ContractLens

Before you buy a token: who controls it, can they mint, blacklist you or raise the sell tax, and is there real liquidity?

Token risk check (2 seconds)

Owner type (renounced, single key, Safe, timelock), upgradeable proxy, admin functions found in the bytecode, source verification, DEX liquidity and pair age. Static checks only: no buy/sell simulation.

x402 sellers: can buyers actually pay your endpoint? (free checker) · See it run over the 250 largest Base tokens: Who holds the keys to Base's top tokens.

Deep contract scan (Slither, 5-60 s)

Works for any contract with verified source on Sourcify. Proxies are followed to the implementation. A scan takes 5 to 60 seconds.

Key-change alerts (waitlist)

Most of the risk in a token is a key someone can turn later. Alerts would email you within minutes when a token you hold upgrades its implementation, changes owner or proxy admin (for example from a Safe to a single key), lowers its Safe threshold or blacklists an address.

Planned price: $9/month in USDC on Base or Arbitrum, up to 25 tokens. Nothing is charged now. Join the waitlist and you get an email when it opens.

For token teams: a public report your holders can check

Holders, listing sites and scanners ask the same thing: who can mint, pause or upgrade this token? A ContractLens report answers it in public. It covers who holds the keys (EOA, Safe, renounced), every admin function with what it can do, the static-analysis findings triaged by a reviewer (false positives called out), and concrete hardening steps. You get a permanent link to share.

$49, paid in USDC or USDT on Arbitrum or Base, after delivery. Turnaround is under 24 hours. Email contractlens@appin60.com with the chain and contract address. Example: DEGEN on Base.

For AI agents: one paid HTTP call

Token risk verdict: $0.005 USDC per call. GET {API}/token?chainId=8453&address=0x... returns LOW/MEDIUM/HIGH with every reason as JSON. Free for MCP clients (50/day): add {API}/mcp as a remote MCP server and call check_token.

The full deep-scan report (every finding with file and line, every privileged function) is an x402 endpoint: $0.01 USDC per call on Base or Arbitrum. No API key, no signup. Your agent pays and gets JSON back.

GET {API}/scan?chainId=8453&address=0x...

With AgentCash: npx agentcash fetch "{API}/scan?chainId=8453&address=0x...". Or any x402 client (@x402/fetch, x402-axios, Python x402). OpenAPI spec: /openapi.json. Free sample: /sample.

Bad input and unverified contracts are rejected before payment. A failed scan is never settled.

What it checks

Who holds the keys now: current owner() and proxy admin, and whether each is renounced, a single-key EOA, or a Safe multisig (with its threshold).
Admin powers: every state-changing function gated by owner/role/admin modifiers or msg.sender checks (mint, pause, blacklist, setFee, upgradeTo...).
Upgradeability: proxy type and current implementation (from Sourcify).
Static analysis: about 90 Slither detectors (reentrancy, arbitrary ETH sends, unchecked transfers, uninitialized storage, dangerous delegatecall, shadowing...), ranked by impact.

Automated static analysis, not a manual audit. Expect false positives and treat findings as leads to review. Contact: contractlens@appin60.com