Weakspot
💵 from $1 · paid in MAGIC on Base

A real smart contract audit.
Priced by the file.

Weakspot reviews your Solidity and Rust/Anchor contracts for reentrancy, access-control, and arithmetic bugs — then checks every finding against your actual code before it reaches the report. Connect a wallet, pay on-chain, get findings. No accounts, no invoices.

The procedure

I.

Connect your wallet and sign in.

II.

Upload your contracts and pay in MAGIC on Base.

III.

Get a findings report with severity, location, and fixes.

Commission your audit

Connect an Ethereum wallet to commission an audit — no account needed.

▸ example finding

critical

Reentrancy in withdraw() allows vault drainage

External call to msg.sender happens before the balance is zeroed — a malicious contract can re-enter and drain the vault.

Vault.sol:20 · source: LLM review · verified

Questions people ask

How much does a smart contract audit cost?

A traditional firm-led audit runs from $10,000 to $100,000 and takes weeks. Weakspot charges $1 per 10 source files and returns a report in minutes. It is not a replacement for a firm audit before a large mainnet launch — it is the check you run continuously in between.

Which languages does Weakspot audit?

Solidity for EVM chains, and Rust — including Anchor programs on Solana. Solidity projects are additionally run through Slither and Mythril; Rust projects through cargo clippy and cargo-audit, with those results fed into the review rather than pasted into the report raw.

Do AI smart contract auditors produce false positives?

Most do, heavily — an LLM asked to find bugs will always find some, real or not. Weakspot runs a second adversarial pass that re-reads every candidate finding against the code it cites and discards what does not hold up. On one internal test run this took 48 raw findings down to 7. You can switch the pass off for a faster, noisier first look.

Can an AI agent commission an audit programmatically?

Yes. Weakspot exposes an x402 machine-payable HTTP API — an agent pays in USDC on Base and gets the audit back, with no account, API key, or wallet-connect flow. Payment is the authentication. See the endpoint reference below.

🤖 For agents & their operators

AI agents can commission audits directly over HTTP using the x402 protocol — no wallet connect, no session, payment is the request. Full spec: /skill.md.

POST /api/agent/audit          # 1-10 files, $1 USDC
POST /api/agent/audit/tier2    # 11-20 files, $2 USDC
POST /api/agent/audit/tier3    # 21-30 files, $3 USDC
POST /api/agent/audit/tier4    # 31-40 files, $4 USDC
GET  /api/agent/audit/:jobId   # poll status, no auth needed

curl -X POST https://<host>/api/agent/audit \
  -H "Content-Type: application/json" \
  -d '{"description":"...","files":[{"path":"Token.sol","content":"..."}]}'

# -> 402 Payment Required, with x402 payment requirements in the
#    PAYMENT-REQUIRED header. Resubmit with a signed payment
#    authorization (EIP-3009) to get a jobId back.