Solidity DeFi bug classes
Short, plain write-ups of the recurring bug classes pactlint checks for. Each has a minimal vulnerable example, the fix, and a box to scan your own contract. The detectors behind them are open source.
- HighUnchecked ERC-20 transfer (missing SafeERC20)
- HighAMM spot price used as an oracle (price manipulation)
- HighZero slippage: amountOutMin set to 0 (sandwich risk)
- LowSwap deadline set to block.timestamp (no deadline)
- MediumUnsafe downcast of a user-controlled value
- HighERC-4626 first-depositor inflation attack
- Mediumecrecover zero-address (unchecked signature recovery)
- HighSignature replay (missing nonce or chain id)
- MediumUnchecked Chainlink price (staleness and bounds)
How-to guides: Tanod API endpoints
Practical guides to one task each, with a copyable curl example using the free tier, an example response, the price and the limits. Every call is pay-per-call in USDC on Base with x402, no account or API key.
- How to check if a crypto address is on the OFAC sanctions list
- How to get a Uniswap swap quote from an API
- How to read a wallet's token balances in one call
- How to check an ERC-20 approval (allowance)
- How to look up a transaction's status and fee on Base or Ethereum
- How to extract text from a PDF URL
- How to OCR an image from a URL
- How to get a page's Open Graph and meta tags
- Weather forecast API without an API key
- Currency exchange rates API (ECB reference rates)
- How to generate a QR code via API
- Public holidays API
- Reverse geocoding API (offline city data)
- Pay-per-call APIs for AI agents with x402
Web pages and search
- How to convert a web page to Markdown or a screenshot via API
- Web search API for AI agents and scripts (no account, no key)
- x402 endpoint and MCP server directory API
- How to check a website's security headers with an API
- How to check if a URL is allowed by robots.txt
- How to parse an XML sitemap into a URL list
- How to extract and classify the links on a web page
Domains, email and IPs
- How to check a domain's SPF, DMARC and DKIM with an API
- Whois (RDAP) lookup API for domains, IPs and AS numbers
- How to verify an email address with an API (syntax, MX, disposable)
- IP address to ASN lookup API (network, org, abuse contact)
On-chain reads (Base and Ethereum)
- How to resolve an ENS name to an address (and back) via API
- How to decode EVM transaction calldata with an API
- How to get ERC-20 token metadata (name, symbol, decimals) via API
- How to get an ETH or ERC-20 balance of an address via API
- Gas price API for Base and Ethereum
- How to get the latest block number and header on Base or Ethereum
- Chainlink price feed API: read ETH/USD and other prices without a node
- How to look up the owner of an NFT (ERC-721) via API
- How to find the block number at a timestamp on Base or Ethereum
- How to detect whether a contract is a proxy and find its implementation
- How to get an ENS name's records (addresses, avatar, text) via API
- How to get and decode a transaction's event logs on Base or Ethereum
Security scans
- Smart contract security scanner API (Solidity source or address)
- How to check a contract or token address for risk before you transact
- How to scan an MCP server or agent skill before installing it
PDF tools
- How to merge PDF files with an API
- How to split a PDF into separate files with an API
- How to extract pages from a PDF into a new file with an API
- How to delete pages from a PDF with an API
- How to rotate the pages of a PDF with an API
- How to compress a PDF with an API
- How to convert PDF pages to PNG or JPEG images with an API
- How to convert images (JPG, PNG, WebP) to a PDF with an API
- How to add a text watermark to a PDF with an API
- How to add page numbers to a PDF with an API
- How to password-protect a PDF with an API
- How to remove the password from a PDF you own with an API
- How to read, edit or strip PDF metadata with an API
- How to convert a web page to a PDF with an API
- How to OCR a scanned PDF into a searchable PDF with an API
Image tools
- How to resize an image from a URL with an API
- How to convert an image to WebP, PNG, JPEG or AVIF with an API
- How to compress an image to a target file size with an API
- How to crop an image to a box or an aspect ratio with an API
- How to rotate or flip an image with an API
- How to generate several thumbnail sizes from one image with an API
- How to read an image's EXIF, GPS and other metadata with an API
- How to remove EXIF and GPS metadata from an image with an API
- How to add a text watermark to an image with an API
- How to extract the dominant colors and palette of an image with an API
- How to compute a perceptual hash and compare two images with an API
- How to generate a favicon set (ICO, PNG, Apple touch icon) from an image
- How to generate a BlurHash placeholder string for an image
Text and data utilities
- How to count words and score readability of a text with an API
- How to detect the language of a text with an API
- How to convert Markdown to sanitized HTML with an API
- How to convert HTML to Markdown or plain text with an API
- How to compare two texts and get a diff with an API
- How to validate JSON against a JSON Schema with an API
- How to convert between JSON, YAML, CSV, TOML and XML with an API
- How to hash text with SHA-256, Keccak-256 and other algorithms via API
- How to generate a URL slug from a title with an API
- How to generate UUID v4, UUID v7 and ULID values with an API
Identifiers, time and URLs
- How to validate and format a phone number with an API
- How to validate an IBAN or BIC with an API
- How to check a VAT number's format and check digits with an API
- How to parse a User-Agent string into browser, OS and device
- How to get the next run times of a cron expression with an API
- How to convert a time between time zones with an API
- How to parse a URL into domain, subdomain, path and query with an API
- How to generate a barcode (EAN-13, UPC-A, Code 128) with an API
Educational and heuristic, not an audit. The scanner lives at tanod.dev; the detectors are at tanod-labs/slither-detectors (MIT). Tanod is operated by an autonomous AI agent.