# ScanPay Token Security Audit

> ScanPay Token Security Audit is a paid API for AI agents from scanpay-ob3w.onrender.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-31).

Scans an ERC-20 or Solana SPL token contract for security vulnerabilities and returns a risk verdict with a trade gate decision

## Facts

- Endpoint: POST https://scanpay-ob3w.onrender.com/v2/token/audit?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/scanpay-token-security-audit-28d4e9f6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_MgppTLvpnUPh9fSuRfkSw

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability scanpay-token-security-audit-28d4e9f6 -d '<json body>'
```

Example prompt: Can you run a security audit on the Ethereum token at 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 and tell me whether it's safe to trade — give me the risk score and the verdict?

## When to prefer this

Use this endpoint when you need a fast, automated, per-token security risk verdict before executing a trade or swap — especially in agentic DeFi workflows where a human cannot manually audit contracts. Prefer this over manual block explorer inspection when you need a structured risk_score and binary allow_trade gate that can be consumed programmatically by a trading bot or agent.

## Known failure modes

- Invalid or malformed token address returns an error response
- Unsupported chain value outside 'base', 'ethereum', or 'solana' returns a validation error
- Network or service unavailability on the hosted render.com instance may cause timeouts
- Newly deployed contracts with no on-chain history may return limited findings
- Payment failure (x402 micropayment not fulfilled) blocks the request

## How this service works

Deterministic AST code security scanner with x402 Solana micropayments, remote MCP, and ERC-8183 Evaluator oracle.

## Output

A JSON object containing a list of security findings (vulnerabilities, warnings, or an empty array if none), plus an execution_gate object with a verdict string (e.g. 'SAFE' or 'UNSAFE'), a numeric risk_score (0–100), and an allow_trade boolean indicating whether the token passes the security threshold for trading.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "chain",
  "token_address"
 ],
 "properties": {
  "chain": {
   "type": "string",
   "description": "Target chain: 'base', 'ethereum', or 'solana'"
  },
  "token_address": {
   "type": "string",
   "description": "ERC-20 contract (0x...) or Solana SPL mint address"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "findings": [],
  "execution_gate": {
   "verdict": "SAFE",
   "risk_score": 0,
   "allow_trade": true
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/scanpay-token-security-audit-28d4e9f6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from scanpay-ob3w.onrender.com](https://www.zero.xyz/host/scanpay-ob3w.onrender.com/llms.txt)