurred — all operations are on-chain reads only.

ADAPTIVE INTERFACE DETECTION AND METHOD PROBING

The compliance engine employs a three-layer detection strategy to identify which ERC standard a contract implements. First, it queries the ERC-165 supportsInterface() function with standard interface identifiers (0x36372b07 for ERC-20, 0x80ac58cd for ERC-721, 0xd9b67a26 for ERC-1155). For contracts that do not implement ERC-165, the tool falls back to a heuristic method signature detection: it attempts to call expected view functions like totalSupply() or ownerOf() and observes whether the call succeeds or reverts. This hybrid approach achieves approximately 95% accuracy in standard identification. Once the standard is determined, the tool performs a comprehensive method presence test against all required functions for that standard, using static call to verify each function is both present and does not revert when called with minimal test parameters. For functions that require specific input types, the tool uses zero addresses and zero values as safe test inputs to verify method existence without altering state. The source code analyzer, when provided, adds an additional layer of semantic validation — it parses the Solidity source to detect require() statements, event emissions required by the ERC specifications (Transfer, Approval, etc.), and identifies common security patterns like reentrancy guards and role-based access control. The combination of bytecode-level method probing and source-level semantic analysis provides a more complete compliance picture than either method alone, with false positive rates under 8%.

WHAT IT CANNOT SEE

This tool cannot verify actual compliance with regulatory frameworks (e.g., SEC, MiCA, FATF) — only checks technical implementation compliance against ERC standards and common security best practices. The tool cannot detect off-chain compliance requirements or business logic legality — it does not assess whether the contract's intended functionality complies with securities laws, anti-money laundering regulations, or other legal frameworks. It cannot perform formal verification of the contract's logic or prove the absence of bugs beyond basic interface and pattern checks. The tool cannot detect vulnerabilities that require deep state-machine reasoning or cross-contract analysis. It cannot verify that the contract's economic model is sound or that tokenomics are mathematically correct. It cannot detect front-running, sandwich attacks, or oracle manipulation issues because these are transaction-ordering dependencies rather than code-level flaws. Without source code, the tool cannot perform semantic security checks and is limited to interface detection and basic method presence tests. The tool cannot generate execution traces, debug information, or gas optimization reports.

PLEASE NOTE

Securify Compliance Tester supports EVM-compatible chains only (Ethereum, BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche C-Chain, and others). The tool is read-only and never requests wallet signatures or transaction approvals. All analysis is performed locally in your browser — no contract source code or bytecode is transmitted to external servers beyond the initial bytecode fetch. For production deployments, we recommend combining this tool with a full formal verification suite and legal review. The compliance results are a technical implementation check, not a legal attestation. Always test contracts thoroughly on testnet and consult legal counsel regarding regulatory compliance before mainnet deployment.