Every contract has a story. Unwrap it.

Understand smart contracts in plain English. Inspect permissions, investigate potential risks, and explore on-chain functionality with AI-powered analysis.

Built for Robinhood Chain, and works on Ethereum, Base, Arbitrum, BNB Chain, Optimism, Polygon, Avalanche. See a sample report

What the chain stores

72dd1161016857806340c10f191161013857806340c10f19

0x40c10f19 is the ID of the mint function.

What the developer wrote

51    function mint(address to, uint256 amount) external onlyOwner {
52        _mint(to, amount);
53    }

What it means

The owner can create new tokens at any time. No cap was found, so new supply can dilute holders.

Evidence: RiskyToken.sol:51, guarded by onlyOwner

From the sample report: a deliberately unsafe test token on a local chain.

How it works

1
Pick the network, paste the address
UNWRAP confirms it is talking to the right chain and that the address holds contract code.
2
Read the chain directly
Bytecode, balance, proxy storage slots, token details and the current owner, straight from the network.
3
Fetch and parse the verified source
From the network's own explorer, with Sourcify as a fallback. Proxies are followed to the code they run.
4
Report with evidence
Every function, permission and finding points to a source line or an on-chain read. Ask follow-up questions; answers cite the same evidence.

In every report

Who can do what: Mint, pause, block addresses, change fees, upgrade the code: who holds each power, and the line that grants it.
Security findings, graded honestly: Each finding says whether it is confirmed behaviour, a potential vulnerability or a heuristic warning, with its confidence. No single score hides the detail.
Proxies unwrapped: EIP-1967, UUPS, beacon and minimal proxies are followed to their implementation, and upgrade risk is reported separately from today's code.
Every function in plain English: Selector, access rule, what it changes, and a one-line explanation. Searchable.
Questions answered from evidence: Ask about the contract. Answers must cite the report; anything the AI cannot back up is flagged.

What findings look like

Real output from the sample report. Each finding says how much weight it can bear, and what it cannot tell you.

HighPotential vulnerabilityRiskyToken.sol:87
State is updated after an external call
withdrawDeposit() makes an external call (msg.sender.call{…}("")) and only afterwards updates deposits. If the callee re-enters the contract before that update, it may observe stale state. This is the classic reentrancy pattern.
MediumConfirmed behaviourRiskyToken.sol:33
Transfers depend on settings an administrator can change
The transfer path checks paused, isBlacklisted, maxTxAmount, and restricted functions can change these values. An administrator can therefore cause transfers by some or all holders to fail.
MediumHeuristic warningRiskyToken.sol:101
Sensitive function without a detected access check: setFeeRecipient
setFeeRecipient(address) appears to grant these capabilities: can change fees. Yet UNWRAP found no modifier, msg.sender check or role check restricting it. If that is accurate, any address can call it.

Open the full sample report

Networks

Robinhood Chain comes first. Every network gets the same analysis; what differs is where the verified source comes from.

Network	Chain ID	Verified source	Explorer
Robinhood Chain	4663	Blockscout, Sourcify	Blockscout
Robinhood Chain Testnet	46630	Blockscout, Sourcify	Blockscout
Ethereum	1	Etherscan V2 (needs key), Sourcify	Etherscan
Base	8453	Etherscan V2 (needs key), Sourcify	Basescan
Arbitrum One	42161	Etherscan V2 (needs key), Sourcify	Arbiscan
BNB Smart Chain	56	Etherscan V2 (needs key), Sourcify	BscScan
OP Mainnet	10	Etherscan V2 (needs key), Sourcify	Optimism Etherscan
Polygon	137	Etherscan V2 (needs key), Sourcify	Polygonscan
Avalanche	43114	Etherscan V2 (needs key), Sourcify	Snowtrace

What UNWRAP can't tell you

Whether it's safe.
Static analysis finds known patterns. New or subtle bugs can slip through.
Whether you can sell.
No trades are simulated, so there is no honeypot verdict.
Much, if the source is hidden.
Without verified source, function names are guesses from selectors.
What an upgrade will do.
Upgradeable contracts are reported as they are today.
Who holds the token.
Holder data needs an indexer; UNWRAP won't estimate it.
That the AI is right.
Check the evidence each answer cites. Code comments are the author's claims.

Questions

Does UNWRAP tell me whether a contract is safe?

No. It shows what the code allows and which known risk patterns appear. No findings is not proof of safety, and UNWRAP is not a substitute for a professional audit.

Why do I have to choose a network?

The same address can be empty on one chain and a different contract on another. Guessing would risk analysing the wrong code.

What if the source isn't verified?

UNWRAP still reads the bytecode: function selectors, proxy patterns and risky opcodes. The report says it is bytecode-only, and findings carry low confidence.

Do I need to connect a wallet?

No. Analysis is read-only. UNWRAP never asks for a wallet connection, a signature, a seed phrase or a private key.

Does it test whether a token can be sold?

Not yet. No trades are simulated, so UNWRAP never says a token is or isn't a honeypot. It shows which transfer conditions an administrator controls.

Who can see my report?

Public reports open for anyone with the link, which contains an unguessable ID. Private reports open only in the browser that created them.