# Contract Safety API

> Paid x402 API that returns on-chain risk signals for EVM token contracts on Base and BSC.

## Service

- Production base URL: https://node-starter--maxujon18.replit.app
- Payment protocol: x402 v2
- Payment scheme: exact EVM
- Payment network: Base mainnet (`eip155:8453`)
- Payment asset: USDC (`0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`)
- Price: 0.02 USDC per successful `/api/check-contract` request
- Authentication: no account, subscription, or API key; pay through the x402 challenge

## Paid endpoint

`GET /api/check-contract`

Query parameters:

- `address` (required): deployed EVM contract address, such as `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`
- `chain` (optional): `base` (default) or `bsc`

The first request receives HTTP 402 Payment Required. Use an x402-compatible client to sign and submit the exact USDC payment, then retry the same request. A successful response is JSON:

```json
{
  "address": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "chain": "base",
  "riskLevel": "medium",
  "signals": [
    "No EIP-1967 proxy pattern detected",
    "Owner has not renounced ownership",
    "Source code is verified on the block explorer"
  ],
  "checkedAt": "2026-08-27T10:37:17.744Z"
}
```

Signals currently cover:

- EIP-1967 implementation and beacon proxy detection
- `owner()` control and renouncement state
- explorer source-code verification

Important: absence of an EIP-1967 signal does not prove that a contract has no other upgrade or admin mechanism.

## x402 TypeScript example

```ts
import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(
  process.env.BUYER_PRIVATE_KEY as `0x${string}`,
);

const fetchWithPayment = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [{
    network: "eip155:*",
    client: new ExactEvmScheme(account),
  }],
});

const response = await fetchWithPayment(
  "https://node-starter--maxujon18.replit.app/api/check-contract?chain=base&address=0x...",
  { method: "GET" },
);
const result = await response.json();
```

Run payment code server-side only. Never expose a buyer private key in a browser bundle.

## Free endpoints

- `GET /api/healthz` — returns `{"status":"ok"}` when the service is available.
- `GET /api/test` — x402 payment challenge for integration testing; it is not a free paid-content endpoint.

## Machine-readable documentation

- OpenAPI: `/openapi.json`
- Human/API landing page: `/`