Tool 06 · On-chain · Free
Verified Source Fetcher
Paste a contract address, get its verified source flattened and ready to analyse — then send it straight into the risk pre-check without a round trip through your clipboard.
At a glance
Verified Source Fetcher
Run it
Stored only in your browser's localStorage and sent directly to the explorer. We never receive it. A site owner can remove this step by configuring a server-side proxy — see the README.
How it works
What this tool does, and what it can't.
Block explorers return verified source in three different shapes: raw Solidity for single-file contracts, a JSON map of paths to contents for multi-file projects, and a double-brace-wrapped standard-json-input for compiler settings. This tool flattens all three into one readable file with path markers, so you can paste it into any analyser.
It also surfaces the compiler version, optimizer settings and license, and tells you whether the explorer flagged the address as a proxy — in which case you almost certainly want the implementation's source rather than the proxy's, and there is a button to fetch it.
Because this site has no backend by default, the request goes from your browser directly to the explorer using a free key you provide, stored only in your own localStorage. A site owner who deploys the included serverless function can hold the key server-side and remove that step for every visitor.
The site is static, so there is no server to hold a shared key — and embedding one in public JavaScript would let anyone burn its rate limit. A free key from etherscan.io/apis takes a minute, works across all supported chains on the V2 API, and stays in your browser.
Ethereum, Arbitrum, Optimism, Base, Polygon, BNB Chain, Avalanche, Linea and Scroll — all through the unified explorer API, so one key covers them.
The proxy's own source, which is usually a few dozen lines of delegation logic. The tool detects this and offers a button to fetch the implementation instead — that is the code you actually want to review. The proxy detector will show you the full picture including the admin.
Then there is nothing to fetch, and that is itself a finding. An unverified contract holding user funds cannot be reviewed by anyone outside the team, which is a reason for users to be cautious and for you to verify it.
It is what the deployer submitted and the explorer's compiler reproduced to match the deployed bytecode — which is a strong guarantee, but verify the compiler version and optimizer settings shown, because those affect the result.
Beyond automation
No tool reads your specification. We do.
The findings that drain protocols come from state assumptions, economic design and cross-contract interaction — none of which a scanner sees. Free scoping in under two working days.