# CanaryGuard EIP-712 Signature Auditor

> CanaryGuard EIP-712 Signature Auditor is a paid API for AI agents from canaryguard-402.onrender.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-20).

Audits EIP-712 and EIP-3009 typed-data signature payloads (Permit, Permit2, transferWithAuthorization) to detect malicious spender approvals and phishing domains.

## Facts

- Endpoint: GET https://canaryguard-402.onrender.com/v1/eip712-signature-audit?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/canaryguard-eip-712-signature-auditor-e1daeda8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_qhvH8_q6cyxSUKUU6j8cz

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability canaryguard-eip-712-signature-auditor-e1daeda8
```

Example prompt: Before I sign this Permit2 approval, can you audit this EIP-712 typed-data payload for me — the verifying contract is 0x000000000022D473030F116dDEE9F6B43aC78BA3 — and flag any malicious spender approvals or phishing domains?

## When to prefer this

Choose this endpoint when an AI agent or wallet needs to programmatically audit EIP-712, Permit, Permit2, or EIP-3009 transferWithAuthorization signatures before a user signs them — especially when guarding against phishing-style approval drainers or malicious spender addresses in DeFi contexts. It is purpose-built for typed-data signature security rather than general transaction decoding or bytecode analysis.

## Known failure modes

- Missing or invalid verifying_contract address returns a validation error
- Unrecognized or unsupported EIP type may result in incomplete audit
- Malformed JSON body returns a 400 error
- Temporary service unavailability on Render free-tier infrastructure may cause timeouts
- Unknown verifying contracts not in threat database may yield inconclusive results

## How this service works

Audits EIP-712 and EIP-3009 typed-data signature payloads (Permit, Permit2, transferWithAuthorization) to block malicious spender approvals and phishing domains.

## Output

Returns a risk assessment of the EIP-712 or EIP-3009 typed-data payload, including flags for malicious or suspicious spender addresses, identified phishing domains in the verifying contract or message data, and an overall safety verdict indicating whether the signature is safe to sign.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "verifying_contract"
     ],
     "properties": {
      "verifying_contract": {
       "type": "string"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/canaryguard-eip-712-signature-auditor-e1daeda8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from canaryguard-402.onrender.com](https://www.zero.xyz/host/canaryguard-402.onrender.com/llms.txt)