Tool 01 · Analysis · Free
Contract Risk Pre-Check
Paste Solidity, get an indicative scan against twenty known vulnerability patterns in under a second. It runs entirely in your browser — the source never leaves the page, and there is no sign-up.
At a glance
Contract Risk Pre-Check
Run it
Press ⌘/Ctrl + Enter to scan. Nothing is transmitted.
How it works
What this tool does, and what it can't.
The scanner strips comments and string literals first, so it never fires on prose or a URL inside a comment. It then runs twenty rules — some line-by-line, some against the whole file with lookahead — and reports each hit with a line number, the matching source, why it matters and what to do about it.
Results use the same severity scale as our audit reports, so a Critical here means the same thing it would mean in an engagement: direct loss of funds, exploitable by anyone, no special preconditions.
What it cannot do is the important part. It has no notion of your protocol's intended behaviour, cannot follow value across contracts, and cannot evaluate whether an economic incentive is exploitable. Every large exploit in this industry involved at least one of those three.
No. Every rule runs in JavaScript in your browser. You can confirm this by opening the network tab while you scan, or by reading js/precheck.js — the whole rule set is in that one file.
Reentrancy shape (external call before state update), tx.origin authorisation, delegatecall, missing access control on privileged functions, unchecked low-level call returns, spot-price oracle reads, unvalidated Chainlink answers, unbounded loops, ERC-4626 first-deposit exposure, missing slippage and deadline protection, raw ERC-20 calls, block-value randomness, unchecked blocks, division-before-multiplication, floating pragmas, missing zero-address checks, single-step ownership, selfdestruct, missing events on setters, and storage reads inside loop conditions.
The pre-check itself works on source. To pull verified source straight from a block explorer, use the source fetcher — it hands the code to this tool in one click.
Because it is a pattern matcher without context. A delegatecall to an immutable, audited library is safe; the rule cannot tell that from a user-supplied target. Treat every hit as a question to answer, not a verdict.
No, and the tool says so. A clean result means none of the twenty shapes are present. Flawed accounting, broken incentive design and cross-contract state assumptions are all invisible to it — and those are what drain protocols.
Beyond automation
No tool reads your specification. We do.
The findings that drain protocols come from state assumptions, economic design and cross-contract interaction — none of which a scanner sees. Free scoping in under two working days.