Base Token Risk Scanner - on-chain facts + live liquidity for any Base ERC-20

Give it a Base token address, get one JSON risk report - ERC-20 metadata read straight from the chain, whether ownership is renounced, the live DEX market (liquidity, 24h volume, price), a list of risk flags, and a BASIC-PASS / CAUTION verdict. No API key, no wallet, no signup. $0.01 per address scanned.

Built for trading agents and developers triaging fresh Base launches (Uniswap, Clanker, bonding-curve tokens) before a human or a bot commits capital.

The most important field is notChecked. This is a fast pre-trade filter, not an audit, and it says so in every record instead of implying coverage it does not have. Read What this does NOT do before you build a buy decision on it.

---

What it actually checks

Read directly from Base mainnet (chainId 8453) at a stated block, batched through Multicall3:

Field	Source	What it tells you
name, symbol, decimals, totalSupply	on-chain ERC-20 calls	the token is a real, standards-shaped ERC-20
owner, ownershipRenounced	on-chain owner()	true = owner is the zero address; false = an owner can still act; null = no owner() function on the contract
scannedAtBlock	on-chain	the exact block the facts were read at, so a report is reproducible
market.liquidityUsd, market.volume24h, market.priceUsd, market.dex	DexScreener public API, deepest pair	is it tradeable right now, and on what
flags	derived	the specific problems found
verdict	derived	BASIC-PASS (zero flags) or CAUTION (one or more)

The flags it raises

• owner NOT renounced - owner can act on the token
• incomplete/non-standard ERC20 metadata (no name or no symbol)
• NO DEX pair on Base - not tradeable / unindexed (dead or pre-liquidity)
• thin liquidity ($<amount>) - easy to rug/drain (under $1,000)
• zero 24h volume - no active trading

An address with no contract code at all short-circuits to verdict: "RISKY" with error: "no contract code at address".

---

Input

One address:

{ "tokens": ["0x4ed4e862860bed51a9570b96d89af5e1b0efefed"] }

Bulk - one record and one charge per address:

{ "tokens": [
  "0x4ed4e862860bed51a9570b96d89af5e1b0efefed",
  "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913"
] }

Field	Type	Notes
tokens	array of strings	Base ERC-20 contract addresses (0x + 40 hex chars)
token	string	single-address convenience form

---

Output - two real records

Both blocks below are verbatim from a live run on 2026-08-15, block 50010505.

1. A liquid, actively traded token - and why it still says CAUTION

{
  "token": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
  "scannedAtBlock": 50010505,
  "name": "USD Coin",
  "symbol": "USDC",
  "decimals": 6,
  "totalSupply": "4186829785297028",
  "ownershipRenounced": false,
  "owner": "0x3ABd6f64A422225E61E435baE41db12096106df7",
  "market": {
    "hasPair": true,
    "liquidityUsd": 153505,
    "volume24h": 276037,
    "priceUsd": "1.000055",
    "dex": "aerodrome"
  },
  "flags": ["owner NOT renounced - owner can act on the token"],
  "notChecked": [
    "sell-tax/honeypot SELL simulation",
    "LP lock/burn status",
    "holder concentration",
    "mint/hidden functions"
  ],
  "verdict": "CAUTION",
  "disclaimer": "On-chain + DEX scan, NOT a full audit. No flags != safe. See notChecked."
}

That is Circle's USDC on Base, and it grades CAUTION because its owner is not renounced - which for a regulated, upgradeable stablecoin is completely normal and completely true. This is the honest shape of a mechanical scanner: it reports the fact, and you apply the policy. Gate on individual flags, not on the verdict alone, or you will reject USDC.

Note also liquidityUsd: 153505 - that is the single deepest pair on DexScreener, not the token's total liquidity across every venue. Read it as "this pair is this deep", not "this is all the liquidity that exists".

BASIC-PASS (not shown here) means zero flags fired, nothing more. It is not a recommendation.

2. A token that is not tradeable

{
  "token": "0x3e9fa140b52c9a9f5327e67ec8759b1f3d3b23c2",
  "scannedAtBlock": 50010505,
  "name": "Kenoma",
  "symbol": "KENM",
  "decimals": 18,
  "totalSupply": "100000000000000000000000000000",
  "ownershipRenounced": null,
  "owner": null,
  "market": { "hasPair": false, "liquidityUsd": null, "volume24h": null, "priceUsd": null, "dex": null },
  "flags": ["NO DEX pair on Base - not tradeable / unindexed (dead or pre-liquidity)"],
  "notChecked": ["sell-tax/honeypot SELL simulation", "LP lock/burn status", "holder concentration", "mint/hidden functions"],
  "verdict": "CAUTION",
  "disclaimer": "On-chain + DEX scan, NOT a full audit. No flags != safe. See notChecked."
}

ownershipRenounced: null is a genuine third state: the contract has no owner() function to read, which is different from "the owner is nobody". A tool that collapses those two into true is telling you something it did not measure.

---

Call it from code or an agent

curl -X POST "https://api.apify.com/v2/acts/EliAI~base-token-risk-scanner/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "content-type: application/json" \
  -d '{"tokens":["0x4ed4e862860bed51a9570b96d89af5e1b0efefed"]}'

Agents can call it as a tool over Apify MCP. The contract an LLM needs:

• Capability: on-chain + DEX risk triage for one or many Base ERC-20 addresses
• Required input: tokens (array) or token (string)
• Returns: one JSON record per address; gate on verdict and on individual flags
• Bounded: one charge per address submitted; no pagination, no crawling
• Side effects: none - read-only RPC and one public API call. No wallet, no signing, no approvals.

---

What this does NOT do

Stated up front, because an under-claimed scanner is safe to automate on and an over-claimed one is how a bot buys a honeypot.

• No sell simulation. It does not attempt a swap to see whether selling is blocked or taxed. This is the single biggest gap: a token can pass every check here and still be a honeypot.
• No LP lock or burn check. Liquidity may be large and withdrawable a minute later.
• No holder-concentration analysis. It does not enumerate holders or measure how much supply the top wallets control.
• No source-verification or bytecode audit. It does not read verified source, diff it against a known-good template, or look for hidden mint, blacklist, pause, or fee-setter functions.
• No price history or rug forensics. volume24h and liquidityUsd are point-in-time.
• Base mainnet only (chainId 8453). Other chains are out of scope.

notChecked ships inside every record for exactly this reason, so a downstream agent reads the gaps rather than assuming them away.

---

Pricing

$0.01 per address scanned - one token-scanned event per address in the tokens array. No start fee, no subscription, no API key.

Be aware of one thing before you send a large batch: the charge fires per address submitted, including addresses that come back with invalid address or no contract code at address. The lookup still ran. Filter obvious junk client-side and you will not pay for it.

Ten candidate launches cost $0.10 to triage. A trading bot filtering a feed of new pairs should budget $0.01 per candidate it decides to look at.

---

FAQ

How do I check if a Base token is a honeypot before buying? Scan the address for the on-chain facts and live liquidity, then read flags. But be precise about the limit: a honeypot is defined by what happens when you sell, and this actor does not run a sell simulation - that gap is listed in notChecked on every record. Use this to eliminate the obvious failures (no contract, no pair, dust liquidity, dead volume, live owner) cheaply, and run a sell simulation before committing capital.

What does the CAUTION verdict mean? At least one flag fired - nothing more specific than that. The flags array names which, and you should gate on the individual flags rather than the verdict. Measured proof: USDC on Base returns CAUTION, purely because its owner is not renounced. Plenty of legitimate tokens have a live owner and plenty of scams have renounced one, so a single-score gate is the wrong shape.

What does BASIC-PASS mean - is the token safe? No. It means zero flags fired on the checks listed above. Everything in notChecked is still unknown. The word "BASIC" is doing real work in that label.

Why does it report what it did NOT check? Because that is what makes the output safe to automate on. An agent reading notChecked knows exactly which risks remain uncovered; a scanner that returns a bare "SAFE" gives an agent no way to know what it is trusting.

Where does the liquidity and volume data come from? DexScreener's public API, at scan time, using the deepest pair by USD liquidity. Token facts come from Base RPC nodes at the block reported in scannedAtBlock.

Does ownershipRenounced: null mean the owner is unknown? It means the contract exposes no owner() function to read. Many modern tokens have no owner at all by design; some proxy or custom-access-control contracts hide it behind a different name. It is reported as null rather than guessed either way.

Can a trading bot use this as a pre-trade filter? Yes - that is the design. Gate on verdict plus specific flags, $0.01 per candidate, read-only, no wallet connection. Pair it with a sell simulation before the buy.

Does it work on Ethereum, Solana, or BNB Chain? No. Base mainnet (8453) only.

Do I need an API key or a wallet? Neither. It reads public RPC and a public API. It never signs anything and never sees a key.

---

Related actors

Same account, same one-job-well approach:

• Webpage Text Extractor - URL to clean text or Markdown
• Redirect Chain Checker - trace every 301/302 hop

Built by Broke to Built.

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/base-token-risk-scanner
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~base-token-risk-scanner/run-sync-get-dataset-items
• Pay with x402, without an Apify account. This Actor is whitelisted for agentic payments, so an agent holding USDC on Base can buy a prepaid token and spend it here. The minimum purchase is $1, the token balance is an absolute spending cap, and it expires 14 days after purchase.
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.