com.tr

Pass a token contract address and get a risk score + flags (ERC-20 conformance, ownership renounce, upgradeable proxy) computed live from Base. Built for trading bots and agents that vet tokens before buying.

The single call an agent makes before touching a Base token: token risk + sellability (honeypot/tax) + route/price-impact + deployer reputation, collapsed into one GO/HOLD/STOP verdict with an auditable receipt. Cheaper than the four checks à la carte. This is the tool to bind first.

The check before the riskiest moment — signing. Decodes raw unsigned calldata (approve / permit / transfer / setApprovalForAll), shows the exact intent (who gets power over what, and whether it's UNLIMITED), and screens the destination + spender for OFAC sanctions and dangerous owner powers, in one

🆕 Base Account spend permissions let an app or agent spend a scoped, recurring allowance from a wallet — the primitive behind autonomous agent payments on Base. This reconstructs a wallet's ACTIVE spend permissions from onchain approve/revoke events and flags the dangerous ones: unlimited allowance,

🆕 The complete fund-movement authority on a Base wallet in one call: ERC-20 approvals (a spender you approved can pull the token) PLUS Base Account spend permissions (the agent-era scoped recurring allowance) — one drain-surface verdict with the ERC-20 revoke queue to act on. Approval tools miss the

🆕 Since Pectra an EOA can carry EIP-7702 delegated code (the 0xef0100 designator): every call to the wallet executes the DELEGATE's contract with the wallet's funds — a malicious delegate is total takeover, invisible to approval tools. Reads the designator, resolves the delegate and verdicts it: not

🆕 First tooling for Base's Commerce Payments protocol (AuthCaptureEscrow): reconciles two-phase auth/capture payments — in escrow, captured, charged, voided, refunded, or payer-RECLAIMABLE because the operator missed the capture window. Filter by payment= (infoHash), payer=, receiver= or operator=,

🆕 Commerce Payments flows are DRIVEN by an operator — it authorizes escrow, captures for merchants and takes the fees. This audits one before you rely on it: 90-day volumes, fees taken, capture-vs-reclaim record (missed capture windows = merchants left unpaid), distinct payers and merchants. verdict

🆕 First lending tooling in the catalog. Reads a Morpho Blue position on Base (the largest lending venue on Base) and returns its liquidation health in one call: health factor, current vs liquidation LTV, and the exact collateral price drop that triggers liquidation. Built for borrowing agents and tr

🆕 A MetaMorpho vault spreads your deposit across Morpho Blue markets — your real risk is WHERE the curator put it and WHO can move it. Reads the vault's live allocation (concentration, per-market collateral + liquidation LTV), idle share, performance fee, timelock, and control (curator/owner/guardia

🆕 Built for liquidator / MEV searchers. Reconstructs the active borrower set on a Morpho Blue market from Borrow events, prices every position onchain in one multicall, and ranks them by liquidation health — flagging positions liquidatable NOW (health <= 1.0) and those one small move away, with the

🆕 A smart account's gas can be paid by a PAYMASTER instead of the account itself — invisible to every 'does this wallet spend ETH' heuristic. Reads a wallet's UserOperationEvents across BOTH EntryPoints (v0.6 + v0.7): is it a smart account, its op count and success rate, and WHO sponsors its gas (se

🆕 Given a paymaster address, audits whether it's a healthy, active gas sponsor. Reads its UserOperationEvents across both EntryPoints: sponsored op volume, distinct accounts served, success rate, total gas sponsored, and concentration (the share coming from its single busiest app). The read to run b

🆕 Multisig / treasury intelligence. Given an address: is it a Gnosis Safe, its owners and M-of-N threshold, version, activity, and — critically — its enabled MODULES. A module can move the Safe's funds via execTransactionFromModule with no owner signatures, so each one is an address with unilateral

🆕 Funding provenance in one call. Traces a Base wallet back to its EARLIEST transaction and resolves who first funded it: a recognized exchange/bridge (real on-ramp, lower risk), an anon EOA (possible sybil/burner — trace the cluster), or a contract. Returns the first funder, whether it's a contract

🆕 Cross-chain inflow detection. Reads a wallet's recent USDC MINTS and correlates them with Circle CCTP receives to tell you whether its USDC is freshly bridged in (and from which source chain — Ethereum, Arbitrum, OP, Polygon, Solana…) vs natively issued. Freshly bridged capital is new money / a po

🆕 Before your agent sends, approves or signs to an address: one GO/REVIEW/STOP verdict. Screens OFAC sanctions, Coinbase/Basename identity, wallet vs contract, how long the address has existed, and whether contract logic can be swapped AFTER you send. Every factor returns what it found and what it c

🆕 The 'who am I dealing with?' check for agents. Reads Coinbase's ONCHAIN verification (an EAS attestation by verifications.coinbase.eth) — meaning the address is tied to a KYC'd Coinbase account, the strongest sybil-resistance signal on Base — plus the address's Basename. Returns a verified/named/a

🆕 Resolves the complete Base identity behind an address or Basename: resolved address, avatar, description, website and social handles (X/Twitter, GitHub, Farcaster, Discord) read from Base's L2 Resolver text records. Lets an agent turn a counterparty address into a real profile — beyond just the na

Flow, not snapshot: the largest transfers of a Base token in the last 24h, classified by whether whales are sending INTO DEX pools (sell pressure) or pulling OUT (accumulation) — a net sell-pressure read that decays in hours. Complements holder-forensics ('who could dump') with 'is anyone dumping no

Retention in one call: pass up to 10 tokens to snapshot them and get a watchId; call again with that watchId to get only the DELTAS since last time — liquidity ±%, price ±%, became-honeypot, sell-tax spiked, liquidity pulled. The second call is worth more than the first. Built for agents holding pos

EOA vs contract, ETH + USDC balance, transaction count and activity level — straight from Base RPC. Useful for counterparty and wallet checks.

Returns current Base gas fees (baseFee, maxPriorityFee) and three tiered suggestions (slow, normal, fast) in Gwei, derived live from the Base RPC. Built for agents that time or cost-estimate transactions.

🆕 Live — B20 is Base's native precompile token standard, and unlike ERC-20 a B20 issuer can freeze holders (Policy Registry) and even SEIZE your balance (burnBlocked) at the protocol level. This reads those powers — seizable, freezable, paused, rebase, uncapped-mint — into one hold/caution/avoid ver

🆕 The single call before trading a Base-native B20: seize (burnBlocked) + freeze (Policy Registry) + rebase + pause + uncapped-mint, collapsed into one GO/HOLD/STOP verdict with an auditable receipt. Pass wallet= to also check if YOUR address is already blocked on that token. The B20 tool to bind fi

🆕 The per-transaction B20 rail check: pass token + from + to (+ optional executor) and get one GO/HOLD/STOP on whether this exact transfer clears NOW — sender policy resolved against the sender, receiver policy against the recipient, executor policy against the operator, plus live transfer-pause. Ev

🆕 Scans a wallet's B20 (Base-native) holdings for protocol-level freeze/seize powers and whether YOUR address is ALREADY blocked on any of them — the risk no ERC-20 portfolio tool can see. Returns per-token seizable/freezable/rebase flags plus a wallet-level verdict. Built for agents holding Base po

🆕 b20-safety tells you WHICH powers a B20 has; this tells you WHO holds them. Reads the token's role-based access control (mint / burn / seize-via-burnBlocked / pause / admin) from onchain role events and reports the exact controllers, how centralized they are, and whether admin has been renounced.

🆕 Every other B20 check reads what the issuer CAN do; this reads what they HAVE done. Scans the token's actual burnBlocked seizures (the BurnedBlocked event) — whether the issuer has ever burned a blocked holder's balance, who was seized, and how much. verdict: enforced (has seized) / armed (can, ha

🆕 Run FIRST on any 'B20'. A scammer can deploy a normal contract at a vanity 0xB200… address and fake the whole B20 read surface — the B20Factory precompile is the one authority that can't be spoofed. Verifies factory registration + bytecode absence (real B20s are chain-native precompiles with no co

🆕 The B20 misconfiguration lint. Base's docs warn: a scope bound to a NON-EXISTENT allowlist silently denies EVERYONE — transfers brick. Audits every policy scope for dangling bindings, ALWAYS_BLOCK, renounced (frozen) lists and live pauses; verdict bricked / critical_misconfig / misconfigured / cle

🆕 b20-freeze-check answers one wallet; this enumerates the WHOLE list. Replays the Policy Registry's BlocklistUpdated/AllowlistUpdated events into the full membership of a B20's blocklist/allowlist: every address ever blocked or whitelisted, when, by whom, and the current member set per scope. Compl

🆕 createB20's initCalls run with role AND transfer-policy gates BYPASSED — a one-tx privilege window only the issuer ever gets. Reconstructs what they did in it: pre-mints (how much, to whom), role grants, policy bindings, blocklist seeding — the token's true starting conditions. verdict: blocklist_

🆕 b20-supply shows the dilution ceiling; this shows the actual printing. Every mint (incl. batchMint) in the window: amount, recipients, and the share of current supply it represents — heavy_dilution / active_minting / minor_minting / quiet. The live issuance feed for agents holding B20 stablecoins

🆕 An Asset B20's multiplier rescales EVERY holder's balance in one call — no transfer, no per-account event, nothing in your tx history. b20-rebase shows today's value; this replays the full MultiplierUpdated history and flags DOWNWARD moves that silently cut every holder. The operator's rebase trac

🆕 A B20 Stablecoin's currency() is SELF-DECLARED — the standard verifies nothing. This is the missing check: declared peg vs actual DEX market price. 'Says USD, trades at $0.71' in one call: on_peg / depeg_warning / depegged / no_market (the peg is a pure claim with zero price discovery) / unverifia

🆕 The premium tier of the B20 suite — no ERC-20 tool can produce it. Composes the full B20 picture: seize/freeze/pause/mint powers, WHO holds them (admin renounced?), allowlist-vs-blocklist access model, supply-cap dilution headroom, metadata mutability, and ACTUAL seizure history (burnBlocked) — th

🆕 B20 adds memos to transfers/mints/burns (transferWithMemo) for payment IDs, compliance tags and settlement correlation — a field ERC-20 has no equivalent for. Reads a token's on-chain Memo event history, optionally filtered by a specific memo (bytes32) or the caller wallet. The settlement-reconcil

🆕 The dilution half of B20 rug risk (b20-safety covers seizure). Reads supply cap vs minted supply (how much can still be minted) plus the on-chain SupplyCapUpdated history — an issuer that RAISED the cap diluted, or set up to dilute, holders. Uncapped mint is flagged as the worst case. Pair with b2

🆕 A B20 with a METADATA_ROLE holder can call updateName/updateSymbol — change its own identity after launch (an impersonation / bait-and-switch vector ERC-20 has no protocol equivalent for). Reads whether the metadata is mutable (role holder exists) AND whether it has ALREADY been renamed on-chain (

🆕 Every B20 has ERC-2612 permit built in — approve a spender by signature instead of a transaction. Reads exactly what an agent needs to build a valid permit: the token's DOMAIN_SEPARATOR, the owner's current nonce (so the signed payload can't be rejected/replayed), and the EIP-712 domain/type struc

🆕 b20-control reads the token's own roles; the address that can actually add you to a blocklist lives in the Policy Registry. This reads WHO administers each active transfer/mint policy (policyAdmin), and whether that control is being handed over (pendingPolicyAdmin) or renounced. The other half of

🆕 A B20 transfer policy is either a BLOCKLIST (allowed unless listed) or an ALLOWLIST (allowed ONLY if listed — a permissioned/whitelist token you can't even receive uninvited). b20-safety flags that a policy exists; this decodes its TYPE per scope (send/receive/execute/mint) — the difference betwee

🆕 B20 Asset tokens can post on-chain announcements (Announcement: id, description, uri) — issuer notices, corporate actions, redemptions — a channel ERC-20 has no equivalent for. Reads a token's announcement feed (active vs ended) from CDP-indexed events. The issuer-communications primitive for agen

🆕 B20 Stablecoin tokens self-declare a fiat currency code (currency() → USD, EUR, …). Reads that declared peg alongside the issuance profile (supply, cap) and control powers (seize/freeze/pause/uncapped-mint) — a one-call 'what is this stablecoin and who controls it' for agents settling in B20 stabl

🆕 Beryl (2026-06-25) cut the single-proof withdrawal window from 7 days to 5, with a dual-proof fast path at ~1 day. Given a Base withdrawal-initiation tx, this decodes the L2ToL1MessagePasser event (the withdrawalHash, target & value needed to prove/finalize on L1) and estimates the finalization wi

🆕 Lists the newest B20 tokens created on Base (from the B20Factory precompile) — variant, symbol, decimals, block. B20 is Base's native token standard and dozens launch hourly. A discovery feed for agents hunting new B20 launches early. Run b20-safety on any address before touching it — new ≠ safe.

The B20-only rug vector: a token can launch clean and later attach a sender blocklist (PolicyUpdated) — silently becoming seizable via burnBlocked. This reads the token's full policy/pause event timeline (CDP-indexed onchain events) plus the live policy state, and tells you if — and exactly WHEN — i

The live layer over B20 Policy Watch: a network-wide onchain webhook captures every B20 PolicyUpdated/Paused sub-second. Pass a token address for its live guard status, or call with no address for the feed of tokens that JUST attached a sender blocklist (turned seizable) across all of Base.

Complete B20 token profile straight from the precompile: variant (Asset/Stablecoin), name, symbol, decimals, total supply, supply cap, active transfer policies, pause states, and rebase. The data companion to b20-safety.