.         .

          \                 |                 /
              \             |             /
   .              \         |         /              .
                       .-'''''''-.
        :             /           \             :
                     |             |
           -   -   - |             | -   -   -
                     |             |
        :             \           /             :
                       '-.......-'
   .              /         |         \              .
              /             |             \
          /                 |                 \

                       .         .

        _    ____   ___  _     _     ___
       / \  |  _ \ / _ \| |   | |   / _ \
      / _ \ | |_) | | | | |   | |  | | | |
     / ___ \|  __/| |_| | |___| |__| |_| |
    /_/   \_\_|    \___/|_____|_____\___/

the oracle reads your contract

Submit a contract. I will scan it for known anti-patterns and vulnerabilities. No account. No API key. No subscription. Fifty cents, settled directly on-chain.
[STATUS]
consulting the light
[PRICE]
$0.50 USDC per reading
[NETWORK]
base · x402
what I look for
  • tx.origin Human: A common trick used to execute phishing attacks. Agent: Identifies authorization checks bypassing msg.sender.
  • delegatecall Human: Letting outside code maliciously rewrite your rules. Agent: Flags state manipulation via untrusted target contracts.
  • selfdestruct Human: A kill switch that can strand or destroy funds. Agent: Detects operations that forcibly remove bytecode.
  • Low-level calls Human: Risky transfers where hackers hide secondary attacks. Agent: Flags unprotected .call{value: x} reentrancy vectors.
  • block.timestamp Human: Trusting the network's clock too much. Agent: Flags timestamp dependence in core contract logic.
  • Compiler bypasses Human: Code that ignores standard safety checks. Agent: Flags floating pragmas and raw inline assembly.

Each finding returns with its line numbers and the reason it matters, as structured JSON your agent can act on.

what I will not tell you

That your contract is safe. I identify known structural vulnerabilities, not logical intent. This is an automated pre-audit designed for speed, not a formal security audit. It highlights risk patterns but cannot guarantee the absence of unknown exploits. It does not replace a human review.

False confidence is a liability.

consult

Any x402-capable client handles the payment handshake automatically. Request a scan, and the endpoint returns a 402 Payment Required with exact pricing terms.

from x402.clients import x402HttpxClient

async with x402HttpxClient(account=account,
        base_url="https://apollo-contract-scan.vercel.app") as client:
    r = await client.post("/scan", json={
        "address": "0x...", "chain_id": 8453})
    print(await r.aread())
  • POST /scan          — $0.50 in USDC on Base
  • POST /scan-testnet — the same reading on Base Sepolia, to try me free
  • GET /health        — what is live, and what is not

Ask with {"address": "0x...", "chain_id": 8453} for any contract whose source is verified on Sourcify, or hand me the source directly as {"source": "pragma solidity..."}.