Smart Contract Security Scanner

WHAT IT DOES

Smart Contract Security Scanner helps you identify common security vulnerabilities in any EVM contract. Enter a contract address and optionally provide the source code—the tool analyzes the bytecode for dangerous opcodes like SELFDESTRUCT, DELEGATECALL, and CALL, and scans the source code for patterns such as unprotected withdraw functions, use of tx.origin, reentrancy vulnerabilities, unchecked low-level calls, and outdated Solidity versions. It also displays on-chain metadata including the contract balance and transaction count. The results are presented with severity levels (critical, high, medium, low) and clear explanations, making it easy to prioritize issues. This is essential for developers, auditors, and users who want a quick security check before interacting with a contract.

HOW TO USE

Connect your EVM wallet (optional—the tool works read-only). Select the network from the dropdown. Enter the contract address (0x…42) you want to scan. Optionally, paste the contract source code in the source code field for a more comprehensive analysis—this enables detection of logic-based vulnerabilities like reentrancy and unprotected functions. Click "scan" to run the analysis. The tool fetches the bytecode and on-chain metadata, then runs pattern-based checks. The results display the contract's balance, transaction count, bytecode size, and a list of findings with severity badges and detailed descriptions. Use the "clear" button to reset all fields.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 via the BGWallet provider. It fetches the contract bytecode using provider.getCode(address) and on-chain metadata (balance with provider.getBalance() and transaction count with provider.getTransactionCount()). For bytecode analysis, it scans for specific opcode byte patterns: 0xFF for SELFDESTRUCT, 0xF4 for DELEGATECALL, and 0xF1 for CALL. For source code analysis, it performs pattern matching using regular expressions on the provided Solidity code, checking for reentrancy risks (call without reentrancy guard), unprotected withdraw functions, use of tx.origin, unchecked low-level calls, and outdated compiler versions. Findings are categorized by severity and displayed with human-readable descriptions.

WHAT IT CANNOT SEE

This tool cannot detect all vulnerabilities without full source code and context—bytecode-only analysis is limited to opcode patterns. It cannot identify logical flaws that are not pattern-based, such as complex business logic errors or economic attacks. It cannot analyze contracts with obfuscated or encrypted code. It cannot provide a comprehensive security audit—this is a heuristic surface-level scan. It cannot detect vulnerabilities in external libraries or dependencies. It cannot analyze contracts on non-EVM chains. It cannot simulate attacks or test exploitability. The tool is limited by the accuracy of the pattern database and the completeness of the provided source code. A clean scan does not guarantee the contract is secure.

PLEASE NOTE

Works exclusively on EVM-compatible chains: Ethereum Mainnet, Goerli, Sepolia, Polygon, Arbitrum, and Optimism. Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. This is a read-only, free security analysis tool—use it for initial contract inspection and to identify areas that warrant deeper review. The presence of a finding does not guarantee a vulnerability exists, and the absence of findings does not guarantee security. Always perform a full professional security audit before deploying or interacting with any contract.