79trust / 100

Verify Deep

by Smart Contract Security Check in Security & trust

x402 APIPassing, checked 3 h ago

Smart contract security check before you approve or pay an address: reads the bytecode, behind proxies too, for privileged functions (mint, pause, blacklist, upgrade), dangerous opcodes and protocol type, and checks whether a single key holds those powers. Adds OFAC SDN screening, who funded the address, sybil-filtered ERC-8004 reputation for agents and a 0-100 score with proceed / hold / block. Static analysis, not an audit. Free: GET /v1/verify. Trial: /v1/trial.

GET https://trust-agent.io/v1/verify/deep

Last 30 days

All checks passedSome failedAll failedNot checked
Uptime
100%
Response time
506 ms typical, 516 ms slowest 5%
Last check
3 h ago
Next check
any minute now

How to call it

# See the payment challenge (nothing is charged)
curl -i -X GET "https://trust-agent.io/v1/verify/deep?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&chain=base&type=contract"
import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Ftrust-agent.io%2Fv1%2Fverify%2Fdeep
const res = await pay("https://trust-agent.io/v1/verify/deep?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&chain=base&type=contract");
console.log(await res.json());

Example input

{
  "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "chain": "base",
  "type": "contract"
}

Example output

{
  "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "confidence": 0.85,
  "contract": {
    "interfaces": [
      "ERC-20",
      "Ownable",
      "EIP-2612 Permit"
    ],
    "privilegedFunctions": [
      "upgradeTo(address)",
      "upgradeToAndCall(address,bytes)",
      "pause()",
      "transferOwnership(address)",
      "blacklist(address)",
      "mint(address,uint256)",
      "unpause()"
    ],
    "protocol": {
      "klass": "token",
      "label": "ERC-20 token"
    },
    "proxy": {
      "implementation": "0x2Ce6311ddAE708829bc0784C967b7d77D19FD779",
      "isProxy": true,
      "kind": "zeppelinos_legacy"
    },
    "safetyScore": 25,
    "sourceVerified": null
  },
  "example": true,
  "flags": [
    {
      "code": "OWNER_PRIVILEGED_MINT",
      "severity": "high",
      "title": "Privileged function: mint(address,uint256) (in implementation 0x2Ce6311ddAE708829bc0784C967b7d77D19FD779)"
    },
    {
      "code": "BLACKLIST_FUNCTION",
      "severity": "high"
    },
    {
      "code": "UPGRADEABLE_PROXY",
      "severity": "medium"
    }
  ],
  "recommendation": "hold",
  "riskBand": "minimal",
  "subjectType": "contract",
  "trustScore": 84
}

Security scan

  • No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks

WhenResultHTTPTimePrice
3 h agoPassed402485 ms$0.01
6 h agoPassed402506 ms$0.01
10 h agoPassed402140 ms$0.01
14 h agoPassed402240 ms$0.01
17 h agoPassed402516 ms$0.01
22 h agoPassed402539 ms$0.01
25 h agoPassed402509 ms$0.01
28 h agoPassed402478 ms$0.01
33 h agoPassed402506 ms$0.01