Contracts API
What a contract can do to a holder
Risk traits of a contract or spender address — what an approval to it would allow, and whether anything about it is flagged.
GET
/api/external/contract-analysis/contract-risk/{chain}/{address}Chains
- BNB Chain BNB
- Ethereum ETH
- Stable STABLE
- Base BASE
- Robinhood Chain RHC
Request
Send your key in the x-dex-data-key header. Replace each <placeholder> with a real value.
curl -H "x-dex-data-key: $DEXDATA_API_KEY" \ "https://api.dexdata.io/api/external/contract-analysis/contract-risk/BNB/<address>"
| Parameter | Description |
|---|---|
chainpath · string · required | ETH, BNB, BASE, STABLE and RHC; Solana and ARC both return 400. Solana, because contract approvals are an EVM concept and no wired source answers there. ARC, because the source itself rejects the chain outright (confirmed live) rather than simply not being asked yet. CELO, ARB, OP and SCROLL return 400 here. |
addresspath · string · required | The contract address being asked about — typically a spender requesting approval. |
Response fields
A JSON response. Every field is always present; null means the value could not be established, never zero.
| Field | Type | Description |
|---|---|---|
tag | string | null | The source's own classifier for this contract, e.g. "UniswapV2", "Pancakeswap". null when unclassified — which is common even for real, heavily-used spenders (Permit2 and the Aerodrome Router both read null here on every chain measured). |
trustList | boolean | null | true when this contract is on the source's own allowlist; null otherwise. Never `false`: the source's own documentation states that an unlisted address means "not included", not "checked and found untrustworthy" — measured live, Permit2 and the Aerodrome Router (genuine, heavily-used infrastructure) both read null here on every chain tried. null can mean either "nobody has vouched for this" or "not yet looked at" — those are indistinguishable in this field alone. |
doubtList | boolean | null | true when this contract is on the source's own denylist; null otherwise. Never `false`, same caveat as trustList. Demonstrated to fire correctly but not shown, in the sample this shipped against, to fire on organically-chosen addresses — read a true here as "flagged", not as a validated hit rate. Read maliciousBehavior alongside it for what specifically fired. |
maliciousBehavior | string[] | The source's own risk-signal names for this contract, e.g. financial_crime, stealing_attack, phishing_activities. Always an array, possibly empty; never null. |
isProxy | boolean | null | true/false when determinable, null when it could not be — observed on a non-contract address, where the source itself reports no answer rather than a real negative. |
contractScan | object | Five independent checks against this contract's bytecode. Unlike trustList/doubtList, this family CAN say "scanned, and clean": each leaf is true (present), false (scanned, genuinely clean), or null (never scanned) — a real three-way answer, not an absence standing in for a negative. |
contractScan.privilegeWithdraw | boolean | null | Whether a privileged address can withdraw funds it should not be able to. null means this contract has never been scanned for this check — never read null as "clean". |
contractScan.withdrawMissing | boolean | null | Whether a withdrawal function is missing where the contract's shape implies one should exist. null means not scanned, never "clean". |
contractScan.blacklist | boolean | null | Whether the contract can blacklist addresses from interacting with it. null means not scanned. |
contractScan.selfdestruct | boolean | null | Whether the contract can self-destruct. null means not scanned. |
contractScan.approvalAbuse | boolean | null | Whether the contract can abuse a granted approval beyond what was authorised. null means not scanned. |
Start building with DexData today
Sign in, create a key and make your first call in a minute. Free credits every month, and you only pay for calls that succeed.
Get a free API key