# TrollBridge /prove-state — Smart Contract No-Theft Symbolic Execution

> TrollBridge /prove-state — Smart Contract No-Theft Symbolic Execution is a paid API for AI agents from mini-tollbooth.onrender.com, paid per call via x402, $1/call, status unknown (last checked 2026-10-11).

Submits a smart contract for symbolic execution (halmos engine) to check the no-theft property, or polls the status of a previously submitted job

## Facts

- Endpoint: GET https://mini-tollbooth.onrender.com/prove-state?utm_source=zero.xyz
- Price: $1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/trollbridge-prove-state-smart-contract-no-theft-symbolic-execution-3654ccac
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_CgXVBdypO52lEwmqzYTNG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability trollbridge-prove-state-smart-contract-no-theft-symbolic-execution-3654ccac
```

Example prompt: Run a no-theft symbolic execution check on the contract at 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 on Base — submit the job and let me know the job ID so I can check back on the results.

## When to prefer this

Choose this endpoint when you need to programmatically check whether a smart contract is vulnerable to token theft via symbolic execution before interacting with it, integrating it, or deploying it. It is especially valuable for AI agents evaluating DeFi protocols, token contracts, or any EVM contract where fund drainage is a risk. Unlike static analysis or rule-based scanners, this runs the halmos symbolic engine to find concrete counterexample theft paths. Use this over simpler honeypot or approval-risk checks when you want deeper, function-level symbolic reasoning about theft vectors. Note: results are bounded symbolic execution, not full formal verification — appropriate for practical security screening.

## Known failure modes

- Contract address not verified on Sourcify — no source available for analysis
- Unsupported solc_version provided (only 0.8.20, 0.8.24, 0.8.26, 0.8.28 accepted)
- Source exceeds 200KB limit
- Missing required fields: action, and either address or source+solc_version+contract_name
- Invalid or expired job_id when polling status
- Payment not received — $1 USDC required for submit action
- Analysis times out for very complex contracts beyond halmos bounds

## How this service works

The insurance booth for AI agents, with Mini's Agent Supply Store on the side of the road. One hundred checkpoints: pre-transaction safety lanes (honeypot, approval-risk, rug-score, receipt-check, tx-dryrun, permit-scan, airdrop-verdict, deployer-history, wallet-watch, secret-scan at $0.02 USDC per call; the protection tier — /contract-check, /approval-screen, /tx-plain-english, /honeypot-check, /tx-simulate, /redteam, /skill-scan, /verdict, /egress-audit, /tool-gate, /airlock, /repo-scan, /prove, /task-scope — at $0.10; the one-call /shield don't-get-rugged screen at $0.25; the full /preflight bundle at $0.05), bounty intel (bounties, fresh, verdicts, deadlines, sweepstakes, opportunities) at $0.02 USDC per call, trader intel (/prices and /quant at $0.02; /enrich and /token-check at $0.05; /contract-check and /honeypot-check at $0.10; /sec-facts at $0.05), market intel (/markets and /search at $0.05; /grants at $0.02), DeFi intel (/yields and /new-pairs at $0.05; /gas and /defi at $0.02), AI intel (/models at $0.02), agent-ops intel (/prompt-cost, /model-picks, /rpc-speed, /terms-tldr, /scrape, /gigs, /retry-verify, /idempotency, /verify-independent at $0.02; /site-watch, /wallet-check, /code-run, /regulatory-pack, /sage, /cron-watch, /caveat-check, /tripwire, /escrow, /trust, /bridge-fees, /dao-votes, /dev-activity, /dex-arb, /dydx-perps, /funding-rates, /gas-predict, /hack-tracker, /long-short-ratio, /lp-yields, /mev-scan, /open-interest, /perp-basis, /polymarket-odds, /rwa-watch, /sentiment, /stablecoin-flows, /tokenomics, /top-movers, /whale-watch, and /yield-stable at $0.05; /approval-screen, /tx-plain-english, /tx-simulate, and /task-scope at $0.10; /scam-scan deep scan at $5.00 or 30-day subscription at $30.00), supply store (/road-pack combo meal at $0.05; curated datasets, the /audit-prep pre-audit review, and the /prove-state symbolic-execution run at $1.00; the /audit AI-agent audit at $25.00). Every lane answers before money moves — heuristic verdicts, not audits. Don't get rugged.

## Output

On submit (action=submit): returns a job_id, status (pending), ETA (~10-40 min), a polling URL, and the property being tested (no-theft). On status poll (action=status): returns current job status, and when complete includes symbolic execution findings — if a theft path was found, concrete counterexample traces for each vulnerable public function are included. Results are honestly labeled as bounded symbolic execution (not formal proof).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "action"
     ],
     "properties": {
      "chain": {
       "type": "string",
       "description": "base | ethereum (default base). Submit path A."
      },
      "action": {
       "type": "string",
       "description": "submit (tolled $1) or status (free)."
      },
      "job_id": {
       "type": "string",
       "description": "Job id from a submit — for action=status."
      },
      "source": {
       "type": "string",
       "description": "Raw Solidity source (max 200KB). Submit path B — needs solc_version + contract_name."
      },
      "address": {
       "type": "string",
       "description": "Contract address with verified source on Sourcify (0x…). Submit path A."
      },
      "property": {
       "type": "string",
       "description": "'no-theft' (v1 supports only the no-theft property)."
      },
      "solc_version": {
       "type": "string",
       "description": "0.8.20 | 0.8.24 | 0.8.26 | 0.8.28. Submit path B."
      },
      "contract_name": {
       "type": "string",
       "description": "Contract to test inside the source. Submit path B."
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "eta": "~10-40 min",
  "lane": "/prove-state",
  "check": "GET /prove-state?action=status&job_id=ps_9f2c4a1b7e30c1d2",
  "job_id": "ps_9f2c4a1b7e30c1d2",
  "status": "pending",
  "warning": "NOT_A_PROOF — symbolic execution within stated bounds, not formal verification.",
  "property": "no-theft",
  "description": "NOT A PROOF — symbolic execution (rung 2): we run the halmos engine against the contract's no-theft property — one symbolic call per public function, symbolic attacker, concrete counterexample traces when a theft path exists. Async: $1 submits the job, poll status free. Bounded scope, honestly labeled."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/trollbridge-prove-state-smart-contract-no-theft-symbolic-execution-3654ccac/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from mini-tollbooth.onrender.com](https://www.zero.xyz/host/mini-tollbooth.onrender.com/llms.txt)