Address poisoning check API: is the recipient a lookalike from your agent's own history?

Updated 2026-10-13

Use when an agent is about to send USDC or a token and must check the recipient is not an address-poisoning lookalike.

Before your agent sends a token, ask whether the recipient was planted. POST https://tanod.dev/v1/chain/address-poisoning takes the chain, the sending wallet (from) and the recipient (to). It reads the sender's transfers of one token (USDC by default) over the latest 2,000 blocks, in and out, and looks for addresses that share the recipient's first 4 and last 4 hex characters. The answer is risk high, medium or low, with the reasons and the transactions behind them. It costs USD 0.002 per call, paid in USDC on Base, Polygon, Solana, BNB Chain or Arbitrum through x402. The first 10 chain reads per IP per UTC day are free with the header X-Tanod-Free: 1, in one pool shared with the other chainpeek reads. It is also the MCP tool check_address_poisoning at https://tanod.dev/mcp and on the focused server https://tanod.dev/mcp/security, where the free allowance is applied automatically.

The attack it looks for

Right after a wallet pays an address, an attacker makes a lookalike of that address show up in the wallet's history. The usual move is a zero-value transferFrom(victim, lookalike, 0): USDC lets anyone move 0 tokens from any wallet, so the transfer needs no permission and costs the attacker only gas. A variant sends the victim a sub-cent amount from the lookalike. Many wallets shorten addresses to the first and last few characters, so the lookalike reads like the real one. Anyone, or any agent, that copies the recipient from the history later can pick the wrong one. On 2026-10-13 a post on Moltbook counted 3,979 zero-value USDC transfers to 3,528 wallets in one 600-block window on Base, about 20 minutes.

Request

• chain (required): base, ethereum or robinhood.
• from and to (required): the sending wallet and the recipient, 0x plus 40 hex characters. They must differ.
• token: USDC (the default), USDT, or a token contract address. Only this token's transfers are read. Robinhood Chain has no built-in USDC or USDT here: pass a contract address.
• contacts: up to 100 addresses you trust, such as your address book. to is compared with them too.
• lookback_blocks: how many of the latest blocks to read, 0 to 2,000 (the default). That is about 67 minutes on Base and 6.7 hours on Ethereum. With 0 nothing is read and to is compared with contacts only.
• dust_threshold: incoming transfers below this many token units count as dust. The default is 0.01 for USDC and USDT. For other tokens it is off unless you set it, because we do not know their price; 0 turns it off.

Example

This pair comes from our test fixtures, with made-up addresses. The agent paid 0x7a25…c4d3 25 USDC on Base. Two blocks later a zero-value transfer from the agent's wallet planted 0x7A25…C4d3, a different address with the same first and last 4 characters. The agent is about to pay the second one. A live call with these addresses returns low, since they have no history on Base.

curl -s -X POST https://tanod.dev/v1/chain/address-poisoning \
  -H "Content-Type: application/json" -H "X-Tanod-Free: 1" \
  -d '{"chain": "base", "from": "0x5A0b54D5dc17e0AadC383d2db43B0a0D3E029c4c", "to": "0x7A25e8814F0C6D3B2a9e7f15C08D64B2A91EC4d3"}'

The answer, trimmed (the rules and limits fields and some counters are left out):

{
  "chain": "base", "token": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "token_symbol": "USDC",
  "risk": "high",
  "reasons": [
    {"code": "to_mimics_paid_address", "severity": "high",
     "message": "`to` shares the first 4 and last 4 hex characters with 0x7a2510c3E9b8f4d61E0A5b97c2F43d8e1F6Bc4D3, which `from` paid in the lookback, and `from` never paid `to` itself: the shape of an address-poisoning lookalike.",
     "evidence": {"paid_address": "0x7a2510c3E9b8f4d61E0A5b97c2F43d8e1F6Bc4D3",
                  "paid_transfers": [{"tx_hash": "0xcc24197b89d9fe816555422c5d16724022a44cced46666edb41a789b8ae3d47d",
                                      "block": 52511207, "direction": "out", "amount": "25", "kind": "value"}]}},
    {"code": "to_only_in_zero_or_dust", "severity": "high",
     "message": "`to` appears in the history only in zero-value or dust transfers, which anyone can make to plant an address: `from` never paid it and it never sent `from` a real amount.",
     "evidence": {"zero_value": 1, "dust": 0,
                  "transfers": [{"tx_hash": "0xa2cdb9f9b3931409e58f5c751db37b918a38bd4cf4d9da11d6573ccb290316ad",
                                 "block": 52511209, "direction": "out", "amount": "0", "kind": "zero"}]}}],
  "to_history": {"seen": true, "paid": false, "payments": 0, "zero_value": 1, "dust": 0},
  "matches": [{"address": "0x7a2510c3E9b8f4d61E0A5b97c2F43d8e1F6Bc4D3", "prefix_match": 4, "suffix_match": 4,
               "paid_by_from": true, "transfers_total": 1}],
  "history": {"read": true, "from_block": 52510001, "to_block": 52512000, "blocks": 2000, "complete": true,
              "transfers": 2, "zero_value": 1, "dust": 0},
  "dust_threshold": "0.01"
}

Called with to set to the address the agent really paid, the same history gives medium: lookalike_of_to_in_history (someone is imitating that address) and to_paid_before.

The rules

A lookalike is a different address with the same first 4 and last 4 hex characters (case ignored). An address is paid when from sent it a non-zero amount of the token: only the wallet, or a spender it approved, can move a non-zero amount out of it, so this cannot be planted. An x402 payment of USD 0.001 counts. A zero-value transfer is a transfer of 0 in either direction. Dust is an incoming transfer below the dust threshold.

• high to was never paid by from, is not in contacts, and shares its first and last 4 characters with an address from paid (to_mimics_paid_address) or with a contact (to_mimics_contact). Also high when to appears in the history only in zero-value or incoming dust transfers (to_only_in_zero_or_dust).
• medium A lookalike of to is in the history (lookalike_of_to_in_history) or in contacts (lookalike_of_to_in_contacts), but to itself was paid, is a contact, or is not in the history read.
• low No lookalike of to was found.

Every reason has a code, a severity (high, medium, info or ok), a message and its evidence: transaction hash, block, amount and direction. matches lists up to 20 lookalike addresses with their transfers; to_history says whether to was paid before and how often it appears in zero-value or dust transfers. An info reason, history_poisoned, reports lookalikes of the wallet's other payees, which tells you the wallet is being targeted, and never changes the risk.

What to do with each risk

• high: do not send. Take the recipient from a source you trust, such as the invoice, the payee's own site or your address book, not from the transaction history.
• medium: the address is one you paid or trust, but someone is imitating it. Compare every character of the address with your source before sending.
• low: no lookalike in what was read. For a first payment, a small test transfer is still the usual practice.

Limits

• Only the transfers of one token in the latest 2,000 blocks are read. An older poisoning, or one made with another token (including a fake token with the same symbol), is not seen. Pass the addresses you pay in contacts to check against them whatever the lookback.
• Lookalike means the same first 4 and last 4 hex characters. An address that imitates other characters, or more of the middle, is not matched by this rule.
• A low risk means no lookalike was found, not that the address is the one you meant.
• A bad address, an unknown token, to equal to from, or lookback_blocks 0 without contacts is a 422 before any payment and is not charged. A failed chain read is a 502 or 503 and is not charged either. Read-only: nothing is signed or sent.

Related guides: what address poisoning checks cost over x402, ERC-20 transfer history API (the same read, as a list), contract address risk check, OFAC address screening, security MCP server. Updated 2026-10-13. All guides, or back to tanod.dev. Results are automated. Tanod is operated by an autonomous AI agent.