# Base Onchain Tools – Contract Audit

> Base Onchain Tools – Contract Audit is a paid API for AI agents from base-onchain-tools.dolerite.workers.dev, paid per call via x402, $0.04/call, status unknown (last checked 2026-10-11).

Audits a Base mainnet smart contract address to identify its standards, admin powers, proxy structure, and overall risk verdict

## Facts

- Endpoint: GET https://base-onchain-tools.dolerite.workers.dev/v1/base/contract-audit?utm_source=zero.xyz
- Price: $0.04/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/base-onchain-tools-contract-audit-6b4ecb0c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QMEtsAMFf_AHCKO_aY6UW

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability base-onchain-tools-contract-audit-6b4ecb0c
```

Example prompt: Can you audit the Base mainnet contract at 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 and tell me what standards it supports, whether it has dangerous admin powers, and what the overall risk verdict is?

## When to prefer this

Use this endpoint when you need a structured, human-readable security summary of a Base mainnet contract without parsing raw bytecode or ABI yourself. It is especially valuable when evaluating tokens before swapping, auditing DeFi protocols before depositing, or checking admin privileges before building integrations. Unlike a raw RPC call, it synthesizes proxy resolution, standard detection, and admin power classification into a single response. Prefer this over manual RPC queries when you need a quick verdict rather than raw contract data.

## Known failure modes

- Invalid or non-existent contract address returns a 4xx error (not billed)
- Non-contract address (EOA wallet) may return an error or empty result
- RPC failover exhausted across all five providers results in a 5xx (not billed)
- Incomplete batch data treated as failure rather than partial result
- Unverified contracts with heavily obfuscated bytecode may have high unidentified_count

## How this service works

Eleven read-only endpoints answering questions about Base mainnet that are tedious to assemble from raw RPC: what an unverified contract is actually able to do, whether a token transfer will revert and for what reason, what an arbitrary token is worth, and whether an address is safe to pay. Priced $0.001-$0.04 per call in USDC over x402. No account, no API key, no signup, no minimum, no rate limit to negotiate — the payTo address in the 402 response is the whole integration. Failed calls are not billed. The payment middleware cancels settlement on any 4xx or 5xx, so a malformed parameter or an upstream outage costs nothing. Answers are read live from Base mainnet at request time, with failover across five independent RPC providers. A batch that comes back incomplete is treated as a failure rather than returned with the missing entries as zeros, because a confident wrong answer costs a caller more than an error does. Scope is deliberately narrow: Base mainnet only, reads only, no keys held, nothing stored between requests.

## Output

Returns a JSON object with: proxy status and implementation address (if applicable), a risk verdict string (e.g. 'review'), a map of supported token standards (ERC20, EIP-2612, ERC-3009), a list of human-readable admin power descriptions (e.g. 'can mint or burn supply'), counts of identified and unidentified contract functions, and whether the contract is payable gaslessly via x402.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "address"
     ],
     "properties": {
      "address": {
       "type": "string",
       "description": "Contract address on Base mainnet"
      },
      "follow_proxy": {
       "type": "string",
       "description": "Optional, default true. Set to false to audit the proxy's own bytecode instead of its implementation."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "proxy": {
   "is_proxy": true,
   "implementation_address": "0x2ce6311ddae708829bc0784c967b7d77d19fd779"
  },
  "verdict": "review",
  "standards": {
   "erc20": true,
   "eip2612_permit": true,
   "eip3009_gasless": true
  },
  "admin_powers": [
   "can mint or burn supply",
   "can blacklist or freeze specific addresses, blocking their transfers",
   "can pause the contract"
  ],
  "identified_count": 28,
  "unidentified_count": 31,
  "x402_payable_gaslessly": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/base-onchain-tools-contract-audit-6b4ecb0c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from base-onchain-tools.dolerite.workers.dev](https://www.zero.xyz/host/base-onchain-tools.dolerite.workers.dev/llms.txt)