Built on Base
Consult detection before you list
No account. No API key. Paid by the call, in USDC.
Exploits, as they are reported.
- Web Application Verification $310.6M
- Solidity Code Verification $192.5M
- Wallet Verification $133.9M
- Ethereum Token Verification $13.4M
Every incident is classified by its reported attack vector, then matched to the service that checks for that vector before execution. A heuristic over DefiLlama's technique field, not a claim that any particular loss would have been prevented.
What goes wrong when nobody verifies.
Three levels. Only the last holds money.
A launchpad, bonding curve or sale contract is the party that lists the token, holds the proceeds if it chooses to, and stands between the deployer and the buyer. It is also the party left carrying the consequence: the deployer is pseudonymous and gone, and the venue is still there and still named. ERC-8376 gives it a way to consult detection before listing, to disclose what it found, and, at full conformance, to return money that has not yet left. The escrow is the expensive part to adopt, so the levels exist to stop it reading as all or nothing.
Call the guard for the launch a buyer is purchasing, and show them the score, the confidence and the evidence at the point of purchase. Where no report exists it must read as unknown, never as safe. Nothing changes on chain.
List your launches so detectors can publish bonded reports against them. Still holds no proceeds and offers no remedy, and the standard forbids implying otherwise.
Hold sale proceeds and release them on a schedule capped at 90 days, so the money is still reachable while the abuse is happening. The only level at which a buyer can be refunded, and the one venues should expect to negotiate over.
Detection scores eleven deployer abuse patterns from a twelve-signal vector into a number from 0 to 100, published as a bonded report a detector loses money for getting wrong. Every signal describes something the deployer did. Price decline is excluded by rule, so a launch that locked liquidity, sold nothing and fell 95 percent still scores clean.
We wrote it, with Chris Johnson of Virtuals, and the detection contracts are live on Base at 0xFef0f857. Reading a launch costs one call and no gas, because the detector is a view function.
Three of the twelve signals are established today. The other nine report as unknown rather than as clean, which is what the standard requires: what exists today and what does not.
Four steps, and what it costs.
Eight of the ten verifications return in under ten seconds. Wallet verification reads 31 chains and web application verification crawls a live site, so those take up to three minutes. Both hand back a job immediately and the page fills in as findings arrive.
Request any endpoint with no key and no account
The server answers with the price, asset and chain
Your wallet signs and the facilitator verifies; no gas
The check runs, then settles. A failed call is not charged
Every figure here is on-chain.
Settlement is public. These figures come from USDC transfers into our receiving address on Base, not from our own logs, so anyone can check them without trusting us.
We wrote the standard this is built on.
ERC-8376, the token launch abuse standard, is ours. We wrote it with Chris Johnson of Virtuals, and the detection above is built to it. It is a Draft proposal and the detector under it is not finished, which is worth knowing before anyone takes our word for the rest.
The other two are 2 Final Ethereum standards on eips.ethereum.org. They are here because authoring a proposal and getting one through review are different things, and only the second is a track record.
