Unreachable Branch Detector via Coverage Data

WHAT IT DOES

This tool detects unreachable conditional branches in deployed smart contracts by combining source code analysis with historical transaction data. It first fetches the contract's verified source code via block explorer APIs (e.g., Etherscan), parsing the control flow to identify all conditional statements (if/else, require, assert, modifiers) and their associated branch logic. It then analyzes historical transaction logs across a user-defined block range, extracting function selectors and call patterns to determine which branches have actually been executed. The results are presented as a comprehensive report showing each branch's status (reachable or unreachable), the condition being tested, the function it belongs to, and the number of calls observed. This is essential for developers seeking to remove dead code paths, auditors assessing test coverage, and teams optimizing contract size and gas costs by eliminating unnecessary logic.

HOW TO USE

Connect your wallet (read-only, no transaction required) and select the target network. Enter the contract address you want to analyze, specify the block range and chunk size, and optionally provide an Etherscan API key for source code verification. Click "detect unreachable branches" and the tool will first attempt to fetch and parse the contract's source code, identifying all conditional branches. It then scans historical logs across the specified range, extracting method IDs from transaction calldata to determine which branches have been executed. Results display with unreachable branches highlighted, alongside a summary of total branches, reachable vs. unreachable counts, and a detailed breakdown table. Use this data to identify code paths that can be safely removed in future contract upgrades.

TECHNICAL MECHANISM

The analyzer uses ethers.js v5.7.2 to perform a multi-stage analysis. First, it attempts to fetch the contract's source code using Etherscan's verification API (if an API key is provided) or falls back to heuristic bytecode analysis. The source code is parsed to identify all conditional constructs (if statements, require checks, assert statements, and modifier conditions), mapping each branch to its containing function and the condition being tested. Second, it performs eth_getLogs queries across the specified block range, automatically handling RPC rate limits through a chunk-and-halve strategy that reduces chunk size on failure until the scan completes. Third, for each log found, it fetches the associated transaction data and extracts the first 4 bytes of calldata (the method ID). By correlating method IDs with the parsed source code—understanding which branches exist within each function—the tool can determine which conditional paths have been exercised by historical transactions. Branches that appear in the source code but have zero calls in the analyzed range are flagged as unreachable. The implementation deduplicates transaction hashes and processes logs in batches to optimize performance while respecting RPC concurrency limits.

WHAT IT CANNOT SEE

This tool cannot analyze contracts that have not been verified on a supported block explorer, as source code is required for branch detection. It is limited by the RPC provider's historical block range availability and rate limits. It cannot see internal transactions or delegate calls that do not emit logs, meaning branches executed through those paths may appear unreachable. Branch detection relies on source code analysis and may miss branches that are optimized away by the Solidity compiler or that exist in inline assembly. It cannot detect branches that are only reachable through specific input states not observed in the historical data—absence of evidence is not evidence of absence. Method ID matching may produce false positives if different functions share the same 4-byte signature. The accuracy of results depends on the completeness and reliability of the underlying RPC data, event emissions, and source code verification. It cannot detect branches in libraries or contracts that are called via DELEGATECALL without logs.

PLEASE NOTE

This is a read‑only analytics tool—it never submits transactions or signs anything. It is designed for EVM‑compatible chains. For best results, use an archival RPC node with broad historical access, and provide a valid block explorer API key for accurate source code retrieval. The tool works best on contracts that emit events on every transaction; contracts without logs will produce no results. Branch detection is heuristic and may not reflect the exact compiler output for complex contracts.