EVM bytecode, decoded and judged

The disassembler that
names the danger.

Unweave is an EVM bytecode disassembler that reconstructs intent and flags dangerous opcodes. A delegatecall is not just 0xf4, it is a proxy-takeover vector, and Unweave says so, inline.

Try it in your browser View on GitHub

runs fully client-side, nothing leaves the page, same engine as the CLI, the HTTP API, and the MCP tool

Most tools list mnemonics. Unweave names the meaning.

A flagged line does not just tell you which opcode ran. It tells you why an auditor should stop and look.

How it differs

evmdis, ethersplay

Give you a correct opcode listing. You supply the EVM security knowledge for every line.

Panoramix, heimdall

Decompile to pseudo-Solidity. Powerful and heavy, and not always right.

Unweave

The fast middle: correct disassembly with the dangerous opcodes flagged inline, plus basic blocks and recovered function selectors. And an MCP tool so an agent can ask "does this delegatecall".

The primitives that matter

Six flags an auditor actually reads first.

critical DELEGATECALL

Runs external code in this contract's own context and storage. The classic proxy-takeover and storage-collision vector.

critical CALLCODE

Legacy delegatecall variant. Same danger: external code executing against this contract's storage.

high SELFDESTRUCT

Destroys the contract and force-sends its balance. Bricks proxies and breaks invariants.

medium CALL

External call with value and gas to an arbitrary address. Check reentrancy and the return value.

medium ORIGIN (tx.origin)

Using tx.origin for authorization is a known phishing and bypass vector. Prefer CALLER.

low TSTORE / CREATE2

Transient-storage reentrancy guards and deterministic deploy addresses. Subtle, worth a second look.

Built for auditors and agents.

CLI

disasm a hex string or a file. Text, JSON, or just the flagged opcodes with --flags-only.

HTTP API

POST bytecode to /disasm, or open the paste-bytecode console in your browser.

MCP server

An unweave_disasm tool over stdio, so an agent auditing a contract can ask the disassembler directly.

Cancun-aware

Full opcode table through TLOAD, TSTORE, MCOPY, BLOBHASH, and BLOBBASEFEE.