Skip to main content
Glama

base_contract_audit

What an UNVERIFIED Base contract can actually do — the case where block explorers show you nothing. Disassembles the deployed bytecode with a PUSH-aware opcode walk (a naive byte scan reports SELFDESTRUCT on contracts that cannot self-destruct), strips the Solidity metadata trailer, recovers the function selectors from the dispatch table and names them against a keccak-derived signature database, then reports admin powers (mint, blacklist, freeze, pause, trading switches, adjustable fees, upgrade hooks), dangerous opcodes (DELEGATECALL, SELFDESTRUCT, CALLCODE, CREATE2), which token standards it really implements, and whether it supports EIP-3009 so it can be paid gaslessly over x402 at all. Proxies are detected and followed, because a forwarder's own bytecode tells you nothing. Costs $0.04 per call, paid in USDC over x402 on Base. Calling this tool returns the payment requirements; failed calls are never billed.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
addressYesContract address on Base mainnet
follow_proxyNoOptional, default true. Set to false to audit the proxy's own bytecode instead of its implementation.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the disassembly approach (PUSH-aware walk), metadata stripping, signature database, proxy following, and the $0.04 cost with no billing for failed calls. It also notes that failed calls are never billed, which is important behavioral context. It does not mention rate limits or auth, but the cost and failure behavior are well covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph that is information-rich but somewhat long. It front-loads the core purpose and then details capabilities and costs. Every sentence adds value, but the length could be slightly trimmed without losing meaning. Still, it is well-structured and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (bytecode analysis, proxy following, cost model) and the lack of annotations and output schema, the description is quite complete. It covers what the tool does, how it works, what it reports, and the payment requirement. It could mention the return format or any limitations, but the description is sufficient for an agent to decide and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters. The description adds context for 'follow_proxy' by explaining the default true behavior and why proxy following matters, which is useful. However, it does not add syntax or format details beyond the schema, so a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: auditing an unverified Base contract by disassembling bytecode, recovering function selectors, and reporting admin powers, dangerous opcodes, token standards, and EIP-3009 support. It distinguishes itself from sibling tools like base_contract_type and base_tx_check by focusing on unverified contracts and deep bytecode analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when a contract is unverified and block explorers show nothing. It also explains the proxy-following behavior and the cost/payment model. However, it does not explicitly state when NOT to use it (e.g., for verified contracts) or mention alternatives among siblings, though the context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.2/5.0
Disambiguation5/5

Each tool targets a distinct concern: address pre-flight, allowance, contract audit, contract type, gas, portfolio, prices, tx status. Even the two pricing tools are clearly separated (Chainlink ETH/BTC vs. any token via Uniswap V3), so selection ambiguity is minimal.

Naming Consistency4/5

All tools share the base_ prefix and snake_case, which is highly predictable. However, the pattern mixes noun-style names (base_allowance, base_gas, base_token) with verb-including names (base_simulate_transfer, base_tx_check), so it is not a pure verb_noun convention throughout.

Tool Count5/5

Twelve tools is a well-scoped set for a Base-focused on-chain analytics server. Each tool provides a meaningful capability without bloating the surface, and the free demo tool is a sensible inclusion.

Completeness4/5

The server covers the main read/analytics lifecycle: address checks, contract verification, token metadata, pricing, gas, portfolio, allowances, simulation, and transaction confirmation. Minor gaps exist, such as no generic contract-state reader or non-synthetic historical deep dives, but the core domain is well served.

Resources