{"uid":"cap_1whMjPBaVgwcKqdMtsqrN","slug":"solidity-smart-contract-heuristic-linter-15e0a453","name":"Solidity Smart Contract Heuristic Linter","description":"Heuristic Solidity linter for a snippet or file (up to 60000 characters): unchecked low-level call/send/delegatecall, value-sending external calls before a storage write (possible reentrancy), arithmetic under pragma below 0.8.0 (overflow risk), and public or external state-changing functions without a visible owner or sender check, with line numbers. Not an audit; misses most real bugs.","url":"https://api.fadeandco.workers.dev/api/agent-intel/smart-contract-linter-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"source":{"type":"string","description":"Solidity source text, 10 to 60000 characters"}}},"responseSchema":{"type":"json","example":{"note":"Heuristic line rules only. Not a security audit. Real bugs are often missed and some findings are false alarms.","counts":{"high":2,"total":2,"medium":0},"source":"hand-written rules","verdict":"HIGH_RISK_PATTERNS","findings":[{"line":1,"rule":"unchecked-low-level-call","text":"function pay(address to) public { to.call{value: 1 ether}(\"\"); balance[to] = 0; }","severity":"high"},{"line":1,"rule":"possible-reentrancy","text":"state write after external call at line 1 in pay","severity":"high"}],"checkedAt":"2026-10-23T09:35:20.037Z"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_vsGpEJ98CjDa9Mk4u-loQ","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Runs heuristic static analysis on Solidity source code to detect common security patterns like unchecked low-level calls, reentrancy risks, arithmetic overflow, and missing access controls, returning findings with line numbers and severity.","exampleAgentPrompt":"Can you lint this Solidity contract for security issues and flag anything like unchecked low-level calls, reentrancy patterns, or missing access control checks? Here's the source: `pragma solidity ^0.7.0; contract Vault { mapping(address => uint) public balance; function withdraw() public { msg.sender.call{value: balance[msg.sender]}(\"\"); balance[msg.sender] = 0; } }`","exampleUseCases":[{"title":"Pre-deploy reentrancy check","prompt":"Before I deploy this contract, can you run it through the Solidity linter and tell me if there are any reentrancy risks or unchecked external calls? Here's the source code: `pragma solidity ^0.6.0; contract Bank { mapping(address => uint) balances; function withdraw(uint amt) external { msg.sender.call{value: amt}(\"\"); balances[msg.sender] -= amt; } }`"},{"title":"Overflow risk scan for legacy contract","prompt":"I have an old Solidity 0.7.0 contract that wasn't written with SafeMath — can you lint it for arithmetic overflow risks and any other high-risk patterns? Source: `pragma solidity ^0.7.0; contract Token { uint public totalSupply; function mint(uint amount) public { totalSupply += amount; } }`"},{"title":"Access control audit for public functions","prompt":"Can you check this smart contract for public or external state-changing functions that don't have any owner or sender access control? I want to know which functions are exposed without a guard. Source: `pragma solidity ^0.8.0; contract Admin { uint public value; function setValue(uint v) external { value = v; } }`"}],"resultDescription":"A JSON object containing a verdict string (e.g. HIGH_RISK_PATTERNS or CLEAN), severity counts (high, medium, total), a list of individual findings each with line number, rule name, matched source text, and severity, plus a checkedAt timestamp and a disclaimer note that this is heuristic-only and not a formal audit.","failureModes":["Source code shorter than 10 characters or longer than 60000 characters returns a validation error","Non-Solidity or malformed text may produce zero findings with no error, giving false confidence","Heuristic rules miss most real bugs and may produce false positives — findings are not exhaustive","Cloudflare Worker timeout on very large inputs near the 60000-character limit","Payment failure or missing x402 payment header returns a 402 or 401 response"],"whenToPreferThis":"Choose this endpoint for fast, inexpensive ($0.004) pre-deploy sanity checks on Solidity contracts when you need line-numbered findings for common patterns like reentrancy, unchecked calls, and missing access control. It is not a replacement for a formal audit but is useful for quick CI/CD signal, early-stage review, or screening untrusted contract code. Prefer dedicated audit tools or manual expert review for production deployments.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T00:33:39.614Z","isFirstParty":false,"canonicalSlug":"solidity-smart-contract-heuristic-linter-15e0a453"}