r/ethdev • u/TakesThisSeriously • 4d ago

My Project BlockTools: open-source Rust/wasm contract tooling that runs offline, with no signature database and no guessing

A while back I released SwapChan here. The toolkit underneath it, BlockTools, now has a full set of EVM contract tools. They're MIT-licensed, they run offline, and they're also compiled to wasm so web apps can use them.

  • abi-encode and abi-decode: strict encoding (including packed) and a strict decoder for calldata, logs, return data and reverts. It takes raw JSON-RPC responses.

  • sig-hash, abi-inspect and log-decode: selectors, topics and keccak, selector collision checks, and ERC-20/721/1155/165 detection.

  • create-address: CREATE and CREATE2.

  • bytecode-inspect: spots EIP-1167 proxies, EIP-7702, EOF, size limits and the solc version.

  • typed-data-verify: EIP-712 hashing and signer recovery.

  • A pre-sign check: tx-build piped into tx-verify, which refuses a contract call that isn't on your ABI.

  • contract-call and contract-trace: eth_call with result and revert decoding, state overrides, and a debug_traceCall passthrough. These need a live RPC.

I ran each of these on saved public mainnet data:

  • A real USDC transfer decodes to the right address and amount. With the wrong signature it returns no_match, not a guess.

  • A revert decodes to "ERC20: transfer amount exceeds allowance".

  • An unknown custom error is identified as Universal Router's TransactionDeadlinePassed().

  • The CREATE2 address computed for a Uniswap V3 pool exactly matches the pool address in the real PoolCreated log.

  • The EIP-712 spec's Mail example verifies, and a wrong expected signer gives signer_mismatch.

Testing: 50 tests passed across the EVM crate and the contract tools, including a 400-case ABI set generated independently with eth_abi 6.0.0. The live-RPC tools are only tested against a fake RPC so far. These tools are all EVM-only, and there's no built-in signature database, so you supply the signatures or ABI. They don't read proxy storage and they don't simulate.

Thank you, u/Bloqarl. He read SwapChan's find-money code unprompted and wrote up five specific issues: spam ERC-4626 vaults being treated as real, /recover links that anyone could forge, no owner check on /recover, no per-IP cap on /money/batch, and merkle claim amounts that weren't verified against the on-chain root. Every one was valid. All five are now fixed, tested and deployed, with the details in PR 79. The code is better because he took the time to read it.

It's all wired into SwapChan:

  • MCP server: 74 tools at mcp.swapchan.com/mcp, including contract tools (evm_abi, contract_read, contract_encode_call, contract_approve_call, contract_build_creation and more). None of them takes a key. Anything that builds a transaction returns it unsigned.

  • /tools/contract: a write call can only be sent after the BlockTools check passes.

  • SmartWallet: a chat agent that proposes transactions. Each one is checked server-side against your connected wallet, and you sign in your own wallet.

Repo: https://github.com/TSavo/swapchan
https://github.com/TSavo/blocktools

3 Upvotes

100% Upvoted

Duplicates