Tool 07 · On-chain · Free
Proxy Detector
Read the standard proxy slots straight from chain state: implementation, admin and beacon. It also tells you the thing that actually matters — whether a single private key can replace the code holding user funds.
At a glance
Proxy Detector
Run it
Reads are made directly from your browser to a public RPC endpoint. No key required, nothing logged by us.
What it checks
- EIP-1967 implementation, admin and beacon slots
- EIP-1822 (UUPS legacy) proxiable slot
- OpenZeppelin legacy implementation and admin slots
- EIP-1167 minimal proxy target, read from runtime bytecode
- EIP-2535 diamond, via the loupe
facets()selector - Whether the admin address is an EOA or a contract
- Runtime code size against the 24,576-byte limit
How it works
What this tool does, and what it can't.
EIP-1967 defines fixed, pseudorandom storage slots for a proxy's implementation, admin and beacon addresses — chosen so they cannot collide with normal contract storage. Reading those slots with eth_getStorageAt tells you what a proxy points at without needing any ABI or verified source.
Minimal proxies (EIP-1167) work differently: the target is hard-coded in the runtime bytecode, so the tool reads the code and extracts it from the standard clone pattern. Diamonds are detected by calling the loupe's facets() selector.
The finding that matters most is not which pattern is in use. It is whether the admin slot holds an externally-owned account. If it does, one private key can replace the implementation instantly, with no timelock and no warning — which means user funds are custodial in practice, whatever the documentation says.
A standard that fixes the storage slots a proxy uses for its implementation, admin and beacon addresses. The slots are derived from hashed strings minus one, so they cannot collide with variables the implementation declares. It is why tools like this one can inspect any proxy without an ABI.
That a single private key can replace the contract's entire code. No multisig threshold, no timelock, no exit window for users. It is one of the most consequential facts about any upgradeable protocol and one of the least documented, which is why this tool checks it explicitly.
If both an implementation and an admin slot are set, it is almost certainly a transparent proxy, where upgrade logic lives in the proxy. If only the implementation slot is set, it is likely UUPS, where the upgrade function lives in the implementation — which means a future implementation that omits _authorizeUpgrade would freeze the proxy permanently.
No. It reads chain state through public RPC endpoints directly from your browser. Nothing is logged by us and no account is required.
It means none of the standard slots hold an address, the code is not a minimal proxy, and the diamond loupe did not respond. A custom, non-standard proxy would not be detected — so treat a negative result as strong evidence, not proof.
Beyond automation
No tool reads your specification. We do.
The findings that drain protocols come from state assumptions, economic design and cross-contract interaction — none of which a scanner sees. Free scoping in under two working days.