Reachability analysis — who can call what

medium

Learn with your AI

Open this lesson in your favourite AI. It'll walk you through the why, explain the demo, and quiz you on the try-it list.

Open in Claude Open in ChatGPT

Why this matters

Half of access-control bugs are not 'the modifier is wrong' but 'the function is public when nobody noticed'. Reachability analysis enumerates: for every state-changing function in the contract, which addresses can call it, under what conditions, with what arguments. Done systematically, it catches the 'I thought this was internal' class on the first pass.

Demo

Tools: Slither's function-summary printer dumps callers + permissions. Manual: grep -E 'function .* (public|external)' then for each, ask 'what's the gate?'. Most production bugs live in functions where the answer to that question is 'nothing'.

Try it yourself

REPRODUCE — pick a small Solidity contract. Run slither <repo> --print function-summary. Inspect the access matrix.
PATCH — find one function that should have been internal/restricted but isn't. Tighten access. Test that the previous caller still works for the intended path and fails for the unintended.
VERIFY — add an access-control invariant: 'only addresses with role X can decrement balanceOf(victim)'.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain reachability analysis for smart contracts.

2. Why it works (the mechanism)

Walk me through Slither's function-summary output.

3. Advanced — application & what's next

Design a CI gate that fails when a previously-internal function becomes public.