WATTCOIN API SPEC: v1 (f1f4c9b) SOLANA TOKEN-2022 MINT: Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump LIVE TEMPLATES: 11 LIVE AGENTS (FREE + $19–$49 SOL)
wattcoin.org ↗ llms.txt ↗ Launch Free Bot ↗
Install Free Utility →
● AVAILABLE NOW · $29 in SOL (ONE-TIME · 3 REBINDS)

EVM Smart Contract & Proxy Inspector — Know who can upgrade the contract before you deposit.

Inspect any Ethereum, Base, or Arbitrum contract before you deposit or integrate: resolve EIP-1967, EIP-1822 UUPS, EIP-1167 clone, and ZeppelinOS legacy proxy storage slots in one batch, trace who actually controls upgrades (Safe M/N threshold & owners, TimelockController delay, ProxyAdmin, or a single EOA), check Sourcify v2 source verification, and scan runtime bytecode for SELFDESTRUCT and DELEGATECALL.

SKU: evm-contract-inspector · Skills: evm-contract-inspector-setup + evm-contract-inspector · Tested: 779 lines stdlib Python, 55 unit tests

⚡ Works in Grok Bot + Cursor + Claude Code + Any Terminal (Zero-Dep Python 3 CLI Included)
See Real Sample Output View in Homepage Catalog

What It Does

  • Batched JSON-RPC slot resolution across Ethereum (eth, 1), Base (base, 8453), and Arbitrum One (arb, 42161): EIP-1967 (implementation, admin, beacon), EIP-1822 UUPS, ZeppelinOS legacy (0x7050c9e0... / 0x10d6a54a...), and EIP-1167 minimal proxy clones.
  • Governance & controller chain probing (--deep, --max-depth 2): classifies Safe multisigs (getThreshold() / getOwners()), Timelocks (getMinDelay() / delay()), ProxyAdmin contracts, or single-key EOAs (EOA_ADMIN).
  • Source verification via Sourcify v2 (fields=abi,proxyResolution,compilation) with Blockscout v2 fallback, plus CBOR-stripped opcode scanning that skips PUSH1..PUSH32 immediate bytes before flagging SELFDESTRUCT (0xff) or unexpected DELEGATECALL (0xf4).
  • Stateful delta monitor (--state PATH --delta): emits EVENT / NEW / CHANGED / RESOLVED diffs whenever an implementation address, proxy admin, Safe threshold, or timelock delay changes. 100% Python stdlib, 55 unit tests.

Live output (Ethereum Mainnet: Circle FiatTokenProxy USDC + Compound III cUSDCv3)

Sample disclosure: this is a representative sample, not a customer report. It was produced against public or fictional test targets; wallet, account and credential values are placeholders or redacted (for example wck_<REDACTED>), and no private keys, seed phrases or secrets are ever shown. Your own report will differ in content and length.

snapshot   2026-10-27 07:52:48 UTC | tool=evm-contract-inspector
endpoints  https://ethereum-rpc.publicnode.com

target    eth:0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48
bytecode  2186 bytes  keccak=0xd80d4b7c890cb9d6a4893e6b52bc34b56b25335cb13716e0d1d31383e6b41505
proxy     ZeppelinOS legacy
impl      0x43506849d7c04f9138d1a2050bbf3a0c054402dd (23464 bytes, verified=yes)
admin     0x807a96288a1a408dbc13de2b1d087d10356395d2 [EOA]
impl.own  0xfcb19e6a322b27c06842a71e8c725399f049ae3a [EOA]
sourcify  verified (match)  name=FiatTokenProxy
opcodes   target: SELFDESTRUCT=no DELEGATECALL=yes | impl: SELFDESTRUCT=no DELEGATECALL=yes

target    eth:0xc3d688b66703497daa19211eedff47f25384cdc3
bytecode  1878 bytes  keccak=0x64952234eab8f3aed74355c49119f627965640b1efeb6b28430b5a31b0d3b192
proxy     EIP-1967
impl      0x63e749153baf1838f63ca22c275370bd2b1ceb15 (18599 bytes, verified=yes)
admin     0x1ec63b5883c3481134fd50d5daebc83ecd2e8779 [contract] -> owner 0x6d903f6003cca6255d85cca4d3b5e5146dc33925 [Timelock delay=172800s]
sourcify  verified (exact_match)  name=TransparentUpgradeableProxy
opcodes   target: SELFDESTRUCT=no DELEGATECALL=yes | impl: SELFDESTRUCT=no DELEGATECALL=yes

findings
  [HIGH    ] EOA_ADMIN: impl_owner 0xfcb19e6a322b27c06842a71e8c725399f049ae3a is a single EOA: one key controls upgrades/administration (custody such as HSM/MPC is not visible on-chain)
  [HIGH    ] EOA_ADMIN: proxy_admin 0x807a96288a1a408dbc13de2b1d087d10356395d2 is a single EOA: one key controls upgrades/administration (custody such as HSM/MPC is not visible on-chain)
  [MEDIUM  ] IMPL_HAS_DELEGATECALL: implementation 0x43506849d7c04f9138d1a2050bbf3a0c054402dd contains DELEGATECALL (heuristic)
  [MEDIUM  ] IMPL_HAS_DELEGATECALL: implementation 0x63e749153baf1838f63ca22c275370bd2b1ceb15 contains DELEGATECALL (heuristic)
  [INFO    ] PROXY_DELEGATECALL: DELEGATECALL in proxy code (expected for a proxy)
  [INFO    ] PROXY_DELEGATECALL: DELEGATECALL in proxy code (expected for a proxy)
  [INFO    ] TIMELOCK_ADMIN: proxy_admin.owner 0x6d903f6003cca6255d85cca4d3b5e5146dc33925 is a timelock with 172800 s delay

exit_code 2
SCOPE_NOTE: Read-only on-chain and public-API inspection. No private keys, seed phrases or signing; no transaction is built or broadcast. Findings are heuristics with stated evidence, not verdicts, and are not tax, legal or investment advice. An EOA admin is not proof of weak custody (HSM/MPC keys look identical on-chain). Opcode scans are byte-level heuristics.

What It Does Not Do

  • Strictly read-only: never asks for private keys or seed phrases, and never builds, signs, or broadcasts transactions.
  • Never labels a contract 'safe', 'audited', or 'rug-proof'; an EOA admin is not proof of weak custody (HSM/MPC keys look identical on-chain).
  • Opcode scans are byte-level heuristics, not formal verification or a substitute for a source audit.

Licensing & Setup

One-time license, up to 3 workspace-reset rebinds. On Turn 1 the evm-contract-inspector-setup skill verifies your agent key, binds your wcl_... code through the read-only license helper, and confirms the bot files are installed. The license code is never printed in chat.

One wcl_... key, two runtimes. Your license key works inside Grok Bot and from any local terminal or IDE agent (Cursor, Claude Code, Windsurf, CI/CD) via the standalone single-file Python 3 CLI (standalone /runtime/<script>.py CLI) — Python 3.10+ standard library only, zero pip install dependencies, with --json / --markdown output.

Frequently Asked Questions — EVM Smart Contract & Proxy Inspector

How do I check if an Ethereum, Base, or Arbitrum contract is an upgradeable proxy with an EOA admin?
Pass the contract address and chain (eth, base, or arb) to the inspector. It batches JSON-RPC reads of the EIP-1967, EIP-1822 UUPS, EIP-1167 and ZeppelinOS storage slots, then with --deep follows the admin or owner chain up to --max-depth 2. If the upgrade controller is a plain externally owned account it reports EOA_ADMIN; Safe multisigs (threshold and owners), TimelockControllers (minimum delay) and ProxyAdmin contracts are classified separately. An EOA admin is a fact about the chain, not proof of weak custody, because HSM or MPC keys look identical on-chain.
How does the inspector check EIP-1967, Beacon, and ZeppelinOS proxy slots and Sourcify v2 source verification?
It reads the EIP-1967 implementation, admin and beacon slots, the EIP-1822 proxiable slot, the legacy ZeppelinOS slots (0x7050c9e0... and 0x10d6a54a...) and EIP-1167 minimal-proxy bytecode in one batched call. Source verification comes from Sourcify v2 (fields=abi,proxyResolution,compilation) with a Blockscout v2 fallback, and runtime bytecode is scanned with CBOR metadata stripped and PUSH immediates skipped before flagging SELFDESTRUCT (0xff) or unexpected DELEGATECALL (0xf4).
Do I need an Etherscan API key or wallet connection to inspect an EVM smart contract?
No. The inspector is read-only and needs no wallet connection and no Etherscan key. It talks to public JSON-RPC endpoints for Ethereum, Base and Arbitrum One plus the public Sourcify and Blockscout APIs. Your only credential is the wcl_... license code, which is bound once through the read-only license helper and never printed in chat.
What safety and refusal boundaries does the EVM Smart Contract & Proxy Inspector enforce?
It is strictly read-only: it never asks for private keys or seed phrases and never builds, signs or broadcasts a transaction. It never labels a contract 'safe', 'audited' or 'rug-proof', and its opcode scans are byte-level heuristics, not formal verification or a substitute for a source audit. Output is factual and is not financial or security-certification advice.