# Solidity Smart Contract Heuristic Linter

> Solidity Smart Contract Heuristic Linter is a paid API for AI agents from api.fadeandco.workers.dev, paid per call via x402, $0.004/call, status unknown (last checked 2026-10-29).

Runs heuristic static analysis on Solidity source code to detect common security patterns like unchecked low-level calls, reentrancy risks, arithmetic overflow, and missing access controls, returning findings with line numbers and severity.

## Facts

- Endpoint: POST https://api.fadeandco.workers.dev/api/agent-intel/smart-contract-linter-audit?utm_source=zero.xyz
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/solidity-smart-contract-heuristic-linter-15e0a453
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1whMjPBaVgwcKqdMtsqrN

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability solidity-smart-contract-heuristic-linter-15e0a453 -d '<json body>'
```

Example prompt: Can you lint this Solidity contract for security issues and flag anything like unchecked low-level calls, reentrancy patterns, or missing access control checks? Here's the source: `pragma solidity ^0.7.0; contract Vault { mapping(address => uint) public balance; function withdraw() public { msg.sender.call{value: balance[msg.sender]}(""); balance[msg.sender] = 0; } }`

## When to prefer this

Choose this endpoint for fast, inexpensive ($0.004) pre-deploy sanity checks on Solidity contracts when you need line-numbered findings for common patterns like reentrancy, unchecked calls, and missing access control. It is not a replacement for a formal audit but is useful for quick CI/CD signal, early-stage review, or screening untrusted contract code. Prefer dedicated audit tools or manual expert review for production deployments.

## Known failure modes

- Source code shorter than 10 characters or longer than 60000 characters returns a validation error
- Non-Solidity or malformed text may produce zero findings with no error, giving false confidence
- Heuristic rules miss most real bugs and may produce false positives — findings are not exhaustive
- Cloudflare Worker timeout on very large inputs near the 60000-character limit
- Payment failure or missing x402 payment header returns a 402 or 401 response

## How this service works

Heuristic Solidity linter for a snippet or file (up to 60000 characters): unchecked low-level call/send/delegatecall, value-sending external calls before a storage write (possible reentrancy), arithmetic under pragma below 0.8.0 (overflow risk), and public or external state-changing functions without a visible owner or sender check, with line numbers. Not an audit; misses most real bugs.

## Output

A JSON object containing a verdict string (e.g. HIGH_RISK_PATTERNS or CLEAN), severity counts (high, medium, total), a list of individual findings each with line number, rule name, matched source text, and severity, plus a checkedAt timestamp and a disclaimer note that this is heuristic-only and not a formal audit.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "source": {
   "type": "string",
   "description": "Solidity source text, 10 to 60000 characters"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "note": "Heuristic line rules only. Not a security audit. Real bugs are often missed and some findings are false alarms.",
  "counts": {
   "high": 2,
   "total": 2,
   "medium": 0
  },
  "source": "hand-written rules",
  "verdict": "HIGH_RISK_PATTERNS",
  "findings": [
   {
    "line": 1,
    "rule": "unchecked-low-level-call",
    "text": "function pay(address to) public { to.call{value: 1 ether}(\"\"); balance[to] = 0; }",
    "severity": "high"
   },
   {
    "line": 1,
    "rule": "possible-reentrancy",
    "text": "state write after external call at line 1 in pay",
    "severity": "high"
   }
  ],
  "checkedAt": "2026-10-23T09:35:20.037Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/solidity-smart-contract-heuristic-linter-15e0a453/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.fadeandco.workers.dev](https://www.zero.xyz/host/api.fadeandco.workers.dev/llms.txt)