Token Contract Backdoor Scanner

WHAT IT DOES

Token Contract Backdoor Scanner reads live on-chain bytecode from any EVM smart contract and uses AI to detect hidden backdoors, undocumented admin capabilities, selfdestruct risks, delegatecall exploits, and secret ownership mechanisms. It examines contract bytecode for selfdestruct/suicide opcode patterns that can destroy the contract and trap funds. It scans for delegatecall and callcode patterns that enable proxy-based attacks or arbitrary code execution. It detects function signatures not documented in source that may represent hidden admin functions. It identifies function selector collisions, fallback functions with side effects, and receive functions that can drain tokens. It analyzes proxy implementation addresses and upgrade permissions. The AI generates a plain-language verdict—SAFE, RISKY, or CRITICAL—along with specific explanations of the backdoor risks before you interact with the contract.

HOW TO USE

Paste any EVM smart contract address into the input field. The tool reads the contract's bytecode and scans for known backdoor and admin function signatures using 4-byte method identifiers—setImplementation() (0x51cff8d9), upgradeTo() (0x3659cfe6), withdraw() (0x2e1a7d4d), setFee() (0x1a3044c4), setSellFee() (0x8b2c78e4), setBuyFee() (0x8f59485e), addToBlacklist() (0xfa4c9e8d), removeFromBlacklist() (0x6a1a5a3e), mint() (0x40c10f19), burn() (0x9dc29fac), transferOwnership() (0xf2fde38b), and renounceOwnership() (0x715018a6). It also scans for dangerous opcode patterns including selfdestruct (0xff), delegatecall (0xf4), and proxy implementation patterns. It extracts hidden function selectors from bytecode to identify unlisted functions. The AI receives all this data and returns a verdict: SAFE (no backdoor patterns), RISKY (backdoor functions exist with some controls), or CRITICAL (selfdestruct, delegatecall, or multiple hidden admin functions). The AI also provides a detailed plain-language explanation of the specific backdoor risks.

BYTECODE OPCODE SCANNING AND SELECTOR EXTRACTION

The tool scans the contract's raw bytecode for dangerous EVM opcodes including SELFDESTRUCT (0xff), DELEGATECALL (0xf4), and CALLCODE (0xf2) which can enable contract destruction or arbitrary code execution. It detects proxy patterns by scanning for common proxy implementation sequences such as 0x3d602d (fallback delegatecall) and 0x3600 (calldata copy). It extracts 4-byte function selectors from the bytecode by identifying patterns that match the standard function signature format, then cross-references them against a database of known backdoor and admin function signatures. It flags selectors that appear in the bytecode but are not part of standard ERC-20 or common token interfaces. The tool does not require executing a transaction to detect these patterns; it reads the deployed bytecode directly from the chain. If a selfdestruct opcode is present alongside admin functions, it elevates the risk level to critical due to the potential for fund destruction or theft.

WHAT IT CANNOT SEE

This tool cannot detect backdoors that require specific off-chain signatures or multi-step triggers not visible on-chain—a contract could have a hidden function that is only callable with a specific private key signature not visible in the bytecode. It cannot analyze bytecode that is obfuscated beyond EVM disassembly limits; some contracts use anti-analysis techniques that hide true behavior. It cannot verify if a function is genuinely hidden vs simply undocumented in the source code. It cannot detect backdoors that are time-locked or require specific block timing. It cannot detect backdoors implemented through external contract calls to unverified contracts. It cannot see pending upgrade transactions not yet executed on-chain. It cannot verify developer intent or source code accuracy. It cannot detect backdoors that are activated through storage manipulation or cross-contract calls.

PLEASE NOTE

EVM chains only. This tool reads on-chain data and generates AI explanations—it does NOT sign transactions or execute any on-chain actions. The wallet's own signature prompt remains the final gate for every real action. Always review the exact transaction details in your wallet before approving any contract interaction. The AI assessment is informational only and does not constitute financial or security advice. Always verify contract details independently through block explorers and official project documentation before assuming any contract is safe to interact with.