Enter your license key to unlock unlimited scans or additional scan credits.
Industry-standard Solidity static analysis. Data flow, CFG traversal, and storage slot inspection.
Read more →Symbolic execution over EVM bytecode. Finds paths no linter can: integer overflows, assertion violations, unprotected ether.
Read more →AST-aware pattern matching. Fast, high-precision rules for known vulnerability classes written by ContractScan.
Read more →Rust-based Solidity AST scanner from Cyfrin. Detects centralization risks, unsafe casts, and unused returns.
Read more →Gas optimisation and code quality checks modeled after Code4rena contest standards. Catches inefficiencies reviewers flag.
Read more →LLM-powered business-logic analysis. Flash loan surfaces, oracle risks, MEV exposure, governance attacks — what static tools miss.
Read more →Enriched with 1635+ real-world DeFi exploits — collected weekly from 6 authoritative sources to keep detection patterns current with emerging attack vectors.
Findings aggregated from public audit reports, competitive auditing platforms, and on-chain post-mortems. Updated daily.
ContractScan automatically collects and indexes real-world DeFi security incidents and professional audit findings from 7 public threat feeds to keep detection patterns current with emerging attack vectors.
Last updated: 2026-08-02 · Learn about our methodology →
Decentralized finance (DeFi) has suffered billions of dollars in losses due to smart contract exploits. Major hacks on bridges, lending protocols, and yield aggregators are rarely caused by completely new attack vectors; instead, they often stem from well-known vulnerabilities like reentrancy, oracle manipulation, and uninitialized storage slots. Preventing these bugs before code deployment is critical to securing Web3 ecosystems.
ContractScan bridges the gap between manual code reviews and complex command-line testing tools. By orchestrating five distinct static analysis engines alongside advanced Large Language Model (LLM) reasoning, ContractScan automatically identifies structural loopholes, logical vulnerabilities, and gas inefficiencies in Solidity source code within seconds.
Our analysis patterns scan for reentrancy bugs (unprotected state updates before external calls), missing access controls (unprotected administrative functions), integer underflow/overflow inside unchecked blocks, and incorrect EIP standard implementations.
In addition to critical security flaws, ContractScan checks for gas optimization patterns modeled after Code4rena and Sherlock standards. This includes identifying redundant storage writes, optimizing loop bounds, and flagging dead code to save users significant deployment costs.
Scan verified smart contracts directly from Etherscan, Polygonscan, Arbiscan, Optimistic Etherscan, and Base Scan. Simply paste the contract address and select the corresponding network to fetch and analyze verified source code automatically.
QuickScan runs lightweight static analysis tools (Slither and Semgrep) to provide an immediate security score and detect standard vulnerabilities in seconds. Full Scan activates symbolic execution engines (Mythril) and imports advanced AI models to audit complex business logic, economic attack vectors, and oracle manipulation risks.
No. ContractScan is an automated pre-check tool designed to catch bugs early in the development lifecycle. Automated tools cannot completely grasp business logic nuances. You must always obtain a comprehensive manual audit from a certified security firm before deploying smart contracts on mainnet.
For anonymous users, all submitted smart contract source code is processed ephemerally within an isolated sandbox environment and deleted immediately after the scan completes. For registered users, code is stored securely in our database solely to enable scan history and rescan capabilities.
Yes, our Pro and Enterprise tiers expose a robust API that integrates with GitHub Actions, GitLab CI, and other deployment tools. You can configure your repository to block PR merges automatically if the scanner detects new critical vulnerabilities.
Pro unlocks Mythril symbolic execution, Aderyn AST analysis, full AI reports, and CI/CD integration — all in under 60 seconds.