# ERC-20 Approval Risk Auditor

> ERC-20 Approval Risk Auditor is a paid API for AI agents from x402.dailyelo.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-10).

Ranks a wallet's standing ERC-20/Permit2 approvals by danger level, flagging unlimited allowances, unknown spenders, and classic drainer patterns

## Facts

- Endpoint: POST https://x402.dailyelo.com/v1/approval-risk?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-10
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/erc-20-approval-risk-auditor-64e53781
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_mWkwrvK0OUgYoAoVaASOv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability erc-20-approval-risk-auditor-64e53781 -d '<json body>'
```

Example prompt: Audit these token approvals for me and tell me which ones are dangerous or should be revoked: USDC approved to 0xAbCd...1234 for unlimited amount, WETH approved to 0x1111...2222 for 1000000000000000000, and DAI approved to 0xDEAD...BEEF for unlimited amount.

## When to prefer this

Use this endpoint when you already have a list of raw approval records from on-chain lookups and need a deterministic, rule-based risk ranking — not a raw allowance fetch. Prefer this over generic blockchain APIs when the goal is specifically to identify dangerous approvals (unlimited, unknown spender, drainer pattern) and prioritize revocations. It is fully deterministic with no LLM or external dependencies, making it reliable and auditable for security-critical workflows.

## Known failure modes

- Missing required fields (spender or allowance) returns a validation error
- Malformed addresses (non-0x, wrong length) may cause parsing errors
- Empty approvals array returns no results
- Invalid allowance format (non-numeric, non-hex) causes rejection
- Payment failure or insufficient USDC balance blocks the call

## How this service works

Audit standing ERC-20/Permit2 approvals for danger. Raw allowance lookups exist elsewhere; this is the risk layer: pass your current approvals and we rank which to revoke — unlimited allowance, unknown (non-registry) spender, or the classic drainer pattern (unlimited AND unknown). Deterministic, no LLM, no external calls. Answers an agent's question 'which of my approvals are dangerous?'

## Output

A ranked list of the submitted approvals annotated with risk flags: whether the allowance is unlimited, whether the spender is unknown (not in a recognized registry), and whether the combination matches the classic drainer pattern (unlimited AND unknown spender). Each approval receives a risk classification so the agent can advise the user which to revoke first.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "approvals": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "spender",
     "allowance"
    ],
    "properties": {
     "token": {
      "type": "string",
      "description": "ERC-20 token address (0x)"
     },
     "spender": {
      "type": "string",
      "description": "approved spender address (0x)"
     },
     "allowance": {
      "type": "string",
      "description": "raw approved amount (uint, decimal or 0x hex)"
     }
    }
   },
   "description": "standing approvals to audit"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "count": 2,
  "items": [
   {
    "token": "0x4200000000000000000000000000000000000006",
    "spender": "0xdeadbeef00000000000000000000000000000001",
    "allowance": "unlimited",
    "risk_flags": [
     "unlimited_allowance",
     "unknown_spender"
    ],
    "action_hint": "revoke_now",
    "spender_known": null
   }
  ],
  "summary": {
   "invalid": 0,
   "unlimited": 2,
   "revoke_now": 1,
   "consider_revoke": 1,
   "unknown_spender": 1
  },
  "confidence": 1,
  "action_hint": "revoke_now"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/erc-20-approval-risk-auditor-64e53781/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.dailyelo.com](https://www.zero.xyz/host/x402.dailyelo.com/llms.txt)