Is your AI-written Solidity safe to deploy?
Paste a single-file Solidity contract (≤2,000 lines; OpenZeppelin imports OK). We compile and statically analyze it — it is never executed.
Full report + auto-fix (pay with USDC on Base)
FAQ
Is ContractScan an audit?
No. ContractScan runs automated static analysis (Slither and Aderyn) plus simple rug-pull pattern checks, and uses AI only to explain the findings in plain language. It can miss bugs and report false positives. For contracts that will hold real value, get a professional audit.
What does ContractScan check?
Common Solidity vulnerabilities detected by Slither and Aderyn (for example reentrancy, unchecked calls, dangerous tx.origin use, missing access control) and rug-like patterns such as owner minting, blacklists, owner-changeable fees, pausing, trading switches, owner withdraw functions and upgradeability.
Is my contract code executed?
No. Your code is only compiled and statically analysed in an isolated sandbox with no network access and strict time and memory limits. It is never deployed or executed.
Who decides the verdict, the AI or the tools?
The verdict (Deployable / Fix first / Do not deploy) is computed from the static analysis findings. The AI writes explanations and optional patches but cannot change the verdict.
What are the limits?
Single Solidity file (flattened is fine), up to 2,000 lines / 250 KB. Only @openzeppelin/contracts imports (v4.9 or v5.x, resolved to a pinned vendored copy; no network); flatten any other imports. Compilers 0.8.0 to 0.8.30 (chosen from your pragma). The free tier gives 3 scans per day with the verdict and top 3 findings.
How much does it cost and how do I pay?
Free: 3 scans/day. Full report with all findings and an auto-fix patch: $3 USDC for 1 scan or $10 USDC for 5 scans, paid on Base. You send a normal USDC transfer, paste the transaction hash and receive a redeem code. We never ask you to sign messages or approve token spending.
Can AI agents use ContractScan?
Yes. There is a JSON API (POST /api/scan) and a minimal MCP server exposing a scan_contract tool. See the API docs and llms.txt.
Do you store my code?
Contract source is processed in a temporary directory that is deleted after the scan. We keep anonymous usage counters, payment records and optional feedback you choose to send.
Get new articles and product updates
Privacy: we store only your email, the signup time and the page you signed up from. No tracking, never sold or shared. Unsubscribe any time by emailing support@contract-scan.dev.