# Contract Risk API

> Contract Risk API is a paid API for AI agents from contract-risk-api-six.vercel.app, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-14).

Scans an EVM smart contract address on Base or Ethereum and returns a risk score by detecting upgradeable proxies and privileged functions from live bytecode.

## Facts

- Endpoint: POST https://contract-risk-api-six.vercel.app/scan
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/contract-risk-api-37f3dda9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_21MJbIFPtAvxjJwsR3tDZ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability contract-risk-api-37f3dda9 -d '<json body>'
```

Example prompt: Can you scan the Ethereum contract at 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 and tell me if it has any proxy upgrade patterns or privileged admin functions I should be worried about before I interact with it?

## When to prefer this

Use this endpoint when you need a quick, automated risk assessment of an unfamiliar EVM smart contract before trading, investing, or interacting with it on Base or Ethereum. It is especially valuable for detecting proxy upgradeability (which allows contract logic to be silently swapped) and privileged functions (which indicate centralized admin control or potential rug-pull vectors). Prefer this over general blockchain explorers when you need a structured risk score rather than raw bytecode, and when you want instant automated analysis rather than manual auditing.

## Known failure modes

- Invalid or non-existent contract address returns an error
- Unsupported chain value (not 'base' or 'ethereum') returns a validation error
- Contracts that use heavy obfuscation or non-standard bytecode may yield incomplete analysis
- Network timeouts when fetching live bytecode from the chain
- Payment failure due to insufficient USDC balance for x402 protocol

## How this service works

On-chain contract risk score: detects upgradeable proxies and privileged functions from live bytecode. Use before trading/interacting with an unfamiliar contract.

## Output

Returns a risk score and details about the scanned contract, including whether it uses an upgradeable proxy pattern, any detected privileged or admin-only functions, and overall risk indicators derived from live on-chain bytecode analysis.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "chain": {
   "enum": [
    "base",
    "ethereum"
   ],
   "type": "string",
   "description": "Chain to query (default: base)"
  },
  "address": {
   "type": "string",
   "description": "0x-prefixed EVM contract address to scan"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/contract-risk-api-37f3dda9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from contract-risk-api-six.vercel.app](https://www.zero.xyz/host/contract-risk-api-six.vercel.app/llms.txt)