Smart contract risk check API before approving a Base contract

$0.01 per call · failed calls are never charged · no account or subscription: pay per call with a card key or USDC

Check a Base contract before you approve or call it: a low to critical risk tier with named flags (proxy, proxy with no implementation, tiny bytecode, zero token supply), plus bytecode size, the EIP-1967 implementation slot and ERC-20 owner, renounced and paused reads. Unreadable reads are null; EOAs return not-applicable. Limited heuristics, not a full security audit. Use before approving a spender or calling an unfamiliar Base contract.

When to use it

Check a Base contract before approving it as a spender or calling it
Get a low to critical tier with named flags such as proxy, unset implementation, tiny bytecode or zero supply
Read the EIP-1967 implementation slot and ERC-20 owner, renounced and paused state

Guide: Token honeypot check API

Run it free (25 free calls) Buy credits by card (from $1) Example result (JSON)

Inputs

Name	Type	Description
`address` (required)	string	Base chain contract address, 0x-prefixed 20-byte hex

Request

Over HTTP, with a card key from /credits:

curl -H "Authorization: Bearer adt_…" "https://tools.funwords.eu/contract-risk?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

Or one of your 25 free calls, no key:

curl "https://tools.funwords.eu/contract-risk?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&trial=1"

Without a key, the same URL answers 402 Payment Required with x402 and MPP terms, so an agent with a wallet pays per call in USDC (Base, Polygon, Arbitrum or Solana over x402; Base or Tempo over MPP) and retries.

Example result

{
  "chain": "base",
  "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "type": "contract",
  "riskLevel": "low",
  "riskFlags": [],
  "summary": "low risk: 0 flag(s). Bytecode 8953 bytes.",
  "facts": {
    "bytecodeSize": 8953,
    "deployedAt": null,
    "hasCode": true,
    "isProxy": false,
    "proxyImplementation": null
  },
  "tokenProperties": {
    "name": "USD Coin",
    "symbol": "USDC",
    "decimals": 6,
    "totalSupply": "10000000000000",
    "owner": "0x0000000000000000000000000000000000000001",
    "ownershipRenounced": false,
    "paused": null
  },
  "lastUpdatedBlock": 18650000
}

From an AI agent (MCP)

Add the MCP server to Claude, Cursor or any MCP client. This tool is contract_risk, and the first 25 successful calls are free:

https://tools.funwords.eu/mcp

Details and limits

Base contract bytecode size and EIP-1967 slot check (a confirmed zero slot returns isProxy false; an empty/unreadable slot response returns null; RPC failures return 502). A nonzero slot with a zero implementation flags proxy-impl-unset. ERC-20 property reads run only for 500–50,000-byte contracts; individual unsupported/reverting reads are null, while multicall transport failures return 502. Zero supply requires a successful zero read; ownershipRenounced is true only for zero owner, false for nonzero, else null; paused is null if unsupported. Risk tiers are limited bytecode/proxy/zero-supply heuristics, not a full audit; empty slots cannot identify uninitialized proxies. EOAs return not-applicable.

Questions

Is this a security audit?

No. It is a limited set of bytecode, proxy and supply heuristics.

What about plain wallets?

An address without code returns not-applicable.

How do I pay?

Each successful call costs $0.01; failed calls are not charged. The first 25 calls are free. Then pay with card credits (from $1; the key goes in an Authorization header or, for clients that can only fetch a URL, as api_key= in the URL) or per call in USDC over x402 or MPP. No account is needed.