Smart Contract Auditor
Source-level security review of Solidity: pass/warn/fail verdict, 0-100 risk score, severity-ranked findings with exact file:line, exploit scenario and a fix, plus a SARIF 2.1.0 log. Accepts raw code, a list of files, or an on-chain address (verified source is read from Sourcify). A deterministic detector pass (reentrancy ordering, tx.origin, delegatecall, unchecked calls, weak randomness, pre-0.8 arithmetic) runs beside one model review, and every model finding is checked against the source: its quoted snippet must exist and its line is corrected. A pre-audit triage, not a substitute for a manual audit; it cannot see deployed bytecode, off-chain components or economic assumptions, and not_checked lists what was missing.
What you get
A pre-audit triage pass catches the obvious reentrancy and access-control bugs before a manual audit, so paid auditor hours go to the hard problems. Not a replacement for that audit.
Call it
Send the JSON body below to https://agents.writerslogic.com/api/v1/audit-contract. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.
curl -i -X POST https://agents.writerslogic.com/api/v1/audit-contract \
-H 'content-type: application/json' \
-d '{"code":"pragma solidity ^0.8.20;\ncontract Vault {\n mapping(address => uint256) public balances;\n function deposit() external payable { balances[msg.sender] += msg.value; }\n function withdraw() external {\n (bool ok, ) = msg.sender.call{value: balances[msg.sender]}(\"\");\n require(ok);\n balances[msg.sender] = 0;\n }\n}","contractName":"Vault"}'
Input
| Field | Type | Required | Description |
|---|---|---|---|
code | string; length 1..100000 | no | Raw Solidity source (one or more files concatenated). Provide exactly one of code, files or address. |
contractName | string; length 0..200 | no | Contract to focus on when several are present. |
files | array<object>; max 40 items | no | Alternative to code: Solidity files with repository-relative paths. Findings report the file and line, and the SARIF log points at them. |
address | string | no | Alternative to code: an on-chain contract address. Its verified source is read from Sourcify (no API key); unverified contracts return 404. |
chainId | integer; 1..2147483647 | no | EVM chain id for address; default 1 (Ethereum mainnet). |
Example request body
{
"code": "pragma solidity ^0.8.20;\ncontract Vault {\n mapping(address => uint256) public balances;\n function deposit() external payable { balances[msg.sender] += msg.value; }\n function withdraw() external {\n (bool ok, ) = msg.sender.call{value: balances[msg.sender]}(\"\");\n require(ok);\n balances[msg.sender] = 0;\n }\n}",
"contractName": "Vault"
}
Result
The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.
| Field | Type | Required | Description |
|---|---|---|---|
summary | string | yes | |
overall_risk | string; one of "critical", "high", "medium", "low", "informational", "none" | yes | |
findings | array<object> | yes | |
verdict | string; one of "fail", "warn", "pass", "inconclusive" | yes | fail: a critical or high finding of medium or high confidence. warn: other findings. pass: only informational notes or none (not proof of safety). inconclusive: no findings but part of the source was not reviewed. |
verdict_reason | string | yes | |
risk_score | integer | yes | 0-100, computed in code from finding severity and confidence. |
status | string; one of "complete", "partial" | yes | partial when files were left out of the review; the result is still signed and not_checked says what is missing. |
next_step | string | yes | |
top_findings | array<object> | yes | |
source | object | yes | Where the source came from: kind (code, files, sourcify), file paths reviewed, and for Sourcify the address, chainId, match type, compiler and verification time. |
sarif | object | yes | SARIF 2.1.0 log, one result per finding at its file and line; uploads to GitHub code scanning as-is. |
contract_names | array<string> | yes | Parsed from the source, not model-generated. |
compiler_version | string | yes | Parsed pragma expression, or "unspecified". |
not_checked | array<string> | yes | What this review could not see; an empty findings list does not cover these. |
severity_counts | object | yes | |
lines_of_code | integer | yes |
Pay and connect
Available through: x402 (USDC on Base), MCP, RapidAPI.
Machine-readable
- This agent as JSON (schemas, example, OpenAPI operation)
- Free signed sample response
- OpenAPI 3.1 · Catalog · Index of every agent