EVM bytecode, decoded and judged
Unweave is an EVM bytecode disassembler that reconstructs intent and flags dangerous opcodes. A delegatecall is not just 0xf4, it is a proxy-takeover vector, and Unweave says so, inline.
runs fully client-side, nothing leaves the page, same engine as the CLI, the HTTP API, and the MCP tool
A flagged line does not just tell you which opcode ran. It tells you why an auditor should stop and look.
Give you a correct opcode listing. You supply the EVM security knowledge for every line.
Decompile to pseudo-Solidity. Powerful and heavy, and not always right.
The fast middle: correct disassembly with the dangerous opcodes flagged inline, plus basic blocks and recovered function selectors. And an MCP tool so an agent can ask "does this delegatecall".
The primitives that matter
Runs external code in this contract's own context and storage. The classic proxy-takeover and storage-collision vector.
Legacy delegatecall variant. Same danger: external code executing against this contract's storage.
Destroys the contract and force-sends its balance. Bricks proxies and breaks invariants.
External call with value and gas to an arbitrary address. Check reentrancy and the return value.
Using tx.origin for authorization is a known phishing and bypass vector. Prefer CALLER.
Transient-storage reentrancy guards and deterministic deploy addresses. Subtle, worth a second look.
disasm a hex string or a file. Text, JSON, or just the flagged opcodes with --flags-only.
POST bytecode to /disasm, or open the paste-bytecode console in your browser.
An unweave_disasm tool over stdio, so an agent auditing a contract can ask the disassembler directly.
Full opcode table through TLOAD, TSTORE, MCOPY, BLOBHASH, and BLOBBASEFEE.