We run two smart-contract audit endpoints on minia2a, both payable per call in USDC over
x402 — no signup, no API key, no checkout flow. An agent (or a
human with a wallet) sends a request, gets back a 402 Payment Required challenge with
the price, pays in USDC, retries, and receives the report. Both endpoints are live now — run either
one before you launch, on testnet or pre-launch code.
| Static scan | AI deep audit | |
|---|---|---|
| Endpoint | x402-smart-contract-audit | x402-ai-audit |
| Price | $2.00 / call | $20.00 / call |
| What it checks | 10 deterministic patterns | Solidity / Rust / Move, sampled 3×, deduplicated |
| Nature | Fast pre-check, deterministic | Probabilistic — business-logic, economic, cross-contract flaws |
The static scan is a mechanical first pass: reentrancy, access-control, integer overflow,
unvalidated external call, tx.origin auth, delegatecall,
selfdestruct, block.timestamp manipulation, assert misuse,
and owner-change. Deterministic — the same code gives the same result every run.
The AI audit goes further: it reads for uninitialized owners, account confusion, missing signer authorization, and economic/business-logic flaws that a pattern list can't catch. It samples three times and deduplicates findings to cut down on false positives.
Neither of these is a substitute for a human audit firm. The static scan only sees the patterns it's been told to look for. The AI audit is probabilistic: it can miss a real vulnerability, and it can report a non-issue as a finding. Treat it as a first line of defense and a triage tool — something you run before you spend five figures on a manual audit, not instead of one. Any critical finding still needs a human to verify it.
That's the point, actually. A pre-launch project shouldn't discover reentrancy or a missing
onlyOwner from a manual audit firm at $40k — it should catch those in a $2 mechanical
scan on day one. The AI pass is for the subtler stuff: the economic bug in the fee math, the
cross-contract assumption that breaks under reorg, the owner left uninitialized because the
constructor is payable.
If you're building on Base and about to launch a contract — a DeFi module, a launchpad, a token, a payment rail — run your code through either (or both) endpoints first. A $2 scan catches the mechanical issues on day one; the $20 AI pass goes after the subtler economic and cross-contract flaws before they reach mainnet.
If you're willing to share honest feedback on what the report caught and what it missed, we'd love to hear it — it makes the endpoints better for everyone. The audit report is yours either way.
The endpoints are live now. A request to either URL returns a 402 with the exact amount and a
payTo address on Base (and an Algorand path). Pay in USDC, retry with the proof, and
the report comes back in the response.
# static scan — $2.00
curl -i https://minia2a.uk/x402/x402-smart-contract-audit \
-X POST -H 'content-type: application/json' \
-d '{"code":""}'
# AI deep audit — $20.00
curl -i https://minia2a.uk/x402/x402-ai-audit \
-X POST -H 'content-type: application/json' \
-d '{"code":"","language":"solidity"}' If you want to talk through the report before paying, email [email protected] — mention "Base audit" and we'll take it from there. See the audit landing page for the two tiers.
One request: don't send unaudited mainnet code you can't lose. Send testnet or pre-launch code, so a finding costs you a fix, not a drained pool.