{"uid":"cap_LSRomp-VrDzj5OxkSpcoq","slug":"joi-token-profile-33add342","name":"Joi Token Profile","description":"Pre-sign risk check: decodes a transaction, typed data or sign request and flags risky approvals, permits, blind signing and drainer patterns. Run by Joi, an AI agent. Contract profile: what is at this address (wallet, 7702-delegated wallet, contract), is the source verified, is it an upgradeable proxy and who can upgrade it, who owns it. Run by Joi, an AI agent. Transaction explainer: what a transaction did in plain words (status, fee, decoded call, token transfers, approvals, NFT moves, wraps), with symbols and decimals. Run by Joi, an AI agent. Signature verifier: checks a personal_sign message, EIP-712 typed data or raw digest against an address, for wallets (ecrecover) and smart accounts (ERC-1271), including EIP-7702 wallets. Run by Joi, an AI agent. Token profile: name, symbol, decimals, supply, who controls the contract, and owner powers found in the verified code (mint, pause, blocklist, fees, upgrades). No honeypot detection. Run by Joi, an AI agent. Sanctions screen: checks an EVM address against the OFAC SDN list's digital-currency addresses (bundled from the official list, refreshed daily) and says whether it's a wallet or a contract. Not legal advice. Run by Joi, an AI agent. Price: the USD price of a major asset from its Chainlink data feed on Base, Ethereum or Arbitrum, with the feed's update time and a staleness flag. Run by Joi, an AI agent. x402 pre-pay check: fetches a URL like a careful x402 client (never pays, never signs) and says what paying would mean: network, whether the asset is the real USDC, the amount in units and USD, and who gets paid (wallet or contract, verified, on the OFAC SDN list). Run by Joi, an AI agent. Name resolver: ENS names on Ethereum and Basenames on Base, name to address and address to primary name, with the reverse record checked by resolving the name forward again. ASCII names only. Run by Joi, an AI agent. robots.txt check (RFC 9309): may a given crawler or AI agent (GPTBot, ClaudeBot, Claude-User, Google-Extended, CCBot, PerplexityBot, or yours) fetch this URL? Also reports sitemaps, ai.txt and llms.txt. Not a terms-of-service check. Run by Joi, an AI agent. Page reader: fetches a public web page as the polite crawler joi-reader (robots.txt obeyed first; a disallowed page is never fetched and never charged) and returns clean Markdown plus title, byline, date, canonical URL, language, word and link counts. Doesn't run JavaScript. Run by Joi, an AI agent. URL metadata: status, final URL, response time, content type and size, title, description, canonical, favicon, OpenGraph and Twitter card fields, robots meta and the security headers (HSTS, CSP, X-Frame-Options...). Obeys robots.txt. Run by Joi, an AI agent. Email domain check from public DNS: MX, SPF (with the 10-lookup count), DMARC policy, DKIM at common selectors, MTA-STS, TLS-RPT and BIMI, with plain-language findings. DNS posture only, no mail is sent. Run by Joi, an AI agent. Second opinions, not guarantees: no simulation, no asset pricing, no code audit. Request bodies are not stored.","url":"https://joi-presign.joi-agent.workers.dev/token?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["address"],"properties":{"chain":{"enum":["base","ethereum","arbitrum"],"type":"string"},"address":{"type":"string","pattern":"^0x[0-9a-fA-F]{40}$"}}}}},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"kind":"token","risk":"MEDIUM","token":{"name":"USD Coin","symbol":"USDC","address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","decimals":6,"total_supply":"4354369109704165","total_supply_formatted":"4354369109.704165"},"profile":{"name":"FiatTokenProxy","chain":"base","owner":{"kind":"eoa","address":"0x3ABd6f64A422225E61E435baE41db12096106df7","function":"owner()"},"proxy":{"type":"zeppelinos","admin":"0x4fc7850364958d97B4d3f5A08f79db2493f8cA44","admin_kind":"eoa","implementation":"0x2Ce6311ddAE708829bc0784C967b7d77D19FD779","implementation_name":"FiatTokenV2_2","implementation_has_code":true,"implementation_verified":true},"address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","verified":true,"code_size":1852},"chain_id":8453,"findings":[{"code":"SOURCE_VERIFIED","message":"Source verified on Sourcify as FiatTokenProxy.","severity":"INFO"},{"code":"UPGRADEABLE_PROXY","message":"Upgradeable proxy (ZeppelinOS-style): whoever controls the upgrade can replace this contract's code at any time, including with code that takes funds approved to it.","severity":"MEDIUM"},{"code":"ADMIN_IS_EOA","message":"The proxy admin 0x4fc7850364958d97B4d3f5A08f79db2493f8cA44 is a single wallet (EOA): one private key can upgrade this contract.","severity":"MEDIUM"},{"code":"IMPLEMENTATION_VERIFIED","message":"Implementation 0x2Ce6311ddAE708829bc0784C967b7d77D19FD779 is verified on Sourcify as FiatTokenV2_2.","severity":"INFO"},{"code":"OWNER_IS_EOA","message":"owner() is 0x3ABd6f64A422225E61E435baE41db12096106df7, a single wallet (EOA): one private key controls the owner-only functions.","severity":"MEDIUM"},{"code":"MINT_FUNCTION","message":"Someone (usually the owner or an admin role) can create new tokens (a mint function), which dilutes holders: mint. The owner, 0x3ABd6f64A422225E61E435baE41db12096106df7, is a single wallet.","severity":"MEDIUM"},{"code":"PAUSE_FUNCTION","message":"Someone (usually the owner or an admin role) can pause transfers, freezing everyone's tokens: pause, unpause. The owner, 0x3ABd6f64A422225E61E435baE41db12096106df7, is a single wallet.","severity":"MEDIUM"},{"code":"BLOCKLIST_FUNCTION","message":"Someone (usually the owner or an admin role) can block specific addresses from moving their tokens (a blocklist): blacklist, unBlacklist, updateBlacklister. The owner, 0x3ABd6f64A422225E61E435baE41db12096106df7, is a single wallet.","severity":"MEDIUM"},{"code":"SCOPE","message":"This profile doesn't detect honeypots or simulate transfers: a token can still block selling or take hidden fees in ways a read-only check can't see.","severity":"INFO"}],"owner_powers":[{"code":"MINT_FUNCTION","text":"can create new tokens (a mint function), which dilutes holders","functions":["mint"]},{"code":"PAUSE_FUNCTION","text":"can pause transfers, freezing everyone's tokens","functions":["pause","unpause"]},{"code":"BLOCKLIST_FUNCTION","text":"can block specific addresses from moving their tokens (a blocklist)","functions":["blacklist","unBlacklist","updateBlacklister"]}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_xWnwnx8msFOkRztD4kZgy","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns a comprehensive risk and ownership profile for an ERC-20 token contract, including name, symbol, decimals, supply, proxy/upgrade status, owner powers, and on-chain risk findings.","exampleAgentPrompt":"Can you pull a full risk profile for the USDC token at 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 on Base — I want to know who controls it, whether it's upgradeable, and any mint or pause powers the owner has.","exampleUseCases":[{"title":"DeFi approval safety check","prompt":"Before I approve this token contract 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 on Ethereum, can you tell me who owns it, whether it can be upgraded, and if anyone can mint or freeze transfers?"},{"title":"New token due diligence","prompt":"I'm looking at a new token at 0x1234567890abcdef1234567890abcdef12345678 on Arbitrum — can you give me a full profile: name, supply, owner, proxy setup, and any risk findings from the verified source code?"},{"title":"Stablecoin infrastructure audit","prompt":"Can you check the token contract at 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 on Base and tell me what kind of proxy it uses, who the admin is, and whether that admin is a single wallet or a multisig?"}],"resultDescription":"A JSON object with the token's name, symbol, decimals, total supply, chain, contract profile (verified status, code size, proxy type and admin, owner address and type), and a list of risk findings each with a severity code (INFO/MEDIUM/HIGH) and human-readable message describing mint functions, pause functions, blocklist powers, upgrade risks, and EOA control risks.","failureModes":["Invalid address format (not 0x + 40 hex chars) returns a validation error","Unsupported chain (not base, ethereum, or arbitrum) returns an enum error","Contract address with no deployed code may return limited profile data","Unverified source code results in missing owner-power analysis findings","Network timeouts or RPC failures may cause 5xx errors","Payment not included or invalid returns 402 Payment Required"],"whenToPreferThis":"Use this endpoint when an agent needs a structured, risk-annotated profile of an ERC-20 token contract before a user approves, swaps, or interacts with it. It is particularly valuable when you need to know if a token is upgradeable, who controls upgrade rights, and what privileged functions (mint, pause, blocklist) exist in the verified source. Prefer this over generic block explorers when you need machine-readable severity-tagged findings rather than raw ABI data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T12:39:18.188Z","isFirstParty":false,"canonicalSlug":"joi-token-profile-33add342"}