Before you buy a token, see who controls it.

Free checks before you buy a token: who controls it, can they mint, blacklist you or raise the sell tax, and is there real liquidity? No sign-up, no wallet.

Free No sign-up, no wallet About 2 seconds

Token risk check

Static checks, no buy or sell simulation

Medium risk Degen (DEGEN) on Base

Example result, checked 2026-10-20

DEGEN: MEDIUM risk. Mint function present; Pause function present. Score 24; control MEDIUM, market LOW.

$109,270DEX liquidity, 1 pair

$17,645volume in 24 h

140 / 337buys and sells in 24 h

1017days since the oldest pair

Address: 0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed
Owner: Safe multisig 2-of-3 0x704Ec5C12Ca20a293C2C0B72B22619A4231f3c0d
Proxy: Not a proxy
Source: Verified on Sourcify (exact_match)

Flags

Severity	Area	Issue
medium	control	Mint function present (mint(address,uint96)): supply can be increased by a live owner/role.
medium	control	Pause function present: transfers can be halted.

Admin functions found in the bytecode

Power	Functions
pause	`pause()`, `unpause()`
mint	`mint(address,uint96)`

Explorer DexScreener

Raw JSON

{
  "ok": true,
  "chain": "Base",
  "chainId": 8453,
  "address": "0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed",
  "token": {
    "name": "Degen",
    "symbol": "DEGEN",
    "decimals": 18,
    "totalSupply": "35982346126980147316154643430"
  },
  "verdict": {
    "risk": "MEDIUM",
    "score": 24,
    "controlRisk": "MEDIUM",
    "marketRisk": "LOW",
    "summary": "DEGEN: MEDIUM risk. Mint function present; Pause function present."
  },
  "flags": [
    {
      "severity": "medium",
      "area": "control",
      "issue": "Mint function present (mint(address,uint96)): supply can be increased by a live owner/role."
    },
    {
      "severity": "medium",
      "area": "control",
      "issue": "Pause function present: transfers can be halted."
    }
  ],
  "control": {
    "owner": {
      "address": "0x704Ec5C12Ca20a293C2C0B72B22619A4231f3c0d",
      "kind": "Safe multisig 2-of-3"
    },
    "proxyAdmin": null,
    "proxy": null,
    "roles": null,
    "bridged": null,
    "minter": null
  },
  "adminPowers": {
    "pause": [
      "pause()",
      "unpause()"
    ],
    "mint": [
      "mint(address,uint96)"
    ]
  },
  "sourceVerified": {
    "sourcify": "exact_match"
  },
  "market": {
    "priceUsd": 0.0009451,
    "fdvUsd": 34007211,
    "marketCapUsd": 34007211,
    "liquidityUsdTopPair": 109270.31,
    "liquidityUsdAllPairs": 109270,
    "volume24hUsd": 17645.34,
    "priceChange24hPct": -3.73,
    "buys24h": 140,
    "sells24h": 337,
    "pairCount": 1,
    "topPair": {
      "dex": "uniswap",
      "address": "0xc9034c3E7F58003E6ae0C8438e7c8f4598d5ACAA",
      "url": "https://dexscreener.com/base/0xc9034c3e7f58003e6ae0c8438e7c8f4598d5acaa"
    },
    "oldestPairAgeDays": 1017
  },
  "links": {
    "explorer": "https://basescan.org/token/0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed",
    "dexscreener": "https://dexscreener.com/base/0xc9034c3e7f58003e6ae0c8438e7c8f4598d5acaa"
  },
  "method": "On-chain reads (EIP-1967/1167/beacon slots, owner, Safe/timelock detection), 4-byte selector scan of the runtime bytecode against known admin functions, Sourcify, DexScreener. Static checks only: no buy/sell simulation, so a clean result does not rule out a honeypot. Not financial advice.",
  "generatedAt": "2026-10-20T08:20:31.492Z"
}

Deep contract scan

Slither, 5 to 60 seconds

Scan a verified contract

Free, up to 10 scans a day

What it checks

Who holds the keys now

The current owner() and proxy admin, and whether each is renounced, a single-key EOA, or a Safe multisig (with its threshold).

Admin powers

Every state-changing function gated by owner, role or admin modifiers or msg.sender checks: mint, pause, blacklist, setFee, upgradeTo.

Upgradeability

Proxy type and current implementation, from Sourcify.

Static analysis

About 90 Slither detectors (reentrancy, arbitrary ETH sends, unchecked transfers, uninitialized storage, dangerous delegatecall, shadowing), ranked by impact.

Automated static analysis, not a manual audit. Expect false positives and treat findings as leads to review. Not financial advice.

More free tools

x402 payability check

For x402 sellers: can buyers actually pay your endpoint? A free checker, a 30-day monitor and a whole-origin audit.

Who holds the keys to Base's top tokens

The token check run over the 250 largest Base tokens: who can upgrade, mint, pause or blacklist each one.

Key-change alerts

Not built yet

Most of the risk in a token is a key someone can turn later. Alerts would email you when a token you hold upgrades its implementation, changes owner or proxy admin (for example from a Safe to a single key), lowers its Safe threshold or blacklists an address.

This is not built. If you want it, leave your email and we will write to you once if it ships.

For AI agents: x402 API, priced per call

HTTP 402 USDC on Base or Arbitrum

People use the checks above for free. The same checks are an HTTP API for AI agents, paid per call in USDC on Base or Arbitrum over x402. No API key, no signup. Bad input and unverified contracts are rejected before payment.

Endpoint	What it returns	Price
GET/token?chainId=8453&address=0x...	Token risk verdict	$0.005USDC
GET/scan?chainId=8453&address=0x...	Full contract scan	$0.01USDC
GET/address	Classify an EVM address: EOA, 7702, Safe, timelock, token, proxy	$0.002USDC
GET/gas	Live EIP-1559 gas tiers and cost estimates	$0.001USDC
GET/payability	Can a real buyer pay this x402 endpoint? Unfunded-signature probe	$0.01USDC
GET/audit	Audit every paid GET route of an x402 origin with an unfunded test payment	$0.25USDC
GET/monitor	30-day hourly payability monitor with email alerts	$0.99USDC
POST/mcp	Free remote MCP server for agents, tool `check_token`, 50 a day	Free

The first request answers 402

$ curl -i "https://contractlens-api.appin60.com/token?chainId=8453&address=0x4ed4e862860bed51a9570b96d89af5e1b0efefed"

What comes back

HTTP/2 402
payment-required: eyJ4NDAyVmVyc2lvbiI6Miwi…

# Your x402 client signs, retries with PAYMENT-SIGNATURE,
# and gets the JSON verdict plus PAYMENT-RESPONSE.

Docs

Payment

Protocol: x402 v2, scheme exact
Networks: Base eip155:8453, Arbitrum One eip155:42161
Asset: USDC
MCP: https://contractlens-api.appin60.com/mcp

Questions

Something else? Email us.

Is this an audit?

No. It is automated static analysis: it reads what the contract allows and who can do it. Expect false positives and treat findings as leads to review.

Is it really free?

Yes, for people. The page allows up to 30 token checks and 10 contract scans a day from one address, so scripts use the agent API instead.

Which chains does it cover?

Base, Ethereum, Arbitrum, Optimism, Polygon and BNB Chain. Ask for another at contractlens@appin60.com.

Does a low risk rating mean the token is safe?

No. The checks are static: there is no buy or sell simulation, so a clean result does not rule out a honeypot.