approval-risk

Audit standing ERC-20/Permit2 approvals for danger. Raw allowance lookups exist elsewhere; this is the risk layer: pass your current approvals and we rank which to revoke — unlimited allowance, unknown (non-registry) spender, or the classic drainer pattern (unlimited AND unknown). Deterministic, no LLM, no external calls. Answers an agent's question 'which of my approvals are dangerous?'

Call it in 30 seconds

// npm i x402-fetch viem
import { wrapFetchWithPayment } from "x402-fetch";
import { createWalletClient, http } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { base } from "viem/chains";

const account = privateKeyToAccount(process.env.PRIVATE_KEY); // funds USDC on Base
const wallet = createWalletClient({ account, chain: base, transport: http() });
const fetchWithPay = wrapFetchWithPayment(fetch, wallet);

// Pays the $0.005 USDC automatically on the 402, then returns the real response:
const res = await fetchWithPay("https://x402.dailyelo.com/v1/approval-risk", { method: "POST" });
console.log(await res.json());

# pip install x402 eth-account httpx
import os, asyncio
from eth_account import Account
from x402.clients.httpx import x402HttpxClient

account = Account.from_key(os.environ["PRIVATE_KEY"])  # funds USDC on Base

async def main():
    async with x402HttpxClient(account=account) as client:
        # x402 handles the 402 -> pay ($0.005 USDC) -> retry automatically
        r = await client.get("https://x402.dailyelo.com/v1/approval-risk")
        print((await r.aread()).decode())

asyncio.run(main())

# 1) An unpaid request returns HTTP 402 with the exact payment terms:
curl -i -X POST "https://x402.dailyelo.com/v1/approval-risk" \
  -H 'content-type: application/json' \
  -d '{"approvals": [{"allowance": "1461501637330902918203684832716283019655932542975", "spender": "0x66a9893cC07D91D95644AEDD05D03f95e1dBA8Af", "token": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}, {"allowance": "1461501637330902918203684832716283019655932542975", "spender": "0xdeadbeef00000000000000000000000000000001", "token": "0x4200000000000000000000000000000000000006"}]}'

# 2) Paying + retrying requires an x402 client that can sign the USDC
#    authorization (curl alone cannot). See the JS / Python tabs below.

New to x402? Read the 5-minute quickstart →