Vulnerability Detector

WHAT IT DOES

Vulnerability Detector scans any EVM contract for a wide range of known security issues. Enter a contract address and optionally provide the source code—the tool analyzes both the on-chain bytecode and the source code (if provided) to identify dangerous patterns. It detects critical issues like SELFDESTRUCT and unrestricted selfdestruct, high-risk patterns like DELEGATECALL, reentrancy, tx.origin use, and unprotected withdraw functions, plus medium-risk issues like outdated compiler versions, block timestamp dependence, and unchecked low-level calls. The results are categorized by severity (critical, high, medium, low) with clear explanations and location indicators, making it easy to prioritize fixes. This is essential for developers conducting quick security checks, auditors performing initial assessments, or users evaluating contract safety.

HOW TO USE

Connect your EVM wallet (optional—the tool works read-only). Select the network from the dropdown. Enter the contract address (0x…42) you want to analyze. For deeper analysis, paste the contract's Solidity source code in the source code field—this enables detection of logic-based vulnerabilities like reentrancy, unprotected functions, and tx.origin usage. Click "detect" to run the scan. The tool fetches the bytecode and on-chain metadata, then runs pattern-based checks. The results display the contract's balance, transaction count, bytecode size, a severity summary, and a detailed list of findings with descriptions and location markers. Use the "clear" button to reset all fields.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 via the BGWallet provider. It fetches the contract bytecode with provider.getCode(address), balance with provider.getBalance(), and transaction count with provider.getTransactionCount(). The bytecode is scanned for specific opcode byte patterns: 0xFF (SELFDESTRUCT), 0xF4 (DELEGATECALL), 0xF2 (CALLCODE), 0xF0 (CREATE), 0xF5 (CREATE2), and 0xF1 (CALL). The source code analysis performs pattern matching using regular expressions on the provided Solidity code, checking for reentrancy risks, unprotected withdraw functions, tx.origin usage, unchecked low-level calls, outdated compiler versions, inline assembly, block timestamp dependence, and unsafe external calls. Findings are categorized by severity and displayed with human-readable descriptions and location indicators.

WHAT IT CANNOT SEE

This tool cannot detect zero-day vulnerabilities or logic flaws that are not pattern-based—it only recognizes known patterns. It cannot analyze contracts with obfuscated or encrypted code. It cannot provide a comprehensive security audit—this is a heuristic surface-level scan. It cannot detect vulnerabilities in external dependencies or libraries. It cannot simulate attacks or test exploitability. It cannot detect business logic flaws or economic attacks. It cannot analyze contracts on non-EVM chains. The tool is limited by the accuracy of the pattern database and the completeness of the provided source code. A clean scan does not guarantee the contract is secure.

PLEASE NOTE

Works exclusively on EVM-compatible chains: Ethereum Mainnet, Goerli, Sepolia, Polygon, Arbitrum, and Optimism. Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. This is a read-only, free security analysis tool—use it for initial contract inspection and to identify areas that warrant deeper review. The presence of a finding does not guarantee a vulnerability exists, and the absence of findings does not guarantee security. Always perform a full professional security audit before deploying or interacting with any contract.