Adds batch and multicall decoding.
Added
- The analyzer now unwraps batched calls and recursively analyzes each inner call, so a dangerous action hidden inside a batch is caught instead of reported as an unknown selector. Supported wrappers:
- Multicall3
aggregate,aggregate3,aggregate3Value,tryAggregate - OpenZeppelin
multicall(bytes[]) - Gnosis Safe
multiSend(bytes)
- Multicall3
- Inner findings are labeled with their position and target, and a critical inner finding raises the overall severity. Nesting is followed up to a depth of 5.
- The decoder is dependency-free and bounds-checked; malformed batch calldata yields a
transaction.batch-malformedwarning rather than a failure.
Install with cargo install evmguard. Linux, Windows, and macOS binaries are attached below.