{"uid":"cap_vTBH4UtLjtTWSA19hrX63","slug":"httpay-contract-audit-scanner-acc90cb1","name":"HTTPay Contract Audit Scanner","description":"Automated smart contract security scanner — checks for reentrancy, oracle staleness, unchecked returns, proxy risks, and more. Returns risk score and actionable findings.","url":"https://httpay.xyz/api/contract-audit-scanner","method":"POST","headers":{},"bodySchema":null,"responseSchema":{"type":"json","example":{"description":"Automated smart contract security scanner — checks for reentrancy, oracle staleness, unchecked returns, proxy risks, and more. Returns risk score and actionable findings."}},"example":{"request":{"chainId":"8453","contractAddress":"0x1234567890123456789012345678901234567890"},"response":{"demo":true,"meta":{"x402":true,"poweredBy":"Alfred Zhang 🫡"},"note":"Demo mode — showing analysis of a known-vulnerable contract pattern. Pass ?address=0x...&chain=base for live analysis.","chain":"base","address":"0xVulnerableVault (Demo Contract)","isProxy":false,"summary":{"low":0,"high":2,"info":0,"medium":1,"critical":1,"totalFindings":4},"findings":[{"check":"Oracle Staleness","severity":"High","codeSnippet":"L30: (, int256 price, , , ) = priceFeed.latestRoundData();","description":"latestRoundData() called without validating updatedAt or answeredInRound. Stale oracle data can lead to incorrect pricing and financial loss.","recommendation":"Always check `require(updatedAt + heartbeatInterval >= block.timestamp)` and `require(answeredInRound >= roundId)` after calling latestRoundData()."},{"check":"Dangling Approvals","severity":"Medium","codeSnippet":"L6: function approve(address spender, uint256 amount) external returns (bool);\nL49: function approveForAll(address spender) external {\nL50: token.approve(spender, type(uint256).max); // Approve max, never revoked","description":"Unlimited token approvals (type(uint256).max) found without revocation. If the approved spender is compromised, all approved tokens are at risk.","recommendation":"Use approve-then-revoke patterns. Grant exact amounts needed. Consider using SafeERC20.forceApprove() and revoking after use with approve(spender, 0)."},{"check":"Reentrancy Risk","severity":"Critical","codeSnippet":"L38: (bool success, ) = msg.sender.call{value: amount}(\"\");\nL40: balances[msg.sender] -= amount; // State updated AFTER external call ← state update after external call","description":"External call detected before state update (violates Checks-Effects-Interactions pattern). No reentrancy guard found. Attacker could drain funds by re-entering the function.","recommendation":"Apply the CEI pattern: update all state before making external calls. Use OpenZeppelin's ReentrancyGuard (nonReentrant modifier). Consider using a mutex lock."},{"check":"Unchecked Return Values","severity":"High","codeSnippet":"L45: token.transfer(to, amount); // Return value ignored!","description":"1 transfer() call(s) with unchecked return value. Non-standard ERC-20 tokens may return false instead of reverting on failure, silently failing transfers.","recommendation":"Use OpenZeppelin's SafeERC20.safeTransfer() which checks return values and reverts on failure. Or manually check: `require(token.transfer(to, amount), 'Transfer failed')`."}],"verified":true,"riskLabel":"🔴 Critical","riskScore":80,"scannedAt":"2026-06-12T04:43:28.535Z","deployedAt":null,"auditStatus":"No Audit Found ⚠️","contractName":"VulnerableVault","sourceCodePreview":"// SPDX-License-Identifier: MIT\npragma solidity ^0.8.0;\n\ninterface IERC20 {\n    function transfer(address to, uint256 amount) external returns (bool);\n    function approve(address spender, uint256 amount) external returns (bool);\n}\n\ninterface AggregatorV3Interface {\n    function latestRoundData() external view returns (\n        uint80 roundId, int256 answer, uint256 startedAt,\n        uint256 updatedAt, uint80 answeredInRound\n    );\n}\n\ncontract VulnerableVault {\n    mapping(address => uint256) p...","topRecommendations":["Fix the reentrancy vulnerability immediately — move state updates before external calls","Add staleness check to Chainlink oracle: require(updatedAt + 1 hours >= block.timestamp)","Replace token.transfer() with SafeERC20.safeTransfer()","Replace unlimited approvals with exact amounts, revoke after use"]}},"exampleRequest":{"chainId":"8453","contractAddress":"0x1234567890123456789012345678901234567890"},"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_l1Ni2-8ByIFKR0SFHv1ni","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Automated smart contract security scanner that checks for reentrancy, oracle staleness, unchecked returns, proxy risks, and other vulnerabilities, returning a risk score and actionable findings.","exampleAgentPrompt":"Can you run a security audit on smart contract 0x1234567890abcdef1234567890abcdef12345678 on chain ID 8453 (Base) and tell me the risk score and any vulnerabilities like reentrancy or oracle issues?","exampleUseCases":null,"resultDescription":"Returns a JSON object containing an automated security assessment of the smart contract, including an overall risk score and a list of actionable findings covering reentrancy vulnerabilities, oracle staleness, unchecked return values, proxy risks, and other common smart contract security issues.","failureModes":["Invalid contract address format — returns error if address is not a valid hex address","Contract not found on specified chain — returns error if no bytecode exists at the address","Unsupported chainId — returns error if the chain is not supported by the scanner","Payment failure — returns 402 if USDC payment via x402 on Base is not completed","Timeout — complex contracts may take longer to analyze and could time out"],"whenToPreferThis":"Use this endpoint when you need a fast, automated security pre-screen of a smart contract before interacting with it, investing in a DeFi protocol, or integrating a contract into a workflow. It is ideal for agents performing due diligence on unknown contracts without requiring a full manual audit. At $0.05 per call with no API key setup, it is well suited for on-demand, per-contract checks.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T06:54:39.517Z","isFirstParty":false}