# HTTPay Contract Audit Scanner

> HTTPay Contract Audit Scanner is a paid API for AI agents from httpay.xyz, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Automated smart contract security scanner that checks for reentrancy, oracle staleness, unchecked returns, proxy risks, and other vulnerabilities, returning a risk score and actionable findings.

## Facts

- Endpoint: POST https://httpay.xyz/api/contract-audit-scanner
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/httpay-contract-audit-scanner-acc90cb1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_vTBH4UtLjtTWSA19hrX63

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability httpay-contract-audit-scanner-acc90cb1 -d '<json body>'
```

Example prompt: Can you run a security audit on smart contract 0x1234567890abcdef1234567890abcdef12345678 on chain ID 8453 (Base) and tell me the risk score and any vulnerabilities like reentrancy or oracle issues?

## When to prefer this

Use this endpoint when you need a fast, automated security pre-screen of a smart contract before interacting with it, investing in a DeFi protocol, or integrating a contract into a workflow. It is ideal for agents performing due diligence on unknown contracts without requiring a full manual audit. At $0.05 per call with no API key setup, it is well suited for on-demand, per-contract checks.

## Known failure modes

- Invalid contract address format — returns error if address is not a valid hex address
- Contract not found on specified chain — returns error if no bytecode exists at the address
- Unsupported chainId — returns error if the chain is not supported by the scanner
- Payment failure — returns 402 if USDC payment via x402 on Base is not completed
- Timeout — complex contracts may take longer to analyze and could time out

## How this service works

Automated smart contract security scanner — checks for reentrancy, oracle staleness, unchecked returns, proxy risks, and more. Returns risk score and actionable findings.

## Output

Returns a JSON object containing an automated security assessment of the smart contract, including an overall risk score and a list of actionable findings covering reentrancy vulnerabilities, oracle staleness, unchecked return values, proxy risks, and other common smart contract security issues.

## Example request

```json
{
 "chainId": "8453",
 "contractAddress": "0x1234567890123456789012345678901234567890"
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "description": "Automated smart contract security scanner — checks for reentrancy, oracle staleness, unchecked returns, proxy risks, and more. Returns risk score and actionable findings."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/httpay-contract-audit-scanner-acc90cb1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from httpay.xyz](https://www.zero.xyz/host/httpay.xyz/llms.txt)