token-risk-oracle v0.1.0

EVM Contract
Risk Oracle

Risk intelligence for AI agents. Structured, explainable security reports for any EVM token or smart contract — paid per call via x402. No API keys, no subscriptions, no accounts.

Integrate Discovery manifest $0.10 / call · USDC on Base (or Solana)

What it detects

Proxy & implementation — resolves upgrade patterns and introspects the real logic contract, not the plumbing.
Honeypots by effect — sell-restriction and gating judged by what the code does, not by function names.
LP burn / lock verification — confirms on-chain whether liquidity can be pulled.
Burned-LP honeypot traps — burned LP used as bait while value is drained through the contract.
Uniswap V4 hook analysis — decodes hook permissions from the address; liquidity-weighted venue risk.
Deployer / owner concentration — known-address supply share and control shape.
Transfer-path gating — privileged setters that change whether transfers succeed.
Tax / drain patterns — tax-to-owner skims and withdrawal backdoors, independent of LP.

Four-band scoring

low

Minimal/renounced control, no dangerous capabilities, transparent.

medium

Legitimate centralized control: disclosed admin powers under an active owner.

high

Concentrated or opaque control — not proven malicious.

extreme

Evidence of a holder-harm mechanism. A dispositive critical flag forces this band.

Real output — same engine, opposite verdicts

A scam token vs. a clean one

WOKE — "Woke Mind Virus"extreme
{
  "address": "0x893643F9E232E4e857f278D61641C955589a7A37",
  "chainId": 1,
  "contractName": "woke",            // "Woke Mind Virus" (WOKE)
  "score": {
    "band": "extreme",
    "value": 47,
    "dispositive": ["tax_drain_pattern", "burned_lp_honeypot"]
  },
  "flags": [
    { "id": "burned_lp_honeypot",    "severity": "critical",
      "msg": "LP is burned (liquidity cannot be removed) but the
              contract retains extraction via tax skim / withdrawal
              backdoor / transfer gating — burned LP as bait." },
    { "id": "tax_drain_pattern",     "severity": "critical",
      "msg": "Sell-tax auto-swapped to ETH -> _taxWallet + withdrawal
              backdoor manualTokenSend(). Drains value regardless of LP." },
    { "id": "tax_skim_to_owner",     "severity": "high", ... },
    { "id": "transfer_gating_control","severity": "high",
      "msg": "removeLimit()/openTrading() set state read in the
              transfer path — by effect, not by name." }
  ]
}
WETH — Wrapped Etherlow
{
  "address": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
  "chainId": 1,
  "contractName": "WETH9",           // "Wrapped Ether" (WETH)
  "score": { "band": "low", "value": 0, "dispositive": [] },
  "flags": [
    { "id": "verified",        "severity": "info" },
    { "id": "risky_withdraw",  "severity": "info" },
    { "id": "v4_hook_capable", "severity": "info",
      "msg": "V4 pools use 1 verified, non-upgradeable hook; it
              advertises capability bits but no red flags found.
              Capability alone is not a finding." }
  ]
}

WOKE's LP is 100% burned — most scanners read that as safe. The oracle scores it extreme: burned LP is bait while value drains through a tax skim and a manualTokenSend() backdoor. WETH carries a V4 hook that could skim swaps, but it is verified and non-upgradeable with no red flags — capability alone is not a finding, so it stays low.

Integration

One paid call, no account

Request

Endpoint
POST https://oracle.futureus.win/api/assess-token-risk
Price
$0.10 per call · USDC on Base (also accepts Solana USDC via Dexter)
Input
{ "address": "0x...", "chainId": 8453 }
Output
Structured JSON: score (band + dispositive flags), flags[], proxy, onchain, v4Hooks, sources. Full schema in the discovery manifest.

x402 flow

  1. Agent sends an unpaid POST to the endpoint.
  2. Server replies HTTP 402 with payment requirements.
  3. Agent signs & pays (USDC), retries with the signature.
  4. Facilitator settles on-chain; server returns the full report.

The 402 challenge

curl -i -X POST https://oracle.futureus.win/api/assess-token-risk \
  -H 'Content-Type: application/json' \
  -d '{"address":"0x...","chainId":8453}'

HTTP/1.1 402 Payment Required
payment-required: { scheme: "exact", network: "eip155:8453", price: "$0.10" ... }
# agent signs payment, retries with payment-signature -> HTTP 200 + report

Free verification check

A no-cost endpoint, POST /api/token-sourcecode-verified, reports explorer source-verification status for any address — no payment, no key.

Discoverable by agents

Indexed on the CDP Bazaar and Dexter / x402 discovery — agents can find and pay for it autonomously, no human in the loop.

Links

/.well-known/x402.json — machine-readable discovery /healthz — service status /api/x402-usage — usage