AI smart contract audit: vulnerability scan

Submit Solidity source code, get an AI-powered security audit: reentrancy, access control, oracle manipulation, and 20+ vulnerability classes with severity ratings and fix suggestions.

$1.00 USDC / call free trial: 1/day per IP contabo

Endpoint

POST https://contabo-vps.taild7e69a.ts.net/contractaudit/api/audit

Data source: Slither-style static analysis + LLM review

Parameters

Param	Type	Description
`source`	string (body JSON)	Solidity source code
`contract`	string (body JSON, optional)	Contract name to focus on

Example request

curl -X POST "https://contabo-vps.taild7e69a.ts.net/contractaudit/api/audit" \
  -H "Content-Type: application/json" \
  -d '{ "source": "contract Token { ... }" }'

Example response

{
  "findings": [
    {"severity": "high", "type": "reentrancy", "line": 42, "fix": "..."}
  ],
  "score": 72
}

How payment works (x402)

Call the endpoint without any payment header → you get 402 Payment Required with the exact price, the USDC contract, the network (eip155:8453 = Base), and the pay-to address.
Pay 1.00 USDC on Base to the pay-to address — with any wallet, the Coinbase CDP x402 SDK, or any x402 client library.
Retry the same request with the X-PAYMENT header set to the base64-encoded signed payment payload → 200 with JSON.

# 1. Get the 402 payment requirements
curl -s -X POST "https://contabo-vps.taild7e69a.ts.net/contractaudit/api/audit" -H "Content-Type: application/json" -d '{ "source": "contract Token { ... }" }'

# 2. Pay 1.00 USDC on Base, then retry with the payment proof
curl -X POST "https://contabo-vps.taild7e69a.ts.net/contractaudit/api/audit" \
  -H "Content-Type: application/json" \
  -H "X-PAYMENT: <base64-signed-payment-payload>" \
  -d '{ "source": "contract Token { ... }" }'

Facilitators: Coinbase CDP and PayAI (no API key needed for either). Scheme: x402 v2 exact. Asset: USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 on Base.

Free trial

Every IP gets 1/day free calls to this endpoint — no payment needed. Free calls run automatically when you call without an X-PAYMENT header. The X-Free-Remaining response header shows how many free calls you have left today. When the quota is exhausted, the request falls through to the normal 402 payment flow.

FAQ

Which vulnerability classes?
Reentrancy, access control, integer issues, oracle manipulation, front-running, and 15+ more.

How long does it take?
30-90 seconds for typical contracts.

Is this a substitute for a human audit?
No. A fast pre-screen before engaging professional auditors.

Do I need an API key?
No. This API uses x402: call the endpoint, receive a 402 Payment Required with the price, pay in USDC on Base, and retry with the X-PAYMENT header. No signup, no API key, no account.

Which facilitators are supported?
Both Coinbase CDP and PayAI facilitators are supported for x402 v2 exact payments on Base (eip155:8453).

What if my payment is too low?
The facilitator verifies the on-chain amount against the price. If underpaid, you get 402 again; pay the full amount and retry.

All 37 x402 API docs · Postman collection (download) · About this API