# OneKeyAway DeFi Contract Control Check

> OneKeyAway DeFi Contract Control Check is a paid API for AI agents from onekeyaway.appin60.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-30).

Returns who holds privileged roles (upgrade, mint, pause) on a smart contract and assesses whether those powers are secured by a single EOA, multisig, or timelock

## Facts

- Endpoint: GET https://onekeyaway.appin60.com/api/control?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/onekeyaway-defi-contract-control-check-7ec3ce03
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_9ffBUcuYjVzZR_imXqDpQ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability onekeyaway-defi-contract-control-check-7ec3ce03
```

Example prompt: Can you check whether the USDC contract at 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 on Base is controlled by a single key or a proper multisig — I want to know who can actually upgrade or pause it?

## When to prefer this

Choose this endpoint when you need a fast, structured assessment of who holds privileged on-chain powers for a specific DeFi contract — especially when evaluating protocol security risk before investing, integrating, or reporting. It covers 480 DeFi tokens across 15+ chains and specifically identifies whether control ends at a dangerous single EOA, a threshold Safe, or a timelock. Prefer this over generic block explorer lookups when you want a pre-interpreted risk verdict rather than raw on-chain data.

## Known failure modes

- Contract address not found or invalid hex format returns an error
- Unsupported chain ID returns an error listing valid chains
- Contract not in the 480-token dataset may return limited or no role data
- Non-upgradeable contracts may return empty roles list
- Payment not received or insufficient USDC results in 402 response

## How this service works

Free check: who can upgrade, mint or pause a smart contract. An EOA, a 1-of-n Safe, a real multisig, or a timelock. Results from 480 DeFi tokens.

## Output

Returns a JSON object with the contract name, symbol, chain, proxy type, upgradeability flag, a list of privileged roles (each with role name, power description, holder address, and controller kind/risk), an overall worst-risk level, and a plain-English verdict string indicating whether the contract is one key away from compromise.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "chain",
      "address"
     ],
     "properties": {
      "chain": {
       "type": "string",
       "example": "8453",
       "description": "Chain id or name: 1, 8453, 42161, 10, 56, 137, 43114, 146, 59144, 81457, 80094, 324, 999, 130, 747474 (or ethereum, base, arbitrum, optimism, bsc, polygon, avalanche, sonic, linea, blast, berachain, zksync, hyperevm, unichain, katana)"
      },
      "address": {
       "type": "string",
       "example": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
       "description": "Contract address (0x + 40 hex)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "name": "USD Coin",
  "chain": "base",
  "roles": [
   {
    "role": "proxy admin",
    "power": "can replace all contract code",
    "holder": "0x...",
    "controller": {
     "kind": "EOA",
     "risk": "single"
    }
   }
  ],
  "symbol": "USDC",
  "address": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
  "chainId": 8453,
  "verdict": "SINGLE KEY: at least one power ends at an EOA (one on-chain signer)",
  "proxyType": "transparent (EIP-1967 admin slot)",
  "worstRisk": "single",
  "upgradeable": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/onekeyaway-defi-contract-control-check-7ec3ce03/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from onekeyaway.appin60.com](https://www.zero.xyz/host/onekeyaway.appin60.com/llms.txt)