Local artifact evidence, no RPC
See what the ABIleaves out.
Paste a verified ABI and deployed runtime bytecode. The audit joins canonical selectors to executable PUSH4 offsets, then shows exactly what needs deeper review.
Contract artifacts
Two surfaces, one audit
Artifacts stay in this browser.
EVM Privilege Surface Auditor
Artifact evidence
Load both evidence surfaces.
Use the representative dispatcher or paste your own verified ABI and deployed runtime. No address lookup or wallet connection is performed.
ethers.js normalizes each ABI function and derives its Keccak selector. The scanner walks opcodes, skips PUSH payload bytes, records PUSH4 offsets, and joins those selectors against the control catalog.
Interpretation boundary
A selector is evidence of surface, not intent.
What this provesA catalogued four-byte value is present in the supplied runtime or ABI, with exact evidence provenance and offsets.
What remainsReachability, authorization, implementation logic, current roles, proxy targets, and live state require separate review.
Transfer practiceAudit the implementation runtime next when proxy signals appear, then inspect the runtime-only selector in source or a decompiler.