base_contract_audit

dev.workers.dolerite.base-onchain-tools/base-onchain-tools · Verify this server

What an UNVERIFIED Base contract can actually do — the case where block explorers show you nothing. Disassembles the deployed bytecode with a PUSH-aware opcode walk (a naive byte scan reports SELFDESTRUCT on contracts that cannot self-destruct), strips the Solidity metadata trailer, recovers the function selectors from the dispatch table and names them against a keccak-derived signature database, then reports admin powers (mint, blacklist, freeze, pause, trading switches, adjustable fees, upgrade hooks), dangerous opcodes (DELEGATECALL, SELFDESTRUCT, CALLCODE, CREATE2), which token standards it really implements, and whether it supports EIP-3009 so it can be paid gaslessly over x402 at all. Proxies are detected and followed, because a forwarder's own bytecode tells you nothing. Costs $0.04 per call, paid in USDC over x402 on Base. Calling this tool returns the payment requirements; failed calls are never billed.