The VAUTH API.

Getting started

Every endpoint is a POST with a JSON body, and every response is JSON. There is no authentication, so the shortest possible integration is one curl.

# map a contract on Robinhood Chain
curl -X POST https://vauth.link/api/agent/vautheye \
  -H "Content-Type: application/json" \
  -d '{"address":"0x5ecaA60dCffe1Ef33Fc61e47AFe3dd7b73DF6bdc"}'

The pre-trade gate

Agents can hold wallets and trade on their own now. What was missing is a check they can make before they act. This endpoint is that check, and it is the only one here written for a program rather than a person: one call, a stable answer to branch on, and reason codes to log.

curl -X POST https://vauth.link/api/verdict \
  -H "Content-Type: application/json" \
  -d '{"token":"0xdAC17F958D2ee523a2206206994597C13D831ec7","chain":"eth"}'

{
  "verdict": "pass",          // "pass" | "fail" | "unknown"
  "risk": "medium",
  "safe": true,              // true only when verdict is "pass"
  "reasons": [
    { "code": "PAUSABLE", "level": "medium",
      "text": "The owner can freeze transfers…" }
  ],
  "checksRun": ["capabilities", "transferability"],
  "checksSkipped": []
}

How to branch on it

Reason codes

VAUTHEYE, the recon agent

Maps any address on Robinhood Chain. This is our own analysis rather than a call to somebody else's scanner, because no security vendor covers this chain. It reads the code from the chain, follows a proxy to the contract that actually executes, and lists every function that code exposes.

Request

Response

{
  "address": "0x5ecaA60dCffe1Ef33Fc61e47AFe3dd7b73DF6bdc",
  "kind": "contract",          // "contract" or "eoa"
  "codeBytes": 45,             // code at the address itself
  "logicBytes": 13804,         // code that actually runs
  "proxy": {
    "type": "EIP-1167 minimal proxy",
    "implementation": "0x581f7b996e6d3e436c537989157c9cb36421419b"
  },
  "token": {
    "name": "VAUTH by Virtuals",
    "symbol": "VAUTH",
    "decimals": "18",
    "totalSupply": "1000000000000000000000000000"
  },
  "owner": "0xe220329659d41b2a9f26e83816b424bdacf62567",
  "groups": {
    "erc20":  ["transfer(address,uint256)", "approve(address,uint256)"],
    "power":  ["owner()", "transferOwnership(address)"],
    "danger": [],
    "info":   ["burn(uint256)"]
  },
  "selectorCount": 91,        // functions found in the bytecode
  "unknown": 77,               // of those, ones we cannot name
  "verdict": "warn",           // "high" | "warn" | "ok" | "info"
  "headline": "Token contract mapped",
  "findings": [
    { "level": "warn", "text": "Ownership is live and held by 0xe220…2567…" }
  ],
  "steps": ["eth_getCode 0x5ecaA60d…", "decoded EIP-1167 clone target"],
  "explorer": "https://robinhoodchain.blockscout.com/address/0x5eca…",
  "tookMs": 2272
}

Fields worth understanding

Finding levels

• high, a capability that can directly harm a holder
• warn, worth understanding before you trust it, including anything we could not read
• good, a property that reduces risk, only ever stated when it was actually verified
• info, context with no risk attached

VAUTHOR, the provenance auditor

VAUTHEYE answers what a contract can do. VAUTHOR answers the question underneath it: is the code you are trusting the code somebody actually published, and who put it there.

The case this agent exists for is the proxy. On a proxy the address everyone quotes holds no source of its own, so a verification check pointed at it reports fully published contracts as unverified. Our own token is one of those. VAUTHOR follows the proxy first, every time, and checks the contract that actually runs.

{
  "verdict": "ok",
  "headline": "Provenance traced",
  "logicAddress": "0x581f7b996e6d3e436c537989157c9cb36421419b",
  "source": {
    "verified": true,
    "name": "AgentTokenV4",
    "compiler": "v0.8.26+commit.8a97fa7a",
    "verifiedAt": "2026-07-01T23:08:09Z"
  },
  "deploy": {
    "creator": "0x43E4C17b15365596Caae8e7d00E42Bc8E988c2d4",
    "creationTx": "0x61bef3c2…"
  },
  "findings": [ … ]
}

Source match

Verification proves the source on an explorer compiles to the deployed bytecode. It says nothing about whether the repository everybody is reading is that same source. This closes that gap: is the code they published the code they deployed?

It also catches a swapped dependency. A contract usually bundles its libraries into its verified source, so comparing those against the library's own repository shows whether the version that shipped is the version the library actually publishes. We ran it on our own token: all fourteen OpenZeppelin files inside the deployed contract are byte for byte identical to OpenZeppelin's published code.

Request

File bodies are far too large to send to an API, so both sides are hashed by the caller after the same normalisation, and we do the matching. Normalise by converting line endings to \n, trimming trailing whitespace on every line, dropping leading and trailing blank lines, then take a SHA-256 of the result.

Paths do not have to line up. @openzeppelin/contracts/utils/Address.sol on chain and contracts/utils/Address.sol in a repo are matched on file name, and when a name appears more than once the candidate sharing the longest path tail wins.

Response

VAUTHRON, the adversarial probe

The other agents read. This one pokes. Every probe is an eth_call, which executes the contract against live chain state and then throws the result away. No transaction, no gas, nothing signed, nothing moved.

The probe that matters: VAUTHRON finds a wallet that genuinely holds the token, then simulates a transfer out of it. If that reverts while the balance is there, holders cannot move their tokens, and that is the shape of a honeypot. Simulating from an empty wallet proves nothing, which is why it goes and finds a real holder first.

VAUTHEON, the sentinel

The other three answer once. This one keeps asking. It records a fingerprint of a contract, the owner, the address a proxy delegates to, and the size of the running code, then re-takes it every thirty minutes.

Those three fields are how a contract quietly becomes a different contract while its address never changes. Subscribe through the Telegram bot with /watch 0x… and you get a message the moment one of them moves.

Contract scanner

A token safety check across four chains. On Ethereum, BNB Chain, and Base it runs against GoPlus Security for honeypot behaviour, buy and sell tax, and owner privileges. On Robinhood Chain, which no honeypot scanner reaches, it reports only what the explorer can prove.

Request

// browser pattern for eth, bnb, and base
const gp = await fetch(
  `https://api.gopluslabs.io/api/v1/token_security/1?contract_addresses=${addr.toLowerCase()}`
).then(r => r.json());

const report = await fetch('https://vauth.link/api/scan', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    address: addr,
    chain: 'eth',
    goplus: gp.result[addr.toLowerCase()]
  })
}).then(r => r.json());

Response

{
  "address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
  "chain": "eth",
  "chainName": "Ethereum",
  "mode": "full",               // "full" or "basic" on Robinhood Chain
  "verdict": "warn",
  "name": "USD Coin",
  "symbol": "USDC",
  "holders": "8062846",
  "high": [],
  "warn": ["Proxy contract, logic can be swapped"],
  "good": ["Source code verified", "Ownership renounced"],
  "explorer": "https://etherscan.io/address/0xA0b8…",
  "note": "Automated check, not a guarantee…"
}

Errors

Failures return a JSON body with an error string you can show to a user as written.

Limits, caching, and fair use

• Answers are cached for about 15 minutes per address. Repeat calls are fast and carry cachedAgeSec.
• If the chain is unreachable, a complete older reading is served with stale: true rather than a broken fresh one.
• There is no published rate limit. It runs on free public infrastructure, so please cache on your side and avoid tight loops.
• If you are building something that needs volume, get in touch on X and we will work out what you need.

What this cannot do

An automated reading is not an audit. Bytecode tells you what a contract is capable of, not what its operators intend. A contract can pass every check here and still be run by someone who plans to rug it, and 77 unnamed functions is exactly that many things we did not read for you.

Treat a clean result as one input among several, never as permission. That is how we use it ourselves, including on our own token, which this API will tell you has ownership that is not renounced.