One HTTPS call scores any Ethereum-mainnet contract from its bytecode in ~1 ms — including the ~95% that ships unverified, where source-based scanners can't even start. Returns an attack-surface / complexity score, a review-priority verdict, proxy resolution and per-contract drivers — no source code, no symbolic execution, no LLM. Built on the model from the ICICPE 2026 paper: a served tree model (RandomForest / XGBoost, statistically indistinguishable) that reproduces Slither's contract-level any-finding label with F1 ≈ 0.92–0.95 (CI 0.918–0.948) on 11,670 held-out Slither-labelled contracts. That number is agreement with Slither on a verified corpus, not measured accuracy on the unverified domain it scores — expect distribution shift. Attack-surface triage, not a vulnerability detector — integrate it; don't email us a CSV.
Sign in at /dashboard → API keys → Generate key. Then:
# score one contract curl -X POST https://revert.pro/api/v1/scan \ -H "Authorization: Bearer rvt_live_xxx" \ -H "Content-Type: application/json" \ -d '{"address":"0xdac17f958d2ee523a2206206994597c13d831ec7"}'
import requests
r = requests.post(
"https://revert.pro/api/v1/scan",
headers={"Authorization": "Bearer rvt_live_xxx"},
json={"address": "0xdAC17F958D2ee523a2206206994597C13D831ec7"},
)
d = r.json()
print(d["verdict"], d["vuln_score"]) # low-risk 0.0001
const r = await fetch("https://revert.pro/api/v1/scan", { method: "POST", headers: { "Authorization": "Bearer rvt_live_xxx", "Content-Type": "application/json" }, body: JSON.stringify({ address: "0xdAC17F958D2ee523a2206206994597C13D831ec7" }), }); const d = await r.json(); console.log(d.verdict, d.vuln_score);
| Field | In | Notes |
|---|---|---|
| address | body | 0x-prefixed 20-byte contract address (required) |
| chain | body | "eth" (default). Model trained + validated on Ethereum mainnet. |
{
"address": "0xdac17f9…831ec7",
"vuln_score": 0.0001, // 0–1 risk-surface score
"verdict": "low-risk", // low-risk | medium-risk | high-risk | unscannable
"proxy": { "is_proxy": false },
"feature_contributions": [ /* per-contract TreeSHAP drivers */ ],
"model_version": "xgb-2025-12-28",
"latency_ms": 86,
"quota": { "tier": "free", "limit": 100, "used": 7 }
}
The API-native bulk scan. Send an array of addresses — one request scores them all and returns them ranked (high-surface first). This is the professional replacement for a 1,000-contract pre-audit triage: page your set, call the endpoint, wire the output straight into your queue. Or score every new / unverified contract you encounter on-chain in real time — fleet-scale screening for MEV and monitoring desks. It ranks attack-surface; it does not confirm exploitability.
curl -X POST https://revert.pro/api/v1/batch \ -H "Authorization: Bearer rvt_live_xxx" \ -H "Content-Type: application/json" \ -d '{"addresses":["0xdac17f95…","0x6b175474…","0xa0b86991…"]}'
Scanning a fleet? Loop the endpoint 25 at a time — the model scores each contract in ~1 ms, so a 1,000-contract backlog is ~40 calls (throughput is bounded mainly by the on-chain bytecode fetch, which runs concurrently). That's the "fleet-scale" — pagination, not a single giant call.
for (const page of chunk(addresses, 25)) await fetch("/api/v1/batch", { method: "POST", headers, body: JSON.stringify({ addresses: page }) });
{
"count": 3, "chain": "eth",
"results": [
{ "address": "0xa0b86991…", "verdict": "high-risk", "vuln_score": 0.972, "proxy": { "is_proxy": true } },
{ "address": "0xdac17f95…", "verdict": "low-risk", "vuln_score": 0.000 },
{ "address": "0x6b175474…", "verdict": "low-risk", "vuln_score": 0.002 }
],
"quota": { "tier": "free", "limit": 100, "used": 10 }
}
Generate, list and revoke your keys from the dashboard — self-serve, no email. The full key is shown once and stored only as a hash.
| Topic | Detail |
|---|---|
| Auth | Authorization: Bearer rvt_live_… (or X-API-Key). Anonymous demo calls are allowed for trying it out, rate-limited per IP and capped at 3 addresses per batch. |
| Quota | Per-key, per calendar month, by tier. Each batch call counts the number of addresses. |
| 429 | monthly_quota_exceeded — upgrade tier or wait for the month to roll over. |
| 413 | batch_too_large — max 25 per call (3 anonymous). |
| 401 | invalid_api_key — key missing, malformed, or revoked. |
low-risk < 0.30 · medium-risk 0.30–0.85 · high-risk ≥ 0.85 — the API returns medium-risk for the middle band; the dashboard labels it elevated. Full semantics: /methodology.
Source-based scanners can't open unverified bytecode at all; deep analyzers and scam-scanners do different jobs. REVERT owns one column: instant attack-surface / complexity triage on the unverified ~95%.
| Capability | REVERT | Slither / Aderyn (source-static) | Mythril (symbolic) | GoPlus / honeypot.is (scam scanners) | Dedaub (deep suite) |
|---|---|---|---|---|---|
| Unverified bytecode (no source) | ✅ core job | ❌ needs source | ✅ | ✅ | ✅ |
| Speed at scale | ✅ ~1 ms/contract, fleet-wide | seconds, per-project | ~30 s–hours | seconds (API) | minutes/contract |
| Scope | attack-surface / complexity (Slither-correlated) | general vuln, exact | exploit paths | scam / honeypot only | deep threat + reuse |
| Output | risk score + per-contract SHAP | line-level findings | exploit input | behavioral flags | severity alerts |
| Confirms a real bug | ❌ priority signal, not proof | ✅ exact | ✅ SMT-proven | ⚠ behavioral | ✅ |
| Price | free tier · $79 / $399 | free / OSS | free / OSS (MythX retired) | freemium API | enterprise |
Honest read: on a single contract with source, Slither/Aderyn win; on confirmed exploitability, Mythril/Dedaub win; on "is this token a scam", GoPlus wins. REVERT wins the column none of them fill — instant attack-surface / complexity triage across the unverified population, calibrated to track Slither's signal on verified contracts. Complement, not replacement.
A scan = one address scored. Batch calls count each address; proxy resolution that also scores the implementation counts as 2.
Free-tier keys are self-serve. For Pro/Team, pay in USDC — activated by hand within hours, no card. Self-serve metered checkout comes later.
429 monthly_quota_exceeded. It's a soft cap: no surprise overage charges — calls are paused until the next calendar-month rollover, or upgrade your tier to lift it immediately.Generate a key, make your first call in under a minute.