Solidity heuristic pattern scan

Deterministic static pattern scan of Solidity source text — a fixed ruleset flagging tx.origin authentication, delegatecall, selfdestruct, unchecked low-level calls, unchecked .send(), floating pragmas, block-timestamp dependence, weak block-derived randomness, value-call reentrancy surface, inline assembly, ecrecover, and missing SPDX headers. Returns line-anchored findings with severities. This is a heuristic pattern check for triage — it is NOT a compiler, NOT a formal audit, and uses no AI. Pair with /api/contract-source to scan any verified contract.

Input

Field	Type	Description
source *	string	Solidity source text to scan (max 512KB).

Example output

{
  "lines": 7,
  "findings": [
    {
      "rule": "tx-origin",
      "severity": "high",
      "line": 4,
      "snippet": "require(tx.origin == msg.sender);",
      "message": "tx.origin used — authentication via tx.origin is phishable; use msg.sender."
    }
  ],
  "summary": {
    "high": 2,
    "medium": 1,
    "low": 1,
    "info": 1
  },
  "disclaimer": "Deterministic heuristic pattern check — not a compiler, not an audit."
}

Try it — see the 402 challenge (free)

curl -i -X POST https://agent402.tools/api/solidity-scan \
  -H "Content-Type: application/json" \
  -d '{"source":"pragma solidity ^0.8.0;\ncontract Wallet {\n  function drain(address payable to) external {\n    require(tx.origin == msg.sender);\n    to.call{value: address(this).balance}(\"\");\n  }\n}"}'

The response is HTTP 402 Payment Required with exact payment requirements. Any x402 v2 client pays automatically and retries:

Paid call (JavaScript agent)

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
registerExactEvmScheme(client, { signer: privateKeyToAccount(KEY) });
const payFetch = wrapFetchWithPayment(fetch, client);

const res = await payFetch("https://agent402.tools/api/solidity-scan", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "source": "pragma solidity ^0.8.0;\ncontract Wallet {\n  function drain(address payable to) external {\n    require(tx.origin == msg.sender);\n    to.call{value: address(this).balance}(\"\");\n  }\n}"
  }),
});

No wallet? Pay with compute

This is a pure-CPU tool, so an agent without a wallet can pay with proof-of-work instead of USDC: fetch a challenge, solve the sha256 puzzle (16 leading zero bits — a fraction of a second of CPU, no money, no AI tokens), and resend with the X-Pow-Solution header.

import { createHash } from "node:crypto";
const lz = (b) => { let t = 0; for (const x of b) { if (!x) { t += 8; continue; } t += Math.clz32(x) - 24; break; } return t; };
const c = await (await fetch("https://agent402.tools/api/pow/challenge?slug=solidity-scan")).json();
let n = 0;
while (lz(createHash("sha256").update(c.challenge + ":" + n).digest()) < c.difficulty) n++;
await fetch("https://agent402.tools/api/solidity-scan", { method: "POST", headers: { "X-Pow-Solution": c.token + ":" + n, "Content-Type": "application/json" }, body: JSON.stringify({"source":"pragma solidity ^0.8.0;\ncontract Wallet {\n  function drain(address payable to) external {\n    require(tx.origin == msg.sender);\n    to.call{value: address(this).balance}(\"\");\n  }\n}"}) });

Part of these workflows

This tool is one step in a curated multi-tool workflow — agents can fetch the whole sequence as an MCP prompt or call https://agent402.tools/api/skill-packs/{slug}/prompt.

• Contract audit — Triage a smart contract before an agent interacts with it: verified source, heuristic vulnerability scan, known-address check, function-selector resolution, and a read-only dry-run of the exact call you plan to make.

Related tools