# x402 Address-Poisoning Check (Base USDC)

> x402 Address-Poisoning Check (Base USDC) is a paid API for AI agents from paycheck.hectichustle.workers.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-17).

Checks whether a recipient Ethereum address is a lookalike/poisoning attack relative to a sender's transaction history, returning a risk level and reasons.

## Facts

- Endpoint: POST https://paycheck.hectichustle.workers.dev/address/check?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/x402-address-poisoning-check-base-usdc-889423fb
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Iw_QeimP3F33Clwnsn2Qu

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability x402-address-poisoning-check-base-usdc-889423fb -d '<json body>'
```

Example prompt: Before I send any USDC, check if 0x509e55c4f898b43c856fb0e51048b1b7bfbc9ede is a safe recipient — my wallet is 0x9d42eba8868cfd38a50ba615ee0cf903f1bbece9 — and tell me if it looks like an address-poisoning lookalike or if I've paid it before.

## When to prefer this

Use this endpoint when you need a fast, low-cost ($0.001) preliminary poisoning check before a USDC transfer on Base, and you don't need full historical coverage (which the sibling full-history endpoint provides at $0.05). Ideal for real-time pre-transfer validation in wallets, bots, or agent workflows where speed matters and a 36% history window scan is sufficient signal.

## Known failure modes

- Invalid Ethereum address format for 'to' or 'from' — returns validation error
- Payment not received or insufficient USDC payment — x402 payment required response
- RPC rate limits or node unavailability causing partial scan (reflected in coverage.complete=false)
- Very new addresses with no history returning low coverage percentage
- Network congestion on Base causing slow or timed-out RPC calls

## How this service works

Address-poisoning check before you send USDC on Base. Body {from, to} (or sender/recipient; chain=base, token=USDC only, others 400 not charged; optional contacts/known_addresses): scans the sender's recent Base USDC transfers for lookalikes (same first/last 4 hex) plus dust/zero-value transfers. No sender? {recipient, known_addresses} = offline contacts check; {address} alone scans its own history for poisoning signs. Returns risk low/medium/high, lookalikes, reasons, coverage.

## Output

A JSON object containing: the 'to' and 'from' addresses, a 'risk' field ('low', 'medium', or 'high'), a 'reasons' array explaining the assessment, a 'seenBefore' boolean indicating if the recipient was found in prior transactions, a 'lookalikes' array of any suspicious similar addresses found, and a 'coverage' object describing how many blocks and RPC calls were scanned and what percentage of history was covered.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "to": {
   "type": "string",
   "pattern": "^0x[0-9a-fA-F]{40}$",
   "description": "Intended recipient (aliases: recipient, toAddress, address). Required in every shape."
  },
  "from": {
   "type": "string",
   "pattern": "^0x[0-9a-fA-F]{40}$",
   "description": "Sender address (aliases: sender, fromAddress). Omit for contacts-only or recipient-only mode."
  },
  "chain": {
   "type": [
    "string",
    "integer"
   ],
   "description": "Optional. Base only (base, eip155:8453, 8453). Any other chain returns 400 unsupported_chain and is not charged — Shield only scans Base USDC."
  },
  "token": {
   "type": "string",
   "description": "Optional. USDC only (symbol USDC or Base USDC contract). Any other token (e.g. USDT) returns 400 unsupported_token and is not charged."
  },
  "contacts": {
   "type": "array",
   "items": {
    "type": "string",
    "pattern": "^0x[0-9a-fA-F]{40}$"
   },
   "maxItems": 50,
   "description": "Optional: up to 50 trusted addresses / address book (aliases: known_addresses, known). With from: offline lookalike of contacts too. Without from: contacts-only mode (no RPC)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "to": "0x509e55c4f898b43c856fb0e51048b1b7bfbc9ede",
  "from": "0x9d42eba8868cfd38a50ba615ee0cf903f1bbece9",
  "risk": "low",
  "reasons": [
   "you have paid 'to' before and no lookalikes found"
  ],
  "coverage": {
   "complete": false,
   "rpcCalls": 47,
   "scannedTo": 52518176,
   "coveragePct": 38,
   "scannedFrom": 52468176,
   "windowBlocks": 50000,
   "transfersSeen": 19
  },
  "lookalikes": [],
  "seenBefore": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/x402-address-poisoning-check-base-usdc-889423fb/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from paycheck.hectichustle.workers.dev](https://www.zero.xyz/host/paycheck.hectichustle.workers.dev/llms.txt)