# OMNI Contract Audit

> Automated Solidity security reports for AI agents, paid per call with x402 (USDC on Base mainnet, eip155:8453). Base URL: https://omni-audit.pplx.app/port/5000

## Paid endpoints
- POST /v1/contract-audit/quick — 1.00 USDC (1000000 atomic). Slither high and medium detectors, risk rating, Ed25519-signed JSON report.
- POST /v1/contract-audit/deep — 25.00 USDC (25000000 atomic). All detectors, owner-power map (mint, blacklist, pause, upgrade, fees, sweep), upgradeability, false-positive annotations, signed report.

Input JSON: {"address":"0x...","chain_id":8453} for a Sourcify-verified contract, {"source":"<solidity>"} for one file, or {"sources":{"path.sol":"..."},"target":"path.sol"} for several. Optional: compiler_version, remappings.
Payment: an unpaid request returns 402 with a payment-required header (x402 v2, scheme exact). Retry with payment-signature. payTo 0x9F4ddCD85E2e142c1Dd1a2B86cB119C26CE9E596, asset USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913.
Payment semantics: the payment authorization is verified, the analysis runs in an isolated sandbox, and settlement is attempted only after a signed report exists. Invalid input (400) or failed analysis (422) is never settled: charged:false. The report is released only when the USDC transfer to the payee is proven on Base (successful transaction with AuthorizationUsed and Transfer logs). If settlement is still unproven (for example a facilitator timeout), you get 202 SETTLEMENT_PENDING: retry the identical request (same payment-signature and body) and you receive the report once the transfer confirms, or 402 charged:false if it never happens or the authorization expires. Retries never charge twice: one authorization buys exactly one report.
Verify a report independently: node verify-report.mjs response.json https://omni-audit.pplx.app/port/5000/.well-known/omni-audit-key (zero-dependency verifier at /verify-report.mjs; add --require-paid; checks the report hash, the Ed25519 report signature and the signed payment receipt).

## When an agent should call this (recurring checks)
- Before buying or swapping into a Base token: POST /deep with {"address":"<token>","chain_id":8453}. Read report.owner_powers: who can mint, blacklist, pause, upgrade, change fees, or sweep funds. Run it once per new token.
- Before approving a spender or depositing into a vault: POST /quick with the spender address. If summary.risk_rating is HIGH, stop and escalate to a human. Run it once per new contract.
- When generating or editing Solidity: POST /quick with {"source":"..."} after each revision, before deploying. It costs $1 per iteration, and a compile or analysis failure is never charged.
- When watching upgradeable contracts: re-run /deep when an implementation changes and compare report_sha256 values.
- Contracts must be Sourcify-verified, or you must send the source. Unverified bytecode returns 422 NOT_VERIFIED_ON_SOURCIFY with charged:false.

## How to buy (clients tested against this live endpoint on 2026-11-11)
Python (pip install "x402[httpx,evm]"):
```python
from eth_account import Account
from x402 import x402Client
from x402.http.clients import x402HttpxClient
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client
c = x402Client(); register_exact_evm_client(c, EthAccountSigner(Account.from_key(KEY)))
c.set_spend_controls({"max_amount_per_payment": "$25"})   # the SDK default cap is $1. Raise it only to buy /deep
async with x402HttpxClient(c, timeout=180) as h:
    r = await h.post("https://omni-audit.pplx.app/port/5000/v1/contract-audit/quick", json={"address": "0x...", "chain_id": 8453})
```
TypeScript (npm i @x402/fetch @x402/core @x402/evm viem):
```ts
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$25" }); // the default cap is $1
client.register("eip155:*", new ExactEvmScheme(privateKeyToAccount(KEY)));
const r = await wrapFetchWithPayment(fetch, client)("https://omni-audit.pplx.app/port/5000/v1/contract-audit/deep",
  { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ address: "0x...", chain_id: 8453 }) });
```
The wallet needs USDC on Base: 1 USDC for quick, 25 for deep. No gas is needed, because the facilitator submits the transfer.
Allow up to 180 s, since a deep audit compiles and analyzes the contract. On 202 SETTLEMENT_PENDING, resend the identical request (same payment-signature header and body). It is never charged twice.

## Free endpoints
- GET /v1/contract-audit — prices, input schema, signing key
- GET /v1/contract-audit/sample — a real deep report on WETH9 (Base)
- GET /.well-known/omni-audit-key — Ed25519 JWK
- GET /health

## Limits
Automated static analysis only (Slither plus OMNI owner-power mapping). It is not a comprehensive independent security audit, not a manual review, and does not guarantee the absence of vulnerabilities. Economic, oracle, cross-contract and most business-logic flaws are out of scope.

Signing key (pin it): kid urn:omni:sirfixall:audit-key:6eb59bd293c7a003, Ed25519 x QuRmY9vzLB_LO7tvBO3atGNroypz9xhooE86Pdz1SHY. Verify with: node verify-report.mjs response.json https://omni-audit.pplx.app/port/5000/.well-known/omni-audit-key --require-paid --expect-kid=urn:omni:sirfixall:audit-key:6eb59bd293c7a003