Contract Audit

${var} — Contract address (0x...) on Base to audit. Required. If empty, log AUDIT_NO_TARGET and exit cleanly (no notify).

Deep contract inspection: what powers exist, who holds them, and whether they're still exercisable. This is the structural view; for a single risk score use rug-scan. Runs keyless on public endpoints.

Read the last 2 days of memory/logs/ so a re-audit can note changes (e.g. ownership newly renounced).

Config

• Target = ${var}. Chain = Base (chainid=8453, explorer basescan.org).
• ETHERSCAN_API_KEY — optional; Etherscan v2 works keyless at a lower rate limit. Appended to the URL, never a header.

Steps

1. Source + verification

ADDR="${var}"
curl -m 10 -s "https://api.etherscan.io/v2/api?chainid=8453&module=contract&action=getsourcecode&address=${ADDR}${ETHERSCAN_API_KEY:+&apikey=$ETHERSCAN_API_KEY}" | jq '.result[0] | {ContractName, Proxy, Implementation, CompilerVersion, verified: (.SourceCode != "")}'