Daily transfers, volume and coverage →
lock-smith-production.up.railway.app · lock-smith-production.up.railway.app · Crypto & Payments
Automated security checks for one x402 endpoint — not a penetration test. Eight non-destructive, unpaid probes: paywall presence, challenge sanity, garbage and forged (invalid-signature) payment rejection, exposure surface, error hygiene, body-size cap, discovery consistency. Returns SECURE / FINDIN
The payout address is also published by 47 other service(s); the volume cannot be attributed to one of them.
| Window | Observed | Transfers |
|---|---|---|
| Last complete day (2026-10-31) | — | — |
| Last 7 days | — | — |
| Last 30 days | — | — |
| Growth, 7d against the 7 before | not comparable | |
Daily history →. Observed transfers show value arriving at the payout address; they do not establish service revenue.
Receiving wallets are payment addresses published for this service. Sending wallets transferred funds to an exclusive receiving address; this alone does not prove a purchase or identify an agent.
| Network | Full wallet address | Evidence |
|---|---|---|
| Base | 0x097f9685d1e0752bf8b02d61e5ce9be7ea0fba7f | Shared address · activity cannot be assigned to this serviceFrom source record · source: x402_bazaar |
No sending wallet addresses have been retained for this service. Buyer wallets are unknown; daily totals and reported payer counts do not reveal their addresses.
Coverage includes retained scans only, not every historical transaction. Earlier daily totals cannot recover sender addresses. Sender lists exclude shared receiving wallets, whose transfers could belong to another service. A provider address does not establish wallet ownership.
Sorted by source-measured calls, not by our opinion. The right-hand figure is observed inflow, which stays empty for peers whose address is shared.
| With a measured call count | 26,541 (85.4 %) |
|---|---|
| With a published price | 28,857 (92.9 %) |
| With attributable inflows | 297 (1.0 %) |
| Observed inflows · 30d | $626,743.28 |
| Median measured calls | 2 |
| Median price per call | $0.01 |
API recommendation and x402 discovery for your task. Required query: need. Which API should I call? Recommends which x402 API to use for any task, with evidence. Describe a task in plain words. Compare up to five paid AP...
Payment quote with amount, asset, and merchant wallet
OpenAI-compatible chat completions across the Venice AI model catalog. Pay per request in USDC on Base via x402, with no account and no API key. Overpayment is never lost: it banks as reusable wallet credit for your next...
One HTTP request per host, matched against an in-house signature set. Every hit carries a confidence value from 0 to 100 and the evidence it rests on: response header, asset path, cookie name, meta generator, DNS or ASN...
Chosen by category and by whether we have measured them, not by who pays us. A sponsored placement in this list is labelled as such.
| Network | Scheme | Amount | Asset |
|---|---|---|---|
| Base | exact | 0.5 | USDC |
“exact” is the price per call. “upto” is a ceiling the client sets, not a price. Atomic amount 500000 = 0.5 USDC per call on Base.
endpoint
https://lock-smith-production.up.railway.app/v1/audit
{
"body": {
"endpoint_url": "https://token-verdict-production.up.railway.app/v1/verdict",
"mode": "compact"
},
"bodyType": "json",
"method": "POST",
"type": "http"
}
{
"example": {
"audit_version": "1.0",
"checks": [
{
"detail": "Unpaid request drew 402.",
"id": "paywall_present",
"name": "Paywall present",
"status": "pass"
},
{
"detail": "Terms complete, consistent.",
"id": "challenge_sanity",
"name": "Challenge sanity",
"status": "pass"
},
{
"detail": "Junk rejected.",
"id": "garbage_payment",
"name": "Garbage payment rejected",
"status": "pass"
},
{
"detail": "Forged rejected.",
"id": "forged_payment",
"name": "Forged payment rejected",
"status": "pass"
},
{
"detail": "Nothing sensitive exposed.",
"id": "exposure_surface",
"name": "Exposure surface",
"status": "pass"
},
{
"detail": "Clean errors only.",
"id": "error_hygiene",
"name": "Error hygiene",
"status": "pass"
},
{
"detail": "Oversized body refused.",
"id": "body_cap",
"name": "Body-cap sanity",
"status": "pass"
},
{
"detail": "Discovery matches terms.",
"id": "discovery_consistency",
"name": "Discovery consistency",
"status": "pass"
}
],
"mode": "compact",
"ok": true,
"probes_used": 14,
"scope_note": "Automated security checks, not a penetration test.",
"service": "lock-smith",
"summary": {
"findings": 0,
"not_tested": 0,
"passed": 8,
"worst_severity": null
},
"target": "https://token-verdict-production.up.railway.app/v1/verdict",
"terms_observed": {
"amount_units": "20000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"network": "eip155:8453",
"pay_to": "0x097f9685D1e0752bF8B02d61E5Ce9be7eA0FBA7F",
"price": "$0.02"
},
"verdict": "SECURE"
},
"schema": {
"properties": {
"audit_version": {
"type": "string"
},
"checks": {
"items": {
"properties": {
"detail": {
"type": "string"
},
"fix": {
"type": "string"
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"status": {
"enum": [
"pass",
"finding",
"not_tested"
],
"type": "string"
}
},
"required": [
"id",
"name",
"status",
"detail"
],
"type": "object"
},
"type": "array"
},
"mode": {
"enum": [
"full",
"compact"
],
"type": "string"
},
"ok": {
"type": "boolean"
},
"probes_used": {
"type": "integer"
},
"scope_note": {
"type": "string"
},
"service": {
"type": "string"
},
"summary": {
"properties": {
"findings": {
"type": "integer"
},
"not_tested": {
"type": "integer"
},
"passed": {
"type": "integer"
},
"worst_severity": {
"type": [
"string",
"null"
]
}
},
"type": "object"
},
"target": {
"type": "string"
},
"terms_observed": {
"properties": {
"amount_units": {
"type": [
"string",
"null"
]
},
"asset": {
"type": [
"string",
"null"
]
},
"network": {
"type": [
"string",
"null"
]
},
"pay_to": {
"type": [
"string",
"null"
]
},
"price": {
"type": [
"string",
"null"
]
}
},
"type": "object"
},
"verdict": {
"enum": [
"SECURE",
"FINDINGS",
"EXPOSED"
],
"type": "string"
}
},
"required": [
"ok",
"service",
"audit_version",
"target",
"verdict",
"summary",
"terms_observed",
"checks",
"probes_used",
"scope_note"
],
"type": "object"
},
"type": "json"
}
Examples are the provider's own, not a call we made.
The payout address is shared with 47 other service(s). That is normal for facilitator and platform addresses, and it is why this profile shows no inflow figure. The volume exists — it just cannot be split without inventing a rule.
How attribution works →297 of 31,075 services (1.0%) in Crypto & Payments have attributable inflows; 26,541 have a source-measured call count. Median measured calls: 2.
Rank this category by observed inflows →Automated security checks for one x402 endpoint — not a penetration test. Eight non-destructive, unpaid probes: paywall presence, challenge sanity, garbage and forged (invalid-signature) payment rejection, exposure surface, error hygiene, body-size cap, discovery consistency. Returns SECURE / FINDINGS / EXPOSED with a fix note per finding. Use this when you operate an x402 route and want its locks checked the way an attacker would rattle them.
Quoted from x402 Bazaar · source record · read 2026-10-31
Attribution blocked
· confidence low
The payout address is also published by 47 other service(s); the volume cannot be attributed to one of them.
Why revenue is “unknown”. A revenue figure needs a receipt: an amount a buyer actually paid for this service. We hold none for this entry, and we hold no funds at all. What we have instead is an activity value of $0.50 — the source's call count multiplied by the published price. That is what the list price implies, not what anyone paid. The payout address is also published by 47 other service(s); the volume cannot be attributed to one of them.
No daily history has been archived for this service yet. Open the full daily history →
A payment rail is where the provider asks to be paid. It is not proof that anything was paid through it.
One row per statement. “Verified” means we checked it ourselves and the finding is quoted. “Provider claim” means we read it in the provider's own record. “Not found” is a statement about our search, not proof of absence.
| Statement | Status | What we found | Source | Checked |
|---|---|---|---|---|
| Endpoint | Provider claim |
https://lock-smith-production.up.railway.app/v1/audit
EvidenceAls Resource-URL im Bazaar-Eintrag geführt. |
api.cdp.coinbase.com | 2026-10-31 |
| Input output | Provider claim |
Request/response examples published with the listing
EvidenceBeispiel-Ein- und -Ausgabe stammen aus dem Bazaar-Eintrag des Anbieters. |
api.cdp.coinbase.com | 2026-10-31 |
| Payment | Provider claim |
1 rail: Base · payee 0x097f9685D1e0752bF8B02d61E5Ce9be7eA0FBA7F
EvidenceAus den `accepts`-Einträgen: Netzwerk, Asset, Empfängeradresse und Betrag. Die Adresse ist die Grundlage der späteren On-Chain-Zuordnung; sie ist noch nicht durch eine eigene 402-Antwort bestätigt. |
api.cdp.coinbase.com | 2026-10-31 |
| Pricing | Provider claim |
0.5 USDC per call
EvidenceAtomic amount 500000 = 0.5 USDC per call on Base. Netzwerk: Base. |
api.cdp.coinbase.com | 2026-10-31 |
| Protocol | Provider claim |
x402 (HTTP 402 payment challenge)
EvidenceIm x402 Bazaar als zahlungspflichtige HTTP-Ressource gelistet (x402Version 2, Typ http). |
api.cdp.coinbase.com | 2026-10-31 |
| Provider | Provider claim |
lock-smith-production.up.railway.app
EvidenceDie Ressource wird unter diesem Host im x402 Bazaar geführt; die Angaben stammen vom Anbieter. |
api.cdp.coinbase.com | 2026-10-31 |
| Usage | Verified |
1 calls / 1 unique payers in the last 30 days
EvidenceSource-reported usage from Coinbase x402 Bazaar, read on 2026-10-31. Letzter Aufruf laut Quelle: 2026-10-29T11:51:24.887Z. Aufrufe sind kein Umsatz. |
api.cdp.coinbase.com | 2026-10-31 |
We have not called this endpoint yet. Until we do, everything above is what the source published — no more.