Contract Powers

List the EVM contracts in the Contract Powers registry, with a one-line risk shape for each: is the code upgradeable, is the admin a single key (EOA) rather than a contract, how many powers are declared, and is it covered by a bug bounty. Use this to see what is already analysed before spending a lookup. Filters are optional and combine with AND.

{
  "type": "object",
  "properties": {
    "chain": {
      "type": "string",
      "enum": [
        "base",
        "ethereum",
        "polygon"
      ],
      "description": "Restrict to one chain."
    },
    "upgradeable": {
      "type": "boolean",
      "description": "true = only contracts whose code can still be replaced."
    },
    "single_key_admin": {
      "type": "boolean",
      "description": "true = only contracts whose admin is a plain wallet (EOA), not a contract/multisig/timelock."
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 200,
      "description": "Default 200."
    }
  }
}

Full free analysis of one contract that is in the registry: verification, proxy pattern and implementation address, who the admin is and whether it is a single key, every retained power (upgrade / mint / grant-minter / pause / blacklist / seize / fees / sweep / burn-from / ownership transfer / limits) with the evidence and confidence behind it, reachable DELEGATECALL / SELFDESTRUCT / CREATE2 opcodes, and the owner-only functions the classifier could NOT categorise — which is where the unusual powers hide. Accepts an address or a symbol such as USDC or AERO.

{
  "type": "object",
  "properties": {
    "contract": {
      "type": "string",
      "description": "A 0x address, or a symbol such as USDC."
    },
    "chain": {
      "type": "string",
      "enum": [
        "base",
        "ethereum",
        "polygon"
      ],
      "description": "Required if a symbol is ambiguous."
    }
  },
  "required": [
    "contract"
  ]
}

Free preview for ANY verified EVM contract on base, ethereum or polygon — including addresses not in the registry. Returns contract type, verification, name, whether it is a proxy, how many powers were found, how many owner-only functions went uncategorised, and whether an owner was found. The decision fields (which powers, the evidence, the admin address, the implementation) are withheld and listed by name. Use get_contract_powers first if the contract is already in the registry — that is free and complete.

{
  "type": "object",
  "properties": {
    "address": {
      "type": "string",
      "description": "0x-prefixed 20-byte address."
    },
    "chain": {
      "type": "string",
      "enum": [
        "base",
        "ethereum",
        "polygon"
      ],
      "description": "Default base."
    }
  },
  "required": [
    "address"
  ]
}

What actually changed behind the watched contracts: implementation swapped, owner moved, a power appeared or disappeared, verification lost. Each event carries the before and after value and the window it was detected in. Severity is one of critical / material / low. Use this to answer "has anything changed behind this contract recently?".

{
  "type": "object",
  "properties": {
    "severity": {
      "type": "string",
      "enum": [
        "critical",
        "material",
        "low"
      ],
      "description": "Minimum severity to return."
    },
    "contract": {
      "type": "string",
      "description": "Filter to one address or symbol."
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 100,
      "description": "Default 25."
    }
  }
}