{"uid":"cap_jtQ_YksCXDVANGQoQvyaX","slug":"web3-auth-scan-3180bb2d","name":"web3-auth-scan","description":"Static heuristics for 7 verified web3 auth/payment vulnerability patterns (W3A-001..007). $0.01 USDC on Base per scan via x402.","url":"https://web3-auth-scan.andrenorton.workers.dev/scan","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"code":{"type":"string","description":"raw source code to scan"},"repo":{"type":"string","description":"GitHub repo owner/name to scan"},"filename":{"type":"string","description":"filename for the code snippet"}}},"responseSchema":{"type":"json","example":{"candidates":[{"file":"a.ts","line":12,"rule":"W3A-001","evidence":"nonce in message"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_AKmYKUkdeRgskd9nb1JtN","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans source code or GitHub repos for 7 known web3 authentication and payment vulnerability patterns using static heuristics","exampleAgentPrompt":"Can you scan this TypeScript code snippet from my dApp for web3 auth and payment vulnerabilities — check it against those W3A-001 through W3A-007 rules and tell me which lines have issues?","exampleUseCases":[{"title":"Pre-deployment dApp security audit","prompt":"Before I deploy my new wallet connector, can you scan the andrenorton/wallet-connector GitHub repo for any of those W3A web3 auth vulnerability patterns and show me which files and lines are at risk?"},{"title":"Code review for signature replay attacks","prompt":"I just wrote this Ethereum sign-in code — here's the raw TypeScript — can you run it through web3-auth-scan and flag any lines where I might have nonce or signature replay vulnerabilities?"},{"title":"CI pipeline vulnerability check on paste","prompt":"I've got this chunk of Solidity from our payment contract, filename PaymentRouter.sol — can you check it for all seven W3A vulnerability rules and list every finding with the rule ID and evidence?"}],"resultDescription":"A JSON object with a 'candidates' array, where each entry contains the file name, line number, rule ID (e.g. W3A-001 through W3A-007), and an evidence string quoting the suspicious code that triggered the heuristic.","failureModes":["Missing both 'code' and 'repo' input returns an error or empty candidates array","Invalid GitHub repo owner/name format causes repo fetch failure","Very large code submissions may hit Cloudflare Worker request size limits","Payment failure (insufficient USDC on Base) blocks scan execution","False negatives possible since only 7 static heuristic rules are checked — not a full audit","Non-web3 code may return empty candidates with no signal"],"whenToPreferThis":"Choose this endpoint when you need fast, cheap ($0.01) static analysis specifically targeting the 7 known web3 authentication and payment vulnerability patterns (W3A-001..007). It is ideal for pre-deployment spot-checks, CI pipeline integration, or reviewing untrusted third-party web3 code. Prefer it over generic SAST tools when web3-specific auth patterns (nonce reuse, signature replay, etc.) are the concern and you want deterministic rule-based results rather than AI-generated suggestions.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:30:38.922Z","isFirstParty":false}