Built on Base
Show every buyer what the deployer did
No account. No API key. Paid by the call, in USDC.
Exploits, as they are reported.
- Web Application Verification $310.6M
- Solidity Code Verification $199.8M
- Wallet Verification $133.9M
- Ethereum Token Verification $6.1M
Every incident is classified by its reported attack vector, then matched to the service that checks for that vector before execution. A heuristic over DefiLlama's technique field, not a claim that any particular loss would have been prevented.
Three levels. The first takes an afternoon.
A launchpad lists the token, stands between the deployer and the buyer, and is left carrying the consequence when the deployer proves pseudonymous and gone. ERC-8376 is written for that position: consult detection, disclose what it found, and at full conformance return money that has not yet left. Escrow is the expensive part, so the levels exist to stop it reading as all or nothing.
Call the guard for the launch a buyer is purchasing, and show them the score, the confidence and the evidence at the point of purchase. Where no report exists it must read as unknown, never as safe.
List your launches so detectors can publish bonded reports against them. Still holds no proceeds and offers no remedy, and the standard forbids implying otherwise.
Hold sale proceeds and release them on a schedule, so the money is still reachable while the abuse is happening. The only level at which a buyer can be refunded.
Detection scores eleven deployer abuse patterns from a twelve-signal vector into a number from 0 to 100, published as a bonded report a detector loses money for getting wrong. Every signal describes something the deployer did. Price decline is excluded by rule, so a launch that locked liquidity, sold nothing and fell 95 percent still scores clean.
We wrote it, with Chris Johnson of Virtuals. It is a Draft standard and the detector under it is not finished: what exists today and what does not.
What goes wrong when nobody verifies.
Four steps. Most results in under ten seconds.
Eight of the ten verifications return in under ten seconds. Wallet verification reads 31 chains and web application verification crawls a live site, so those take up to three minutes. Both hand back a job immediately and the page fills in as findings arrive.
Request any endpoint with no key and no account
The server answers with the price, asset and chain
Your wallet signs and the facilitator verifies; no gas
The check runs, then settles. A failed call is not charged
Every figure here is on-chain.
Settlement is public. These figures come from USDC transfers into our receiving address on Base, not from our own logs, so anyone can check them without trusting us.
Pay for the call, not the seat.
We wrote the standards, not just the code.
2 final Ethereum standards on eips.ethereum.org, one in Idea. ERC-8126 does not merely resemble this catalogue: it names seven of these services by their own codes, as the checks an agent verification is composed of.
