ToolMint Base Token Safety

Routes and prices

Free routes: /, /health, /openapi.json, /.well-known/x402.

Try it

Copycurl -i "https://toolmint-base-token-safety-json.toolmint.workers.dev/check?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

When to use it

• Quick first-pass screen of a Base token contract before an agent spends time or money on it: is the contract upgradeable, does it have mint/pause/blacklist functions, is there an owner, is there DEX liquidity on Base.

Not for: deciding to buy or sell, proving a token is safe, non-Base chains, NFTs, or EOAs.

Example

curl -i "https://toolmint-base-token-safety-json.toolmint.workers.dev/check?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

That hostname is the planned Worker name. The tool is not deployed yet.

Trimmed response (values illustrative; shown with Blockscout unavailable):

{
  "tool": "base-token-safety-json",
  "version": "0.1.0",
  "fetchedAt": "2026-10-31T12:00:00.000Z",
  "chain": "base",
  "chainId": 8453,
  "address": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
  "isContract": true,
  "contract": {
    "bytecodeBytes": 1000, "verified": null, "name": null, "compiler": null,
    "proxy": true, "proxyStandard": "zos-legacy",
    "implementation": "0x...", "proxyAdmin": "0x...", "beacon": null,
    "implementationScanned": true
  },
  "ownership": {
    "owner": "0x...", "renounced": false,
    "note": "Upgradeable proxy: a renounced owner() does NOT remove control - the proxy admin can replace the code."
  },
  "capabilities": { "mint": true, "pause": true, "paused": false, "blacklist": true,
                    "selectorsScanned": { "...": "..." }, "selectorsFound": { "...": true } },
  "holders": { "available": false, "holderCount": null, "topHolderPct": null, "top10SharePct": null,
               "topSample": [], "note": "Percentages use Blockscout total_supply (null when unavailable). ..." },
  "liquidity": { "available": true, "pairCount": 3, "totalLiquidityUsd": 1000000,
                 "bestPair": { "dex": "...", "pairAddress": "0x...", "liquidityUsd": 500000, "priceUsd": "1.00", "url": "..." } },
  "risk": {
    "grade": "F", "score": 15,
    "flags": ["upgradeable_proxy_admin_can_change_code", "verification_unknown", "owner_not_renounced",
              "mint_selector_present", "pause_selector_present", "blacklist_selector_present"],
    "unknowns": ["source verification", "holder concentration (needs Blockscout holders + total_supply)"],
    "gradeMeaning": "A = fewest red flags among the heuristics below; F = many. A grade is a triage signal, never a safety verdict.",
    "notChecked": ["Honeypot / sell-ability simulation, transfer taxes, max-tx/max-wallet limits (no trade simulation is run)", "..."],
    "disclaimer": "Read-only heuristic for agent triage on Base ERC-20s. Not financial advice, not an audit, and not a guarantee against rug pulls or honeypots. ..."
  },
  "provenance": {
    "rpc": "https://mainnet.base.org",
    "verification": "https://base.blockscout.com/api/v2/smart-contracts/0x...",
    "holders": "https://base.blockscout.com/api/v2/tokens/0x.../holders",
    "liquidity": "https://api.dexscreener.com/latest/dex/tokens/0x...",
    "notes": ["Read-only JSON-RPC only ...", "..."],
    "errors": { "verification": "HTTP 403 (HTML/bot-challenge page)", "holders": "HTTP 403 (HTML/bot-challenge page)" }
  }
}

The numbers above (score, liquidity, bytecode size) are placeholders, not a real reading of that address. What the grade means: scoring starts at 100 and subtracts for upgradeable proxy, unverified or unknown source, owner not renounced, mint/pause/blacklist selectors in the bytecode, a large top holder, and low or unknown liquidity. 85+ is A, 70+ B, 50+ C, 30+ D, below that F. Selector matches are bytecode patterns; a match is not proof the function can be called by anyone.

Data sources and licence

Public Base RPC nodes (read-only calls), Blockscout public API, DexScreener public API. Each has its own terms and rate limits; the public RPC endpoints are not for production SLAs. Data is as the sources return it; no endorsement by any of them.

Freshness and caching

Results use data cached in memory for a few minutes (contract code 10 min, verification 15 min, holders 10 min, liquidity 5 min). fetchedAt is the time of your call; the cache is not shown per field.

Limits

• Base mainnet ERC-20 only.
• Proxy detection covers EIP-1967 and legacy zos slots only; other proxy types are not read.
• Holder percentages need Blockscout total supply and are not classified (LP pools, burn and exchange addresses are not told apart).
• Public RPCs are rate-limited; heavy use may fail with 502 (not charged).

Errors are not charged

Payment settles only on a successful answer. These responses are never settled: