Technical note
What a contract's bytecode can and cannot tell you
Deployed bytecode reveals the powers a contract holds: whether it can be upgraded, destroyed, paused, minted from, or handed to a new owner. It cannot tell you who holds the keys. The scanner reports the first and refuses to guess the second.
· 1 min read · written from the shipped implementation
Reading powers from bytecode
A deployed contract is bytecode, and bytecode is honest about capability in a way documentation is not. If the code contains a self-destruct path, the contract can be destroyed. If it writes to the EIP-1967 implementation slot, it is an upgradeable proxy and its logic can be replaced. If it exposes mint, pause and ownership-transfer paths, those are powers someone holds.
The Smart Contract Address Risk Scanner reads a contract's bytecode and reports those powers. Each finding describes what the contract can do. None of them pronounces it safe or unsafe, because that judgement depends on something bytecode does not contain.
0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbcWhy the scan walks PUSH data
An opcode scan that reads every byte as an instruction is wrong about a lot of them. PUSH instructions carry inline data — an address literal, a constant — and the bytes inside that data are not instructions, even when they happen to equal the opcode for SELFDESTRUCT. A naive scan reports powers a contract does not have. The scanner walks PUSH data so that bytes inside literals are never mistaken for instructions.
The judgement bytecode cannot make
An upgradeable proxy is a trust assumption whose weight depends entirely on who holds the admin key and under what process. A timelocked multisig and a single hot wallet produce identical bytecode. That is why the tool's output is a list of capabilities, and why the authorized audit — which reads the source, the deployment, the key management and the governance around them — is a different engagement rather than a bigger version of the same scan.
- Read: the deployed bytecode, from a public chain.
- Inferred: upgradeability, self-destruct, mint, pause and ownership-transfer capability.
- Not claimed: safety, intent, or who controls the powers found.