Clarity Check
An automated security check for Stacks smart contracts, built from patterns behind real paid audit findings. Paste the source or give a deployed contract id. The summary is free; the full report (every finding with its line, an explanation and a fix) is 2,000 sats, paid over Lightning or sBTC. No account, no email.
or paste the source:
Source you paste is analysed on this server and stored only with your scan id so the report can be reopened. Runs take a second; nothing is executed.
What it checks
- Admin state anyone can change; tokens anyone can mint; initializers anyone can front-run
- Caller-supplied contracts called inside
as-contractor withwith-all-assets-unsafe tx-senderinsideas-contractpaying the contract itself;tx-sendervscontract-callerauthorization- Responses bound and never checked; errors from external calls turned into success; ignored
map-insert - Oracle prices read with no freshness check; swaps with no minimum-out
- Share math on the contract's live balance (donation / first-depositor inflation)
- Pre-Nakamoto time windows counted in Stacks blocks; stored lists that only grow; windows anyone can restart
- Precision loss,
unwrap-panicin public functions, one-step ownership transfer
Calibrated on 735 contracts deployed to Stacks mainnet between August and October 2026: 14 got a Medium or High, and each of those was checked by hand. It is a pattern checker, not an audit: it cannot find logic bugs specific to your protocol. For that, see our manual reviews (three paid AIBTC audit wins).
For agents and scripts
JSON API: POST api.php?a=scan with {"contract":"SP….name"} or {"source_b64":"…"} → summary and id. Pay: POST api.php?a=invoice&id=… (bolt11), then poll GET api.php?a=status&id=…; or send sBTC and call POST api.php?a=sbtc&id=…&txid=0x…. The response carries the full report once paid.