// rest api · bytecode-only · ethereum mainnet

Risk-score any contract — even the unverified 95%.

One HTTPS call scores any Ethereum-mainnet contract from its bytecode in ~1 ms — including the ~95% that ships unverified, where source-based scanners can't even start. Returns an attack-surface / complexity score, a review-priority verdict, proxy resolution and per-contract drivers — no source code, no symbolic execution, no LLM. Built on the model from the ICICPE 2026 paper: a served tree model (RandomForest / XGBoost, statistically indistinguishable) that reproduces Slither's contract-level any-finding label with F1 ≈ 0.92–0.95 (CI 0.918–0.948) on 11,670 held-out Slither-labelled contracts. That number is agreement with Slither on a verified corpus, not measured accuracy on the unverified domain it scores — expect distribution shift. Attack-surface triage, not a vulnerability detector — integrate it; don't email us a CSV.

Get your API key → free tier · 100 scans/mo · no card

01Quickstart

Sign in at /dashboardAPI keysGenerate key. Then:

# score one contract
curl -X POST https://revert.pro/api/v1/scan \
  -H "Authorization: Bearer rvt_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"address":"0xdac17f958d2ee523a2206206994597c13d831ec7"}'
Python
import requests
r = requests.post(
    "https://revert.pro/api/v1/scan",
    headers={"Authorization": "Bearer rvt_live_xxx"},
    json={"address": "0xdAC17F958D2ee523a2206206994597C13D831ec7"},
)
d = r.json()
print(d["verdict"], d["vuln_score"])  # low-risk 0.0001
JavaScript
const r = await fetch("https://revert.pro/api/v1/scan", {
  method: "POST",
  headers: { "Authorization": "Bearer rvt_live_xxx", "Content-Type": "application/json" },
  body: JSON.stringify({ address: "0xdAC17F958D2ee523a2206206994597C13D831ec7" }),
});
const d = await r.json();
console.log(d.verdict, d.vuln_score);

02Endpoints

POST/api/v1/scanscore one contract
FieldInNotes
addressbody0x-prefixed 20-byte contract address (required)
chainbody"eth" (default). Model trained + validated on Ethereum mainnet.
200 response
{
  "address": "0xdac17f9…831ec7",
  "vuln_score": 0.0001,            // 0–1 risk-surface score
  "verdict": "low-risk",         // low-risk | medium-risk | high-risk | unscannable
  "proxy": { "is_proxy": false },
  "feature_contributions": [ /* per-contract TreeSHAP drivers */ ],
  "model_version": "xgb-2025-12-28",
  "latency_ms": 86,
  "quota": { "tier": "free", "limit": 100, "used": 7 }
}
POST/api/v1/batchscore up to 25 in one call

The API-native bulk scan. Send an array of addresses — one request scores them all and returns them ranked (high-surface first). This is the professional replacement for a 1,000-contract pre-audit triage: page your set, call the endpoint, wire the output straight into your queue. Or score every new / unverified contract you encounter on-chain in real time — fleet-scale screening for MEV and monitoring desks. It ranks attack-surface; it does not confirm exploitability.

curl -X POST https://revert.pro/api/v1/batch \
  -H "Authorization: Bearer rvt_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"addresses":["0xdac17f95…","0x6b175474…","0xa0b86991…"]}'

Scanning a fleet? Loop the endpoint 25 at a time — the model scores each contract in ~1 ms, so a 1,000-contract backlog is ~40 calls (throughput is bounded mainly by the on-chain bytecode fetch, which runs concurrently). That's the "fleet-scale" — pagination, not a single giant call.

for (const page of chunk(addresses, 25))
  await fetch("/api/v1/batch", { method: "POST", headers, body: JSON.stringify({ addresses: page }) });
200 response — ranked
{
  "count": 3, "chain": "eth",
  "results": [
    { "address": "0xa0b86991…", "verdict": "high-risk", "vuln_score": 0.972, "proxy": { "is_proxy": true } },
    { "address": "0xdac17f95…", "verdict": "low-risk",  "vuln_score": 0.000 },
    { "address": "0x6b175474…", "verdict": "low-risk",  "vuln_score": 0.002 }
  ],
  "quota": { "tier": "free", "limit": 100, "used": 10 }
}
POST/api/keysmanage keys (signed-in)

Generate, list and revoke your keys from the dashboard — self-serve, no email. The full key is shown once and stored only as a hash.

03Auth, rate limits & errors

TopicDetail
AuthAuthorization: Bearer rvt_live_… (or X-API-Key). Anonymous demo calls are allowed for trying it out, rate-limited per IP and capped at 3 addresses per batch.
QuotaPer-key, per calendar month, by tier. Each batch call counts the number of addresses.
429monthly_quota_exceeded — upgrade tier or wait for the month to roll over.
413batch_too_large — max 25 per call (3 anonymous).
401invalid_api_key — key missing, malformed, or revoked.

04What the score means

triage, not an audit A high verdict is a review-priority signal, NOT a confirmed vulnerability — the bytecode matches risky patterns, but complex audited infra (DEX routers, aggregators) scores high too. A low verdict means "no known pattern fired", never proof of safety (low != safe). unscannable = no runtime bytecode (EOA / destroyed), not a safety signal. REVERT is an attack-surface / complexity triage that ranks contracts by how much there is to review — calibrated to track Slither's contract-level any-finding signal — to reorder a review queue — use it alongside Slither/Mythril, never instead of them. The API ranks where a human should look; the verdict stays with the human. Bands: low-risk < 0.30 · medium-risk 0.30–0.85 · high-risk ≥ 0.85 — the API returns medium-risk for the middle band; the dashboard labels it elevated. Full semantics: /methodology.

05How REVERT compares

Source-based scanners can't open unverified bytecode at all; deep analyzers and scam-scanners do different jobs. REVERT owns one column: instant attack-surface / complexity triage on the unverified ~95%.

CapabilityREVERTSlither / Aderyn
(source-static)
Mythril
(symbolic)
GoPlus / honeypot.is
(scam scanners)
Dedaub
(deep suite)
Unverified bytecode (no source)✅ core job❌ needs source
Speed at scale✅ ~1 ms/contract, fleet-wideseconds, per-project~30 s–hoursseconds (API)minutes/contract
Scopeattack-surface / complexity (Slither-correlated)general vuln, exactexploit pathsscam / honeypot onlydeep threat + reuse
Outputrisk score + per-contract SHAPline-level findingsexploit inputbehavioral flagsseverity alerts
Confirms a real bug❌ priority signal, not proof✅ exact✅ SMT-proven⚠ behavioral
Pricefree tier · $79 / $399free / OSSfree / OSS (MythX retired)freemium APIenterprise

Honest read: on a single contract with source, Slither/Aderyn win; on confirmed exploitability, Mythril/Dedaub win; on "is this token a scam", GoPlus wins. REVERT wins the column none of them fill — instant attack-surface / complexity triage across the unverified population, calibrated to track Slither's signal on verified contracts. Complement, not replacement.

06Pricing — by usage

Free
$0
100 scans / mo
1 key · batch up to 25
SHAP · proxy resolution
indie auditors · trying it
Get your API key →
Pro
$79 / mo
5,000 scans / mo
3 keys · webhooks
everything in Free
solo auditors · bounty hunters
Pay with USDC
Team
$399 / mo
50,000 scans / mo
5 keys · priority
everything in Pro
audit firms · DEX sec teams · MEV / monitoring desks
Pay with USDC
Enterprise
Custom
unlimited · SLA
on-prem option
bridges · L1/L2 foundations
Contact sales

A scan = one address scored. Batch calls count each address; proxy resolution that also scores the implementation counts as 2.

Free-tier keys are self-serve. For Pro/Team, pay in USDC — activated by hand within hours, no card. Self-serve metered checkout comes later.

07FAQ — billing & the dev path

What counts as a scan?
One address scored = one scan. A batch call counts each address in the array. Proxy resolution that also scores the implementation counts as 2. Quota is metered per key, per calendar month, by tier.
Are API keys self-serve, or do I have to email you?
Free-tier keys are self-serve — generate them instantly in the dashboard, no email needed. The full key is shown once and stored only as a hash. Paid tiers ($79 Pro / $399 Team) are activated manually by email today, since metered checkout isn't live yet.
How do I actually pay — is there a checkout?
Yes — pay in USDC (Ethereum ERC-20) on the payment page: send the amount, email your tx-hash, and we activate your key within hours. No card stored, no auto-renew. Self-serve metered checkout comes later.
Is $79 recurring? Can I cancel?
Pro and Team are monthly. While billing is manual, there is nothing on file to auto-renew — your tier stays active for the month you arranged, and you simply tell us to stop or let it lapse. When self-serve checkout lands, cancellation will be one click.
What happens when I hit my limit — hard block or overage?
You get a 429 monthly_quota_exceeded. It's a soft cap: no surprise overage charges — calls are paused until the next calendar-month rollover, or upgrade your tier to lift it immediately.
Do you store the addresses I scan through the API?
Authenticated scans are tied to your account for quota and are visible only to you, enforced by row-level security. We do not use authenticated-account scan data for our own bounty work — strict data-lane separation. The public "recent scans" feed is address-anonymized via a salted, non-reversible hash. Full details: /privacy and the Privacy section of /methodology.
Can I self-host or run REVERT on-prem?
On-prem deployment is an Enterprise option. Contact sales to scope it.
Does a high score mean the contract is exploitable?
No. A high verdict is a review-priority signal, not a confirmed vulnerability — audited infra like DEX routers scores high too. A low verdict means no known pattern fired, never proof of safety (low != safe). REVERT scores attack-surface / complexity and is calibrated to track Slither's any-finding signal on verified contracts, but it runs on the unverified contracts Slither can't open — where accuracy is unmeasured; use it alongside Slither/Mythril, never instead of them. See /methodology.

Ship it into your pipeline

Generate a key, make your first call in under a minute.