Static Analysis Finding Triage Tool

WHAT IT DOES

Static Analysis Finding Triage Tool scans Solidity source code for common security vulnerabilities, code smells, and risky patterns. It analyzes the source code you provide (or verifies the contract exists on-chain) and reports findings categorized by severity: Critical, High, Medium, Low, and Info. Each finding includes a clear description, the location in the source code (line number and snippet), and a practical suggestion for remediation. The tool checks for unsafe external calls, tx.origin usage, selfdestruct, block.timestamp reliance, unchecked arithmetic, assembly blocks, transfer/send gas issues, missing events, commented-out code, and missing access control — all in one triage pass. It is designed as a quick first-pass review to highlight obvious issues before deeper manual or formal verification.

HOW TO USE

Paste a contract address into the address field — the tool will verify that a contract exists at that address on your selected network. Then paste the contract's Solidity source code into the source code text area. Click "Run static analysis" to begin the scan. The tool processes the source line-by-line, applying pattern-matching rules to detect known anti-patterns and vulnerabilities. Results appear in the results card, organized by severity with critical and high-severity findings shown first. Each finding displays the line number, a description of the issue, and a recommendation for fixing it. If you do not have the source code, the tool will still verify the contract's existence and suggest that you paste the source for a meaningful analysis.

THE REAL MECHANISM — why this beats a basic linter

Most code linters check for style and syntax, but they do not understand EVM-specific security pitfalls. This tool combines a curated set of security rules derived from the Smart Contract Security Best Practices guide and common attack vectors. The analyzer tokenizes the source code line-by-line and applies regular expression patterns that match dangerous EVM constructs: calls that ignore return values (call, delegatecall, staticcall), use of tx.origin which is vulnerable to phishing, selfdestruct which can kill a contract, block.timestamp used for critical logic, arithmetic operations without explicit safety checks, and low-level assembly. It also detects missing events, lack of access control on public functions, and commented-out code that indicates incomplete features. The severity classification follows a risk-based model: selfdestruct and tx.origin are critical/high because they can lead to loss of funds or total compromise; block.timestamp manipulation and unchecked external calls are medium because they require specific conditions to exploit; and missing events or commented code are informational. The output is structured to help developers prioritize fixes, with the most dangerous issues at the top.

WHAT IT CANNOT SEE

- Cannot detect vulnerabilities that require runtime context, such as reentrancy with complex state changes, cross-function race conditions, or flash loan attacks that depend on transaction ordering.

- Cannot prove the absence of vulnerabilities — no static analyzer can guarantee a contract is completely secure.

- Cannot analyze contracts that are not verified on a block explorer and have no source code provided — without source, the tool can only check if the contract exists.

- Cannot detect logic flaws that do not appear in static patterns, such as incorrect business logic, broken access control across multiple functions, or subtle mathematical errors that are not simple overflows.

- Cannot assess deployment-specific risks like privileged roles being assigned to unsafe addresses, timelock configurations, or proxy upgrade patterns without manual review of those parameters.

- Cannot determine if findings are actually exploitable in the current chain state — a finding is a warning, not a proof of exploitability.

- Cannot detect vulnerabilities in dependencies or imported libraries — only the code you paste is analyzed.

- Cannot decode obfuscated code or code that uses complex inheritance where patterns are spread across multiple files.

PLEASE NOTE

This tool works exclusively with Solidity source code on EVM-compatible chains (Ethereum, Goerli, Sepolia, Polygon, Arbitrum, Optimism). It does not support Vyper, Huff, Yul, or non-EVM languages. The tool is read-only — it never sends transactions. No data is stored remotely; all analysis happens in your browser. Findings are heuristic and may include false positives — always manually review any flagged code. For production contracts, combine this tool with formal verification, manual auditing, and test coverage analysis. Use this tool as a triage aid, not as a substitute for professional security review.