# Forensik Bytecode Clone Provenance Analyzer

> Forensik Bytecode Clone Provenance Analyzer is a paid API for AI agents from forensik.halowerk.com, paid per call via x402, $0.001/call, status unknown (last checked 2026-11-02).

Analyzes caller-supplied bytecode evidence to classify smart contract clone provenance, confidence thresholds, and missing signal gaps without querying any blockchain directly.

## Facts

- Endpoint: POST https://forensik.halowerk.com/v1/bytecode-clone-provenance?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-02
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/forensik-bytecode-clone-provenance-analyzer-96ef83a5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Mi48qUlMkKF_Hr7IvLn4P

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability forensik-bytecode-clone-provenance-analyzer-96ef83a5 -d '<json body>'
```

Example prompt: Check the bytecode clone provenance for contract 0xABC123 — I have evidence showing 87% unmatched bytecode, an unknown deployer flag set to true, and a metadata divergence count of 3, all observed at 2024-11-01T12:00:00Z from on-chain analysis.

## When to prefer this

Choose this endpoint when you have pre-collected bytecode forensic signals (unmatched bytecode percentage, unknown deployer status, metadata divergence count) for a smart contract and need a structured provenance classification with explicit confidence thresholds — especially when you cannot or do not want the service to perform live chain queries. It is ideal for offline audit pipelines, pre-screening workflows, or integrating forensic scoring into a larger risk assessment system. Prefer sibling endpoints (Dusting Attack Monitor, Address Poisoning Detector) for those specific threat categories instead.

## Known failure modes

- Missing required evidence items returns an error or low-confidence result when strict mode is enabled
- Unrecognized metric enum values are rejected with a validation error
- Evidence array with no items fails schema validation (minItems:1)
- Subject string exceeding 256 characters is rejected
- Stale or conflicting timestamps across repeated metrics may reduce classification confidence
- Calling with strict:true but omitting any documented metric causes the request to be rejected outright

## How this service works

Bytecode Clone Provenance analyses only the evidence supplied by the caller. It does not claim to query a chain, identify a legal status or replace an independent audit. Missing signals lower confidence and are listed explicitly; every classification includes the exact thresholds used.

## Output

Returns a clone provenance classification for the subject (e.g., confirmed clone, likely clone, inconclusive, original), a confidence score with the exact thresholds applied, a list of any missing or low-signal metrics that reduced confidence, and the caller-supplied context labels echoed back for correlation.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "strict": {
   "type": "boolean",
   "default": false,
   "description": "Reject unless all documented metrics are supplied."
  },
  "context": {
   "type": "object",
   "description": "Optional non-secret labels returned unchanged for correlation.",
   "maxProperties": 20,
   "additionalProperties": {
    "type": [
     "string",
     "number",
     "boolean",
     "null"
    ]
   }
  },
  "subject": {
   "type": "string",
   "maxLength": 256,
   "minLength": 1,
   "description": "Address, transaction, protocol, asset, proposal or other subject being assessed."
  },
  "evidence": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "metric",
     "value"
    ],
    "properties": {
     "note": {
      "type": "string",
      "maxLength": 500
     },
     "value": {
      "type": [
       "number",
       "boolean"
      ]
     },
     "metric": {
      "enum": [
       "unmatched_bytecode_pct",
       "unknown_deployer",
       "metadata_divergence_count"
      ],
      "type": "string"
     },
     "source": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "Evidence source or query identifier."
     },
     "timestamp": {
      "type": "string",
      "maxLength": 40,
      "minLength": 10,
      "description": "ISO-8601 observation time."
     }
    },
    "additionalProperties": false
   },
   "maxItems": 50,
   "minItems": 1,
   "description": "Caller-supplied observations. Repeated metrics form a time series; the newest timestamp is assessed."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "scope": "caller_supplied_evidence_only",
  "engine": "verify",
  "service": "Bytecode Clone Provenance",
  "subject": "bytecode-clone-provenance-sample",
  "confidence": 100,
  "risk_score": 12.85,
  "generated_at": "2026-10-23T00:07:35.809Z",
  "classification": "low",
  "recommendation": "No supplied metric crossed a warning thr",
  "service_number": 99
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/forensik-bytecode-clone-provenance-analyzer-96ef83a5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from forensik.halowerk.com](https://www.zero.xyz/host/forensik.halowerk.com/llms.txt)