Contract audit

Triage a smart contract before an agent interacts with it: verified Solidity source, heuristic vulnerability scan, known-address check, function-selector resolution, and a read-only dry-run of the exact call you plan to make.

When to use this pack

An agent is about to approve, transfer, or call an unfamiliar contract - you want the verified Solidity source scanned for red flags, the address checked against known labels, and the intended calldata simulated before anything is signed or broadcast: the first pass a smart-contract auditor would run.

Tools in this pack

All 5 run inside the single $0.022 call above. Each is also callable on its own if you only need one part.

• Verified contract source (Sourcify) POST /api/contract-source Fetch the verified Solidity source files and compiler metadata for a contract address from Sourcify's open verification repository. Covers 8 EVM mainnets (ethereum, base, polygon, arbitrum, optimism, bsc, gnosis, celo). Contracts that were never verified return a structured {verified:false} miss, not an error. Feed the returned source into /api/solidity-scan for a heuristic pattern check.
• Solidity heuristic pattern scan POST /api/solidity-scan Deterministic static pattern scan of Solidity smart-contract source text - a fixed ruleset flagging tx.origin authentication, delegatecall, selfdestruct, unchecked low-level calls, unchecked .send(), floating pragmas, block-timestamp dependence, weak block-derived randomness, value-call reentrancy surface, inline assembly, ecrecover, and missing SPDX headers. Returns line-anchored findings with severities. This is a heuristic pattern check for triage - it is NOT a compiler, NOT a formal audit, and uses no AI. Pair with /api/contract-source to scan any verified contract.
• Function selector / event topic lookup POST /api/selector-lookup Resolve a 4-byte function selector or a 32-byte event topic hash to its known human-readable Solidity signatures, via the openchain.xyz signature database with 4byte.directory as fallback. Unknown selectors return {found:false} with an empty list, not an error.
• Known-address label lookup POST /api/address-label Label a known EVM address from a curated, committed dataset: major stablecoin + token contracts (the USDC and USDG contracts of every EVM chain we settle on, USDC on Ethereum, USDT, DAI, WETH, WBTC), DEX routers (Uniswap, 1inch, 0x), canonical L1↔L2 bridges, large exchange hot/cold wallets, and burn/system addresses. Deterministic and offline - the provenance field states the dataset revision. Unknown addresses return {found:false}, not an error.
• Transaction simulation (eth_call + gas) POST /api/tx-simulate Dry-run a prospective smart-contract call or transaction without broadcasting it: executes eth_call and eth_estimateGas against the latest block over the same keyless multi-endpoint public RPC pool as /api/evm-rpc (ethereum, base, polygon, arbitrum, optimism). Returns the return data and a gas estimate on success, or {success:false} with the revert reason when the call would fail. Strictly read-only - nothing is signed or broadcast.

Bought one at a time, these 5 tools cost $0.024 together; the pack is that sum less a 10% bundle discount, rounded up to the $0.001 settlement floor, which is $0.022.

Workflow

1. Fetch the verified Solidity source and compiler metadata from Sourcify via contract-source - an unverified contract is itself a finding.
2. Run solidity-scan over the returned source for line-anchored heuristic findings: tx.origin auth, delegatecall, selfdestruct, unchecked calls, weak randomness, and more.
3. Resolve the 4-byte selector of the calldata you plan to send with selector-lookup so you know exactly which function it hits.
4. Check the address against the curated known-address dataset with address-label - is this the real token/router/bridge or an impostor?
5. Dry-run the exact call with tx-simulate (eth_call + gas estimate, strictly read-only) to see whether it succeeds or reverts before anything is signed.

Arguments

What one call returns

A JSON object with pack, args, steps, summary; steps holds one entry per tool (contract-source, solidity-scan, selector-lookup, address-label, tx-simulate), each with its own result or error. Full example on the API page.

Call it directly

Any x402 client pays the 402 and gets the whole workflow back in one response. With the agent402-client SDK (npm i agent402-client, an ES module):

import { Agent402 } from "agent402-client";
// payFetch: an x402-wrapped fetch your wallet signs (@x402/fetch).
// Tools on the free tier need no options: new Agent402() pays them by proof-of-work.
// an existing prepaid credits key also works: new Agent402({ creditsKey })
const client = new Agent402({ fetch: payFetch });
const result = await client.call("skill-contract-audit", {"address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","network":"base","data":"0x70a08231000000000000000000000000abf4fabd7c416fb67202e5f9002389fc75e2a9d0"});

Run it in Claude

claude mcp add agent402 -s user -- npx -y agent402-mcp@latest

Then paste this prompt into Claude:

Audit the contract 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 on base before interacting with it, using Agent402's contract-audit skill pack. (1) Fetch the verified source from Sourcify, (2) run the heuristic Solidity scan over it, (3) resolve the selector of the planned calldata 0x70a08231000000000000000000000000abf4fabd7c416fb67202e5f9002389fc75e2a9d0, (4) check the address against known labels, (5) simulate the call read-only. Report: verification status, scan findings by severity, what the calldata does, whether the address is a known contract, and the dry-run verdict.

← All skill packs