Token Risk (Base)

Heuristic risk checks for an ERC-20 token on Base mainnet before an agent buys or sells it: honeypot and transfer-tax simulation against the deepest pool, plus contract, metadata, proxy, owner and privileged-function checks. Read-only: every check is a JSON-RPC read against a free public Base endpoint (mainnet.base.org, then base-rpc.publicnode.com, then base.drpc.org). Nothing is signed or broadcast, and no paid data provider is called.

Informational only, not financial advice. The checks run at one block and can miss risks or flag legitimate tokens.

Call

POST /api/skills/token-risk

{"token": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "chain": "base"}

token (required): the token contract address (0x + 40 hex). chain (optional): only "base" for now.

Checks

Each check is {"result": "pass" | "warn" | "fail" | "unknown", "evidence": {...}}. A check that could not run is unknown with a reason; it is never reported as a pass.

A Uniswap quoter is not used for tax: it quotes the pool's math, not what a fee-on-transfer token actually delivers, so the token transfer is measured directly. AMM fees are not included.

risk_level: any fail → high; else any warn → medium; else any unknown → unknown; else low. One exception: an unreadable owner on a token with no privileged selectors (for example WETH) does not block low. reasons lists what drove the level.

Errors (not charged)

• 422 invalid_params: missing or malformed token, chain other than "base".
• 400 invalid_token: zero or dead address.
• 502 upstream_error: no public Base RPC answered.

Response (paid 200, USDC)

USDC is medium because it is an upgradeable proxy with an active owner and mint, blacklist and pause functions. Those are real controls, even though the token is a regulated stablecoin.

{
  "skill": "token_risk",
  "ok": true,
  "token": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
  "chain": "base",
  "chain_id": 8453,
  "block": 52494540,
  "symbol": "USDC",
  "risk_level": "medium",
  "reasons": [
    "proxy: warn",
    "ownership: warn",
    "privileged_functions: warn"
  ],
  "checks": {
    "contract_code": {
      "result": "pass",
      "evidence": {
        "bytecode_bytes": 1852,
        "block": 52494540
      }
    },
    "erc20_metadata": {
      "result": "pass",
      "evidence": {
        "name": "USD Coin",
        "symbol": "USDC",
        "decimals": 6,
        "total_supply": "4419304031200909",
        "missing": []
      }
    },
    "proxy": {
      "result": "warn",
      "evidence": {
        "standard": "zeppelinos (legacy unstructured storage)",
        "implementation": "0x2ce6311ddae708829bc0784c967b7d77d19fd779",
        "admin": "0x4fc7850364958d97b4d3f5a08f79db2493f8ca44",
        "note": "upgradeable: whoever controls the proxy can replace the token's code"
      }
    },
    "ownership": {
      "result": "warn",
      "evidence": {
        "function": "owner()",
        "owner": "0x3abd6f64a422225e61e435bae41db12096106df7",
        "renounced": false
      }
    },
    "privileged_functions": {
      "result": "warn",
      "evidence": {
        "found": {
          "mint": [
            "configureMinter(address,uint256)",
            "mint(address,uint256)"
          ],
          "blacklist": [
            "blacklist(address)",
            "isBlacklisted(address)"
          ],
          "pause": [
            "pause()",
            "unpause()"
          ]
        },
        "scanned": [
          "token",
          "implementation"
        ],
        "note": "selector presence only; who may call them is not checked"
      }
    },
    "liquidity_pool": {
      "result": "pass",
      "evidence": {
        "dex": "uniswap_v3",
        "variant": "fee 3000",
        "pool": "0x6c561b446416e1a00e8e93e221854d6ea4171372",
        "quote_token": "WETH",
        "token_balance": "76072526114911",
        "quote_balance": "29060996929756341666149",
        "thin_liquidity": false,
        "pools_found": 7
      }
    },
    "sell_simulation": {
      "result": "pass",
      "evidence": {
        "pool": "0x6c561b446416e1a00e8e93e221854d6ea4171372",
        "amount": "76072526114",
        "balance_slot": "solidity:9",
        "method": "eth_simulateV1 transfer leg",
        "received": "76072526114"
      }
    },
    "buy_simulation": {
      "result": "pass",
      "evidence": {
        "pool": "0x6c561b446416e1a00e8e93e221854d6ea4171372",
        "amount": "76072526114",
        "balance_slot": "solidity:9",
        "method": "eth_simulateV1 transfer leg",
        "received": "76072526114"
      }
    },
    "transfer_tax": {
      "result": "pass",
      "evidence": {
        "sell_tax_pct": 0.0,
        "buy_tax_pct": 0.0,
        "note": "token-side transfer tax only; AMM/pool fees are not included"
      }
    }
  },
  "rpc": "mainnet.base.org",
  "disclaimer": "Informational only, not financial advice. These are automated heuristics from public on-chain reads and simulations at a single block. They can miss risks (owner actions after this block, time-, amount- or wallet-specific traps, off-chain controls, other pools) and can flag legitimate tokens (for example regulated stablecoins with blacklist and pause functions). Do your own research."
}

Unpaid → HTTP 402 (x402 USDC on Base). Retry with PAYMENT-SIGNATURE. Free preflight: send X-X402-Validate-Only: 1 (422 on bad params, else 402).

Price: $0.005 per call.