Documentation
Learn what 0xSENTINEL checks today, how to interpret the output, and where lightweight scanning stops.
How it Works
0xSENTINEL accepts pasted or uploaded Solidity source code, sends it through a Next.js server action, and runs an AST-backed analysis pass against common risk patterns.
When the parser cannot recover cleanly, the scanner falls back to regex heuristics so users still get a first-pass read. It remains a triage tool, not a substitute for a full manual audit or deeper symbolic analysis.
Supported Checks
- ✓Reentrancy: Flags value-transferring external calls that often deserve manual ordering review.
- ✓tx.origin: Identifies authorization logic that depends on `tx.origin`.
- ✓Unchecked calls: Flags low-level calls when the success value is not obviously handled.
- ✓Weak randomness: Flags `block.timestamp`, `block.difficulty`, and `now` when used as entropy.
- ✓Floating pragma: Flags version ranges such as `pragma solidity ^0.8.0`.
- ✓delegatecall risk: Highlights delegatecall usage because it executes in the caller storage context.
- ✓selfdestruct usage: Flags shutdown primitives that can permanently alter production behavior.
Best Practices
Treat findings as leads, not verdicts
Review flagged lines in context. AST-backed analysis improves precision, but contract safety still depends on surrounding logic, access control, upgrade paths, and system design.
Checks-Effects-Interactions
Update state before external calls whenever possible. This remains one of the clearest habits for preventing common reentrancy mistakes.
Lock your compiler version
Prefer exact Solidity versions so the code you audit matches the code you compile and deploy.