Selfdestruct Usage Flagger

WHAT IT DOES

Selfdestruct Usage Flagger is a read-only security analysis tool that scans EVM smart contract bytecode to detect the presence of the SELFDESTRUCT opcode. Given any verified or unverified contract address, it fetches the deployment bytecode and performs a static scan for the 0xff opcode that triggers self-destruction. The tool presents a clear pass/fail result, helping developers, auditors, and security researchers quickly identify contracts that contain this potentially dangerous opcode.

HOW TO USE

Connect your EVM-compatible wallet (e.g., MetaMask, WalletConnect) via the BGWallet bridge. Select the network where the target contract is deployed—Ethereum Mainnet, Goerli, Sepolia, Polygon, Optimism, Arbitrum, BSC, or Avalanche C-Chain. Paste the contract address and click "Scan for SELFDESTRUCT". The tool fetches the bytecode and displays the result. No signatures or transactions are submitted; the tool never writes to the chain.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 to call provider.getCode(address) on the selected network, retrieving the runtime bytecode of the contract. It then strips the "0x" prefix and scans the hexadecimal string for the byte pattern "ff", which corresponds to the SELFDESTRUCT opcode. This is a pure static analysis—no state queries, no simulation, and no execution. The scan is instantaneous for any contract that has been deployed, as the bytecode is stored in the blockchain state trie. The tool does not rely on source code verification, meaning it works even for unverified or obfuscated contracts. It does not perform control-flow analysis or attempt to determine reachability; it simply reports whether the opcode exists anywhere in the bytecode.

WHAT IT CANNOT SEE

This tool has fundamental limits that users must understand. It cannot determine whether the SELFDESTRUCT opcode is actually reachable under any execution path—the opcode may be present but guarded by conditional logic that makes it impossible to trigger in practice. It cannot detect selfdestruct logic that is hidden behind delegatecall or proxy patterns if the opcode resides in an implementation contract that is not the one being scanned; scanning the proxy address alone will show no SELFDESTRUCT, even though the implementation may contain it. It also cannot detect obfuscated or dynamically generated selfdestruct targets that are computed at runtime. The tool does not perform symbolic execution or taint analysis, so it cannot trace whether a selfdestruct call is protected by access controls, time locks, or multi-signature requirements. It is a first-pass warning system, not a final security audit.

PLEASE NOTE

This tool only supports EVM-compatible blockchains (Ethereum, Polygon, BSC, Avalanche C-Chain, Optimism, Arbitrum, and their testnets). Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. The tool is free, open-source, and requires no API keys—it uses the wallet's native provider.