# CanaryGuard EIP-712 Signature Auditor

> CanaryGuard EIP-712 Signature Auditor is a paid API for AI agents from canaryguard-402.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-17).

Audits EIP-712 and EIP-3009 typed-data signature payloads (Permit, Permit2, transferWithAuthorization) to detect unauthorized token approvals and replay attack vectors

## Facts

- Endpoint: GET https://canaryguard-402.onrender.com/v1/security/eip712-signature-auditor?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/canaryguard-eip-712-signature-auditor-cd0d955d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_hxrDeV6BNlZUzM2gGeO7j

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability canaryguard-eip-712-signature-auditor-cd0d955d
```

Example prompt: Before I sign this Permit2 request, can you audit this EIP-712 payload? The primary type is 'PermitTransferFrom', the spender is 0xAbC123...456, and the verifying contract is 0xDef789...012 — flag any replay attack risks or unauthorized approval vectors.

## When to prefer this

Use this endpoint when an AI agent or wallet interface needs to programmatically screen EIP-712 / EIP-3009 typed-data signature requests before a user signs them — especially for Permit, Permit2, and transferWithAuthorization flows where a malicious payload could silently authorize unlimited token transfers. Prefer this over generic contract auditors when the threat surface is specifically the off-chain signature and not the on-chain contract code itself.

## Known failure modes

- Invalid or unrecognized primary_type returns validation error
- Malformed or checksum-invalid Ethereum addresses cause rejection
- Unknown verifying contract address may limit risk context
- Service may return false negatives for novel attack patterns not yet in its ruleset
- Rate limiting or payment failure returns 402 or 429 error

## How this service works

Audits EIP-712 and EIP-3009 typed-data signature payloads (Permit, Permit2, transferWithAuthorization) to prevent unauthorized token approvals and replay attacks.

## Output

Returns a structured security audit of the typed-data signature payload, including risk classification, identified attack vectors (replay attacks, unauthorized approvals, suspicious spender addresses, malicious verifying contracts), and a pass/fail or risk-level verdict for the given Permit, Permit2, or transferWithAuthorization payload.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "primary_type": {
   "type": "string"
  },
  "spender_or_to": {
   "type": "string"
  },
  "verifying_contract": {
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/canaryguard-eip-712-signature-auditor-cd0d955d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from canaryguard-402.onrender.com](https://www.zero.xyz/host/canaryguard-402.onrender.com/llms.txt)