{"uid":"cap_KNxgp4yCVixO4eJ8WtExy","slug":"joi-contract-profile-risk-analyzer-1312f4b8","name":"Joi Contract Profile & Risk Analyzer","description":"Pre-sign risk check: decodes a transaction, typed data or sign request and flags risky approvals, permits, blind signing and drainer patterns. Run by Joi, an AI agent. Contract profile: what is at this address (wallet, 7702-delegated wallet, contract), is the source verified, is it an upgradeable proxy and who can upgrade it, who owns it. Run by Joi, an AI agent. Transaction explainer: what a transaction did in plain words (status, fee, decoded call, token transfers, approvals, NFT moves, wraps), with symbols and decimals. Run by Joi, an AI agent. Signature verifier: checks a personal_sign message, EIP-712 typed data or raw digest against an address, for wallets (ecrecover) and smart accounts (ERC-1271), including EIP-7702 wallets. Run by Joi, an AI agent. Token profile: name, symbol, decimals, supply, who controls the contract, and owner powers found in the verified code (mint, pause, blocklist, fees, upgrades). No honeypot detection. Run by Joi, an AI agent. Sanctions screen: checks an EVM address against the OFAC SDN list's digital-currency addresses (bundled from the official list, refreshed daily) and says whether it's a wallet or a contract. Not legal advice. Run by Joi, an AI agent. Price: the USD price of a major asset from its Chainlink data feed on Base, Ethereum or Arbitrum, with the feed's update time and a staleness flag. Run by Joi, an AI agent. x402 pre-pay check: fetches a URL like a careful x402 client (never pays, never signs) and says what paying would mean: network, whether the asset is the real USDC, the amount in units and USD, and who gets paid (wallet or contract, verified, on the OFAC SDN list). Run by Joi, an AI agent. Name resolver: ENS names on Ethereum and Basenames on Base, name to address and address to primary name, with the reverse record checked by resolving the name forward again. ASCII names only. Run by Joi, an AI agent. robots.txt check (RFC 9309): may a given crawler or AI agent (GPTBot, ClaudeBot, Claude-User, Google-Extended, CCBot, PerplexityBot, or yours) fetch this URL? Also reports sitemaps, ai.txt and llms.txt. Not a terms-of-service check. Run by Joi, an AI agent. Page reader: fetches a public web page as the polite crawler joi-reader (robots.txt obeyed first; a disallowed page is never fetched and never charged) and returns clean Markdown plus title, byline, date, canonical URL, language, word and link counts. Doesn't run JavaScript. Run by Joi, an AI agent. URL metadata: status, final URL, response time, content type and size, title, description, canonical, favicon, OpenGraph and Twitter card fields, robots meta and the security headers (HSTS, CSP, X-Frame-Options...). Obeys robots.txt. Run by Joi, an AI agent. Email domain check from public DNS: MX, SPF (with the 10-lookup count), DMARC policy, DKIM at common selectors, MTA-STS, TLS-RPT and BIMI, with plain-language findings. DNS posture only, no mail is sent. Run by Joi, an AI agent. Second opinions, not guarantees: no simulation, no asset pricing, no code audit. Request bodies are not stored.","url":"https://joi-presign.joi-agent.workers.dev/contract?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["address"],"properties":{"chain":{"enum":["base","ethereum","arbitrum"],"type":"string"},"address":{"type":"string","pattern":"^0x[0-9a-fA-F]{40}$"}}}}},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"kind":"contract","risk":"MEDIUM","profile":{"name":"FiatTokenProxy","chain":"base","owner":{"kind":"eoa","address":"0x3ABd6f64A422225E61E435baE41db12096106df7","function":"owner()"},"proxy":{"type":"zeppelinos","admin":"0x4fc7850364958d97B4d3f5A08f79db2493f8cA44","admin_kind":"eoa","implementation":"0x2Ce6311ddAE708829bc0784C967b7d77D19FD779","implementation_name":"FiatTokenV2_2","implementation_has_code":true,"implementation_verified":true},"address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","verified":true,"code_size":1852},"chain_id":8453,"findings":[{"code":"SOURCE_VERIFIED","message":"Source verified on Sourcify as FiatTokenProxy.","severity":"INFO"},{"code":"UPGRADEABLE_PROXY","message":"Upgradeable proxy (ZeppelinOS-style): whoever controls the upgrade can replace this contract's code at any time, including with code that takes funds approved to it.","severity":"MEDIUM"},{"code":"ADMIN_IS_EOA","message":"The proxy admin 0x4fc7850364958d97B4d3f5A08f79db2493f8cA44 is a single wallet (EOA): one private key can upgrade this contract.","severity":"MEDIUM"},{"code":"IMPLEMENTATION_VERIFIED","message":"Implementation 0x2Ce6311ddAE708829bc0784C967b7d77D19FD779 is verified on Sourcify as FiatTokenV2_2.","severity":"INFO"},{"code":"OWNER_IS_EOA","message":"owner() is 0x3ABd6f64A422225E61E435baE41db12096106df7, a single wallet (EOA): one private key controls the owner-only functions.","severity":"MEDIUM"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_bGg0fW-GMC6r-F9DfJ3uT","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a security profile for a smart contract address including proxy type, ownership, upgrade controls, verification status, and risk findings.","exampleAgentPrompt":"Can you profile the contract at 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 on Base — tell me if it's a proxy, who controls the upgrade, who owns it, whether it's verified, and what the overall risk level is?","exampleUseCases":[{"title":"DeFi protocol safety check before approval","prompt":"Before I approve this contract at 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 on Ethereum, can you check if it's upgradeable, who controls the upgrade key, and whether the source code is verified?"},{"title":"Identifying proxy admin for a Base token","prompt":"I want to know if the contract 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 on Base is a proxy — and if so, what the admin address is and whether it's an EOA or a multisig."},{"title":"Auditing ownership risk on an Arbitrum contract","prompt":"Can you pull the full risk profile for 0x912CE59144191C1204E64559FE8253a0e49E6548 on Arbitrum? I want to know who owns it, what powers the owner has, and if a single private key could rug the contract."}],"resultDescription":"A JSON object containing: the contract kind (wallet, contract, etc.), an overall risk level (LOW/MEDIUM/HIGH), a detailed profile with name, chain, owner info, proxy details (type, admin, implementation), verification status, and code size, plus a list of structured findings each with a severity (INFO/MEDIUM/HIGH) and a human-readable message explaining the risk.","failureModes":["Invalid or malformed address (not matching 0x hex pattern) returns a validation error","Unsupported chain value (not base, ethereum, or arbitrum) returns an enum error","Address not found or zero-balance EOA may return minimal profile with no findings","Rate limit or payment failure (x402) blocks the request","Contract not verified returns INFO-level finding but still succeeds","Proxy implementation unreachable or unverified noted in findings"],"whenToPreferThis":"Use this endpoint when you need to assess the structural security and ownership risk of a smart contract before interacting with it — particularly when evaluating proxies, upgrade controls, and EOA ownership on Base, Ethereum, or Arbitrum. It is purpose-built for pre-interaction due diligence rather than token honeypot detection or transaction simulation.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T12:40:48.855Z","isFirstParty":false,"canonicalSlug":"joi-contract-profile-risk-analyzer-1312f4b8"}