Full Wallet Portfolio

Complete ERC-20 portfolio for a Base address — every non-zero token with balance, metadata and live USD value, plus a total. Token discovery via CDP Data API (Coinbase) with Alchemy fallback; USD from DexScreener.

Use before an agent buys or swaps into a Base token: token-risk, sellability (honeypot, tax), swap route and price impact for your size, and deployer reputation in one GO/HOLD/STOP verdict with a receipt. GO only when every check ran clean; an outage is HOLD. Coinbase tokenized stocks get stock checks (transfer policy, wallet eligibility, premium vs reference). GO/HOLD return `enforce`: a Cobalt c

"Top holder owns 18%" means nothing without: 18% of what, against how deep a pool. Values the largest live holders' bags (GoPlus % × Base supply × price; pools, lending, bridges, vaults, lockers, burn excluded; exchanges reported apart) and dumps them through every Base pool the token is in, constant-product. Impact if the top holder and top 3 exit; verdict resilient → exit_trap. USD stablecoins:

🆕 Lists the newest B20 tokens created on Base (from the B20Factory precompile) — variant, symbol, decimals, block. B20 is Base's native token standard and dozens launch hourly. A discovery feed for agents hunting new B20 launches early. Run b20-safety on any address before touching it — new ≠ safe.

🆕 One block on Base — height, hash, parent, timestamp and age in seconds, transaction count, gas used against the limit, and the base fee in gwei. Takes a block number, a 0x… block hash, or latest / finalized / safe / earliest. A block that isn't mined yet answers found:false with the reason rather than an error. Raw chain data, no interpretation.

🆕 What sits at a Base address: contract or plain wallet, and if a contract, whether it declares ERC-721 or ERC-1155 via ERC-165 or carries the ERC-20 shape, plus name, symbol, decimals and code size. Interface support is read from the contract's own declaration first and only inferred when there is none — the ordering matters, because NFTs answer totalSupply() too.

🆕 The receipt for a Base transaction: success or reverted, block, gas used, effective gas price, the fee in wei and ETH, how many logs it emitted and which contracts emitted them. A contract deployment reports the new address. No receipt yet means pending, dropped, or never here — and it says which is possible instead of failing.

🆕 A Base transaction by hash, unedited: from, to, value in wei and ETH, nonce, gas, fee caps, type, and the 4-byte method selector with the calldata size. Flags a contract creation (null to) and a still-pending transaction (null block) rather than leaving you to infer either. Unknown hashes answer found:false, not an error.

Runs pre-trade-gate (risk, sellability, route, deployer), b20-gate (seize/freeze/pause; N/A for non-B20 tokens), owner-powers and dump-risk in parallel on a Base token, with clanker-token-audit as provenance that never moves the verdict. Returns GO/HOLD/STOP, what each check saw, an unverified list, a max size held to 2% impact on the exit-liquidity read, and a receipt. GO only if every applicable

Use when an agent asks "is this Base token safe?" before buying, holding or listing it. One scam/rug check read live from Base RPC + GoPlus: honeypot, buy/sell tax, hidden or reclaimable owner, pausable transfers, blacklist, holder concentration (sellable holders only), LP lock and upgradeable proxy. Returns a 0-100 score, flags and a GO/HOLD/STOP receipt. On established tokens (50k+ holders, $1M+

The check before the riskiest moment — signing. Decodes raw unsigned calldata (approve / permit / transfer / setApprovalForAll), shows the exact intent (who gets power over what, and whether it's UNLIMITED), and screens the destination + spender for OFAC sanctions and dangerous owner powers, in one GO/HOLD/STOP verdict + receipt. No simulation needed — pure decode + onchain risk. Catches the unlim

🆕 Base Account spend permissions let an app or agent spend a scoped, recurring allowance from a wallet — the primitive behind autonomous agent payments on Base. This reconstructs a wallet's ACTIVE spend permissions from onchain approve/revoke events and flags the dangerous ones: unlimited allowance, no expiry, unrecognized spender. The Base-native, agent-era drain check that ERC-20 approval tools

Reads who controls a contract straight from chain: owner/getOwner/admin, pending owner, EIP-1967 proxy implementation + admin, and paused state — and whether the owner is a single EOA key (one compromise = total control) or a contract (multisig/timelock). Crucially: ownership 'renounced' is NOT safe if it is still an upgradeable proxy whose admin can swap the logic. The control-surface read before

🆕 totalSupply for any Base token, returned raw and scaled by its decimals, alongside the name and symbol. When a contract doesn't declare decimals the answer assumes 18 and marks that it assumed — a silent guess here quietly moves every downstream number by orders of magnitude. Non-token addresses answer found:false.

🆕 The next nonce for any Base address, plus its ETH balance and whether it is a contract. The count means different things either side of that line — transactions sent for a wallet, contracts deployed for a contract — so both are reported under their own name instead of one ambiguous number. What you need before building a transaction, or to tell a fresh address from a used one.

A quote shows today's price; it does NOT tell you a $5k buy into a $20k pool pays ~20% more. This takes the token's deepest Base pool, treats it as constant-product (Uniswap-V2 / Aerodrome volatile) and computes the exact x*y=k price impact for your USD size. Conservative — concentrated-liquidity pools usually do better. Also returns the largest size under 1% and 3% impact. Pass address= and size=

Validate an IBAN offline: country registry length, structure, and the ISO 7064 mod-97 checksum that catches what humans and spreadsheets actually get wrong — a transposed pair, a dropped character, an O typed for a zero. Returns the normalised and print-formatted forms, country, SEPA membership, and the bank identifier where the layout is known. Every rejection names WHICH check failed, so you kno

🆕 An ERC-20 balance on Base, in raw units and in decimals, with the token's symbol and decimals resolved in the same call. Zero is flagged explicitly, since it is the commonest answer and the one most easily confused with a failed read. An address that doesn't implement balanceOf answers found:false and says so.

🆕 First tooling for Base's Commerce Payments protocol (AuthCaptureEscrow): reconciles two-phase auth/capture payments — in escrow, captured, charged, voided, refunded, or payer-RECLAIMABLE because the operator missed the capture window. Filter by payment= (infoHash), payer=, receiver= or operator=, or omit everything for the network feed. The order-reconciliation read merchants and agents need be

🆕 Since Pectra an EOA can carry EIP-7702 delegated code (the 0xef0100 designator): every call to the wallet executes the DELEGATE's contract with the wallet's funds — a malicious delegate is total takeover, invisible to approval tools. Reads the designator, resolves the delegate and verdicts it: not_delegated / delegated_known (Coinbase's EOA→SmartWallet path) / delegated_unknown (🚨) / smart_con

The payer-trust mirror of x402-seller-check. Reads a wallet's outgoing USDC payments on Base over 90 days: distinct sellers paid (breadth), total payments and USDC (depth), and whether it ever paid the same payee twice. Breadth with no depth in a short burst is the crawler/sampler pattern; a repeat or sustained payer is the opposite. Sees only Base USDC; absence reads as 'thin', never bad. Not fin

Lists the NFT collections a Base wallet holds — name, count and floor value — spam-filtered, via Covalent. For agents profiling a wallet's NFT exposure.

Returns current Base gas fees (baseFee, maxPriorityFee) and three tiered suggestions (slow, normal, fast) in Gwei, derived live from the Base RPC. Built for agents that time or cost-estimate transactions.

🆕 A B20 with a METADATA_ROLE holder can call updateName/updateSymbol — change its own identity after launch (an impersonation / bait-and-switch vector ERC-20 has no protocol equivalent for). Reads whether the metadata is mutable (role holder exists) AND whether it has ALREADY been renamed on-chain (NameUpdated/SymbolUpdated history). Trust the address, not the label.

🆕 b20-safety tells you WHICH powers a B20 has; this tells you WHO holds them. Reads the token's role-based access control (mint / burn / seize-via-burnBlocked / pause / admin) from onchain role events and reports the exact controllers, how centralized they are, and whether admin has been renounced. The issuer-control map an agent needs before holding a regulated Base-native asset.

🆕 Commerce Payments flows are DRIVEN by an operator — it authorizes escrow, captures for merchants and takes the fees. This audits one before you rely on it: 90-day volumes, fees taken, capture-vs-reclaim record (missed capture windows = merchants left unpaid), distinct payers and merchants. verdict: healthy_operator / mixed / sloppy_operator / no_activity. No other tool reads this new Base comme

🆕 The complete fund-movement authority on a Base wallet in one call: ERC-20 approvals (a spender you approved can pull the token) PLUS Base Account spend permissions (the agent-era scoped recurring allowance) — one drain-surface verdict with the ERC-20 revoke queue to act on. Approval tools miss the spend permissions; spend-permission tools miss the approvals. The only combined check for agent wa

The other half of bridge-route. A bridge takes minutes with funds in flight, and from the source chain alone an agent cannot tell if it completed. Tracks a transfer by its source tx hash via the LiFi status API: completed (with the receiving tx), pending (poll again), failed (with the reason), or not-found (not a bridge tx, or too early to index). Pass from/to/bridge for a faster lookup. not-found

Use when an agent hunts what is moving on Base. Up to 15 trending Base pools ranked by live DEX activity (GeckoTerminal): token address, pool, DEX, price, 24h change, volume, liquidity and trade count. Paid DexScreener promotions are listed separately, never mixed in. Trending is not safety: vet with token-risk before buying.

Returns the latest tokens profiled on Base from the DexScreener feed — address, description, and links. Great for discovery bots hunting new launches early.

Parse a bank CSV (comma/semicolon/tab, quoted fields) and map common headers (date/amount/debit/credit/balance/description, TR aliases) into one schema. Up to 500 rows. Best-effort.

Live Base chain snapshot: latest block, base fee + priority fee (Gwei), current ETH price, and the estimated USD cost of a simple ETH transfer. For agents timing or budgeting transactions.

Resolves a 4-byte function selector (e.g. 0x70a08231) to candidate human-readable signatures via 4byte.directory. Accepts a bare selector or full calldata.

Computes the 4-byte selector for a function signature (e.g. transfer(address,uint256) → 0xa9059cbb). The inverse of the decoder — useful for agents building or matching calldata.

Before an agent pays or trusts a NEAR account: does it exist, what kind is it (named, implicit, 0x), how much NEAR it holds (available, staked, locked for storage), whether it is a contract or a NEP-141 token, and who controls it — full-access keys that can do anything, and function-call keys limited to one contract. Flags a wallet held by one key, a contract replaceable by key, and an account no

An indicative quote for swapping any asset NEAR Intents routes — NEAR, USDC, USDT, BTC, SOL and more, across chains. Name assets as a symbol (USDC = on NEAR, USDC@base for another chain), a NEAR token account, or a 1Click asset id. Returns amount out, minimum out, USD in and out, the rate, the cost in percent lost to fees and price impact, and the expected time. Nothing is reserved or paid.

A token can look clean now — low tax, no honeypot, sells fine — and still leave the owner holding the switches to trap you later. sellability asks 'can I sell today'; this asks 'what can the owner do AFTER I buy'. Lists the mutable owner powers — raise sell tax to 100%, zero your balance, blacklist you, pause transfers, reclaim 'renounced' ownership, mint supply — each mapped to the attack it enab

Not 'is this address sanctioned' (that's sanctions) but 'has it DEALT with one' — screens a wallet's USDC counterparties (both directions) against the OFAC SDN list. Taint by association: receiving from or routing through a wallet that transacts with sanctioned addresses carries sanctions risk. Returns the sanctioned counterparties found. Covers direct counterparties; pair with fund-trace for the

Not price momentum — ADOPTION. token-age tells you when a token was born; holder-distribution is a snapshot. Neither shows the TRAJECTORY. A token can pass every static check and still bleed users week over week — what a human sees watching for days, an agent can't. Reads weekly transfer counts and distinct participants over the last 28 days and calls it: accelerating, steady, cooling, dying, or l

Metadata for a Base token: name, symbol, logo image, official website and social links (X/Telegram/etc.) plus price & liquidity — from DexScreener. For agents and UIs enriching a token.

Pass a Base token contract address and get the current USD price, 24h change, liquidity, and volume from DexScreener (highest-liquidity pair auto-selected). No API key required.

When was this token born — its earliest transfer on Base — and how old is it in days, with a verdict: brand_new (<1d), very_new (<7d, where most rugs happen), new (<30d), established, or mature. New is not bad, but age is a first-order risk input every agent should have before sizing. Pairs with launch-snipers and token-risk. Not a safety verdict on its own. Not financial advice.

Dividends and splits on a tokenized stock settle by moving its multiplier; balanceOf never changes, so a naive reader is silently wrong. Coinbase announces each one on chain days ahead. This lists every announced action across all tokenized stocks Coinbase lists, plus any ERC-8056 schedule, and with wallet= which touch that wallet's holdings. Lenders pause a stock's reserve while one is applied. N

Ranks a wallet's active token approvals by USD-at-risk x unlimited-allowance x unlabelled-spender, and returns a prioritised revoke queue. Approvals are the #1 drain vector; this tells an agent exactly what to revoke first.

The address-poisoning attack: a scammer sends dust from an address whose first/last characters match one you really use, hoping you copy-paste the poisoned one. An auto-paying agent is the perfect victim. This compares the recipient against the head/tail of addresses the wallet actually transacts with and flags a look-alike that is NOT a real counterparty. Pass wallet= (yours) and to= (the recipie

owner-powers says the owner CAN mint; this says whether they ARE, and how fast. A token can advertise fixed supply and quietly inflate it, diluting holders before the dump. Sums zero-address mints and burns over a window (CDP SQL) against live on-chain totalSupply, annualised. Verdict from fixed_in_window / deflationary to hyperinflation. Honest: bridges, staking and LP programs mint legitimately

Before your agent sends, approves or signs to an address — a wallet risk check with one GO/REVIEW/STOP verdict. Screens OFAC sanctions, Coinbase/Basename identity, wallet vs contract, how long the address has existed, and whether contract logic can be swapped AFTER you send. Every factor returns what it found and what it could not read — a check that did not run never reads as clean, so GO means e

Wallet age in days, first & last activity timestamps, and outgoing transaction count for any Base address — read straight from the Base archive, not a 30-day feed, so it dates wallets of any age. Counts and last-activity cover what the wallet SENT; inbound transfers don't raise the nonce and aren't counted. Built for sybil screening and counterparty trust checks.

Every dividend or split applied to a Coinbase tokenized stock on Base, with multiplier before/after and the share accrual, joined to Coinbase's own record; those announced but not yet applied; and each stock's cumulative accrual. The record cost-basis and NAV need. symbol= narrows to one stock. A failed warehouse read reads as degraded, never 'none'. Not financial advice.

b20-safety says a tokenized stock is a real issuance; this says what it trades at ON-CHAIN and whether there's liquidity for size. Pass symbol=AAPL (or AAPLc) for the deepest Base pool's price, aggregate liquidity, 24h move and volume; omit symbol for the full directory. Covers every stock Coinbase lists — the roster tops itself up from Coinbase's own API. This is the tradeable Base price, which c