Is this TRC-20 contract safe? Paste the address, find out in seconds.

This isn't a generic "best practices" list. It's the exact set of checks that come from actually designing and shipping a presale contract honestly — each one maps to a specific, real way a presale contract can be built to work against the buyer instead of for them. Kinetix's own AUDX presale contract is used below as a live, checkable example of what "passes" looks like.

Why the ABI matters more than the marketing

Every TRC-20/ERC-20-style contract exposes an ABI — a JSON list of every function it has. Unlike a website's claims, the ABI can't lie: if a function exists to move funds somewhere, it's in there. The fastest due-diligence step for any presale is reading the ABI before reading anything the team wrote about themselves.

The 8 checks

The script

Pulls a verified ABI straight from TronScan's public API (no key required) and flags any of the patterns above automatically. If the contract isn't verified, that failure IS the finding — the script says so instead of guessing.

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
 python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
 ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
 "funds are NOT limited to one fixed wallet."),
 ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
 "same risk as an unlocked withdraw."),
 ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
 ("updaterate", None, "Rate/price appears changeable after deployment."),
 ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
 ("increasesupply", None, "Contract can increase its own token supply after deployment."),
 ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
 ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
 ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def _base58_decode(s):
 num = 0
 for char in s:
 num = num * 58 + _B58_ALPHABET.index(char)
 n_bytes = (num.bit_length() + 7) // 8
 combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
 n_pad = len(s) - len(s.lstrip("1"))
 return b"\x00" * n_pad + combined

def tron_address_to_hex(address):
 """T.. base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
 raw = _base58_decode(address)
 return raw[:21].hex()

def fetch_contract_info(address):
 """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
 url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
 try:
 with urllib.request.urlopen(url, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 entries = data.get("data", [])
 return entries[0] if entries else None

def fetch_contract_abi(address):
 """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
 hex_addr = tron_address_to_hex(address)
 body = json.dumps({"value": hex_addr}).encode()
 req = urllib.request.Request(
 TRONGRID_GETCONTRACT_API, data=body,
 headers={"Content-Type": "application/json"},
 )
 try:
 with urllib.request.urlopen(req, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 return data.get("abi", {}).get("entrys", [])

def load_abi(path):
 with open(path) as f:
 return json.load(f)

def scan_abi(abi):
 findings = []
 fn_names = [f.get("name", "") for f in abi
 if f.get("type", "").lower() == "function" and f.get("name")]
 fn_lower = {n.lower(): n for n in fn_names}

 for keyword, needs_addr_param, message in RISKY_PATTERNS:
 for lower_name, real_name in fn_lower.items():
 if keyword in lower_name:
 if needs_addr_param:
 entry = next(f for f in abi if f.get("name") == real_name)
 params = [p.get("type", "") for p in entry.get("inputs", [])]
 if "address" not in params:
 continue
 findings.append((real_name, message))

 if "transferownership" in fn_lower:
 findings.append((fn_lower["transferownership"],
 "Ownership is transferable — today's team may not control it tomorrow."))

 return findings, fn_names

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("address")
 ap.add_argument("--abi", help="path to a local ABI JSON file")
 args = ap.parse_args()

 print(f"=== Presale audit: {args.address} ===\n")

 info = fetch_contract_info(args.address)
 if info:
 print(f"Contract created: {info.get('date_created', 'unknown')}")
 print(f"Balance: {info.get('balance', 0)}")
 print()

 abi = None
 if args.abi:
 abi = load_abi(args.abi)
 print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
 else:
 abi = fetch_contract_abi(args.address)
 if abi:
 print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

 if not abi:
 print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
 print("on-chain at deploy time — no separate 'verification' step is needed to")
 print("expose it. This means you cannot audit what you cannot read. Do not send")
 print("funds to a sale contract you can't inspect, and separately check whether")
 print("its source is verified on a block explorer like TronScan.")
 sys.exit(1)

 findings, fn_names = scan_abi(abi)

 print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

 if not findings:
 print("No red flags matched from this checklist. This does NOT mean the contract")
 print("is safe — it means it passed these structural checks. Still read the")
 print("actual source code before sending money.")
 else:
 print(f"{len(findings)} finding(s):\n")
 for fn, msg in findings:
 print(f" ⚠ {fn}(): {msg}")

 print("\nThis script checks structure, not intent. A contract can pass every check")
 print("here and still be malicious in ways only a full manual code read will catch.")

if __name__ == "__main__":
 main()

More free security tools

Browse the full free library →

这不是一份泛泛而谈的"最佳实践"清单，而是我们自己动手设计并诚实地上线一个预售合约之后，真实总结出来的检查项——每一条都对应一种预售合约可能被设计成"坑买家而不是护买家"的具体真实手法。下文用 Kinetix 自己的 AUDX 预售合约作为一个可以直接核实的"通过"范例。

为什么 ABI 比宣传文案更重要

每一个 TRC-20/ERC-20 风格的合约都会暴露一份 ABI——一份列出合约所有函数的 JSON 清单。跟网站上的宣传不同，ABI 不会撒谎：如果有一个函数能把资金转到某处，它就一定会出现在这里。对任何预售来说，最快的尽调步骤就是先读 ABI，再读团队自己写的介绍。

8 项检查

脚本

直接从 TronScan 的公开 API 拉取已验证的 ABI（不需要 API key），自动标出上面提到的可疑模式。如果合约没有经过验证，这个"拿不到 ABI"的结果本身就是一个发现——脚本会如实说明，而不是瞎猜。

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
 python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
 ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
 "funds are NOT limited to one fixed wallet."),
 ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
 "same risk as an unlocked withdraw."),
 ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
 ("updaterate", None, "Rate/price appears changeable after deployment."),
 ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
 ("increasesupply", None, "Contract can increase its own token supply after deployment."),
 ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
 ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
 ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def _base58_decode(s):
 num = 0
 for char in s:
 num = num * 58 + _B58_ALPHABET.index(char)
 n_bytes = (num.bit_length() + 7) // 8
 combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
 n_pad = len(s) - len(s.lstrip("1"))
 return b"\x00" * n_pad + combined

def tron_address_to_hex(address):
 """T.. base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
 raw = _base58_decode(address)
 return raw[:21].hex()

def fetch_contract_info(address):
 """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
 url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
 try:
 with urllib.request.urlopen(url, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 entries = data.get("data", [])
 return entries[0] if entries else None

def fetch_contract_abi(address):
 """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
 hex_addr = tron_address_to_hex(address)
 body = json.dumps({"value": hex_addr}).encode()
 req = urllib.request.Request(
 TRONGRID_GETCONTRACT_API, data=body,
 headers={"Content-Type": "application/json"},
 )
 try:
 with urllib.request.urlopen(req, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 return data.get("abi", {}).get("entrys", [])

def load_abi(path):
 with open(path) as f:
 return json.load(f)

def scan_abi(abi):
 findings = []
 fn_names = [f.get("name", "") for f in abi
 if f.get("type", "").lower() == "function" and f.get("name")]
 fn_lower = {n.lower(): n for n in fn_names}

 for keyword, needs_addr_param, message in RISKY_PATTERNS:
 for lower_name, real_name in fn_lower.items():
 if keyword in lower_name:
 if needs_addr_param:
 entry = next(f for f in abi if f.get("name") == real_name)
 params = [p.get("type", "") for p in entry.get("inputs", [])]
 if "address" not in params:
 continue
 findings.append((real_name, message))

 if "transferownership" in fn_lower:
 findings.append((fn_lower["transferownership"],
 "Ownership is transferable — today's team may not control it tomorrow."))

 return findings, fn_names

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("address")
 ap.add_argument("--abi", help="path to a local ABI JSON file")
 args = ap.parse_args()

 print(f"=== Presale audit: {args.address} ===\n")

 info = fetch_contract_info(args.address)
 if info:
 print(f"Contract created: {info.get('date_created', 'unknown')}")
 print(f"Balance: {info.get('balance', 0)}")
 print()

 abi = None
 if args.abi:
 abi = load_abi(args.abi)
 print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
 else:
 abi = fetch_contract_abi(args.address)
 if abi:
 print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

 if not abi:
 print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
 print("on-chain at deploy time — no separate 'verification' step is needed to")
 print("expose it. This means you cannot audit what you cannot read. Do not send")
 print("funds to a sale contract you can't inspect, and separately check whether")
 print("its source is verified on a block explorer like TronScan.")
 sys.exit(1)

 findings, fn_names = scan_abi(abi)

 print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

 if not findings:
 print("No red flags matched from this checklist. This does NOT mean the contract")
 print("is safe — it means it passed these structural checks. Still read the")
 print("actual source code before sending money.")
 else:
 print(f"{len(findings)} finding(s):\n")
 for fn, msg in findings:
 print(f" ⚠ {fn}(): {msg}")

 print("\nThis script checks structure, not intent. A contract can pass every check")
 print("here and still be malicious in ways only a full manual code read will catch.")

if __name__ == "__main__":
 main()

更多免费安全工具

浏览完整免费产品库 →

這不是一份泛泛而談的"最佳實踐"清單，而是我們自己動手設計並誠實地上線一個預售合約之後，真實總結出來的檢查項——每一條都對應一種預售合約可能被設計成"坑買家而不是護買家"的具體真實手法。下文用 Kinetix 自己的 AUDX 預售合約作爲一個可以直接覈實的"通過"範例。

爲什麼 ABI 比宣傳文案更重要

每一個 TRC-20/ERC-20 風格的合約都會暴露一份 ABI——一份列出合約所有函數的 JSON 清單。跟網站上的宣傳不同，ABI 不會撒謊：如果有一個函數能把資金轉到某處，它就一定會出現在這裏。對任何預售來說，最快的盡調步驟就是先讀 ABI，再讀團隊自己寫的介紹。

8 項檢查

腳本

直接從 TronScan 的公開 API 拉取已驗證的 ABI（不需要 API key），自動標出上面提到的可疑模式。如果合約沒有經過驗證，這個"拿不到 ABI"的結果本身就是一個發現——腳本會如實說明，而不是瞎猜。

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
 python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
 ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
 "funds are NOT limited to one fixed wallet."),
 ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
 "same risk as an unlocked withdraw."),
 ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
 ("updaterate", None, "Rate/price appears changeable after deployment."),
 ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
 ("increasesupply", None, "Contract can increase its own token supply after deployment."),
 ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
 ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
 ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def _base58_decode(s):
 num = 0
 for char in s:
 num = num * 58 + _B58_ALPHABET.index(char)
 n_bytes = (num.bit_length() + 7) // 8
 combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
 n_pad = len(s) - len(s.lstrip("1"))
 return b"\x00" * n_pad + combined

def tron_address_to_hex(address):
 """T.. base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
 raw = _base58_decode(address)
 return raw[:21].hex()

def fetch_contract_info(address):
 """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
 url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
 try:
 with urllib.request.urlopen(url, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 entries = data.get("data", [])
 return entries[0] if entries else None

def fetch_contract_abi(address):
 """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
 hex_addr = tron_address_to_hex(address)
 body = json.dumps({"value": hex_addr}).encode()
 req = urllib.request.Request(
 TRONGRID_GETCONTRACT_API, data=body,
 headers={"Content-Type": "application/json"},
 )
 try:
 with urllib.request.urlopen(req, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 return data.get("abi", {}).get("entrys", [])

def load_abi(path):
 with open(path) as f:
 return json.load(f)

def scan_abi(abi):
 findings = []
 fn_names = [f.get("name", "") for f in abi
 if f.get("type", "").lower() == "function" and f.get("name")]
 fn_lower = {n.lower(): n for n in fn_names}

 for keyword, needs_addr_param, message in RISKY_PATTERNS:
 for lower_name, real_name in fn_lower.items():
 if keyword in lower_name:
 if needs_addr_param:
 entry = next(f for f in abi if f.get("name") == real_name)
 params = [p.get("type", "") for p in entry.get("inputs", [])]
 if "address" not in params:
 continue
 findings.append((real_name, message))

 if "transferownership" in fn_lower:
 findings.append((fn_lower["transferownership"],
 "Ownership is transferable — today's team may not control it tomorrow."))

 return findings, fn_names

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("address")
 ap.add_argument("--abi", help="path to a local ABI JSON file")
 args = ap.parse_args()

 print(f"=== Presale audit: {args.address} ===\n")

 info = fetch_contract_info(args.address)
 if info:
 print(f"Contract created: {info.get('date_created', 'unknown')}")
 print(f"Balance: {info.get('balance', 0)}")
 print()

 abi = None
 if args.abi:
 abi = load_abi(args.abi)
 print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
 else:
 abi = fetch_contract_abi(args.address)
 if abi:
 print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

 if not abi:
 print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
 print("on-chain at deploy time — no separate 'verification' step is needed to")
 print("expose it. This means you cannot audit what you cannot read. Do not send")
 print("funds to a sale contract you can't inspect, and separately check whether")
 print("its source is verified on a block explorer like TronScan.")
 sys.exit(1)

 findings, fn_names = scan_abi(abi)

 print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

 if not findings:
 print("No red flags matched from this checklist. This does NOT mean the contract")
 print("is safe — it means it passed these structural checks. Still read the")
 print("actual source code before sending money.")
 else:
 print(f"{len(findings)} finding(s):\n")
 for fn, msg in findings:
 print(f" ⚠ {fn}(): {msg}")

 print("\nThis script checks structure, not intent. A contract can pass every check")
 print("here and still be malicious in ways only a full manual code read will catch.")

if __name__ == "__main__":
 main()

更多免費安全工具

瀏覽完整免費產品庫 →

これは一般的な「ベストプラクティス」一覧ではなく、プレセール契約を正直に設計・公開した経験から得た検査項目です。それぞれが「買い手を守るのではなく不利にする」具体的な手口に対応します。下記では Kinetix の AUDX プレセール契約を「合格」の実例として使います。

なぜ ABI が宣伝より重要か

TRC-20/ERC-20 系の契約は ABI（全関数の JSON 一覧）を公開します。サイトの主張と違い、ABI は嘘をつけません。資金を移せる関数があればそこに載ります。プレセールの最速のデューデリは、チームの文章より先に ABI を読むことです。

8 つのチェック

スクリプト

TronScan の公開 API から検証済み ABI を取得し、上記パターンを自動フラグします。未検証なら、推測せずその失敗自体を結果として出します。

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
 python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
 ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
 "funds are NOT limited to one fixed wallet."),
 ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
 "same risk as an unlocked withdraw."),
 ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
 ("updaterate", None, "Rate/price appears changeable after deployment."),
 ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
 ("increasesupply", None, "Contract can increase its own token supply after deployment."),
 ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
 ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
 ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def _base58_decode(s):
 num = 0
 for char in s:
 num = num * 58 + _B58_ALPHABET.index(char)
 n_bytes = (num.bit_length() + 7) // 8
 combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
 n_pad = len(s) - len(s.lstrip("1"))
 return b"\x00" * n_pad + combined

def tron_address_to_hex(address):
 """T.. base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
 raw = _base58_decode(address)
 return raw[:21].hex()

def fetch_contract_info(address):
 """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
 url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
 try:
 with urllib.request.urlopen(url, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 entries = data.get("data", [])
 return entries[0] if entries else None

def fetch_contract_abi(address):
 """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
 hex_addr = tron_address_to_hex(address)
 body = json.dumps({"value": hex_addr}).encode()
 req = urllib.request.Request(
 TRONGRID_GETCONTRACT_API, data=body,
 headers={"Content-Type": "application/json"},
 )
 try:
 with urllib.request.urlopen(req, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 return data.get("abi", {}).get("entrys", [])

def load_abi(path):
 with open(path) as f:
 return json.load(f)

def scan_abi(abi):
 findings = []
 fn_names = [f.get("name", "") for f in abi
 if f.get("type", "").lower() == "function" and f.get("name")]
 fn_lower = {n.lower(): n for n in fn_names}

 for keyword, needs_addr_param, message in RISKY_PATTERNS:
 for lower_name, real_name in fn_lower.items():
 if keyword in lower_name:
 if needs_addr_param:
 entry = next(f for f in abi if f.get("name") == real_name)
 params = [p.get("type", "") for p in entry.get("inputs", [])]
 if "address" not in params:
 continue
 findings.append((real_name, message))

 if "transferownership" in fn_lower:
 findings.append((fn_lower["transferownership"],
 "Ownership is transferable — today's team may not control it tomorrow."))

 return findings, fn_names

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("address")
 ap.add_argument("--abi", help="path to a local ABI JSON file")
 args = ap.parse_args()

 print(f"=== Presale audit: {args.address} ===\n")

 info = fetch_contract_info(args.address)
 if info:
 print(f"Contract created: {info.get('date_created', 'unknown')}")
 print(f"Balance: {info.get('balance', 0)}")
 print()

 abi = None
 if args.abi:
 abi = load_abi(args.abi)
 print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
 else:
 abi = fetch_contract_abi(args.address)
 if abi:
 print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

 if not abi:
 print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
 print("on-chain at deploy time — no separate 'verification' step is needed to")
 print("expose it. This means you cannot audit what you cannot read. Do not send")
 print("funds to a sale contract you can't inspect, and separately check whether")
 print("its source is verified on a block explorer like TronScan.")
 sys.exit(1)

 findings, fn_names = scan_abi(abi)

 print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

 if not findings:
 print("No red flags matched from this checklist. This does NOT mean the contract")
 print("is safe — it means it passed these structural checks. Still read the")
 print("actual source code before sending money.")
 else:
 print(f"{len(findings)} finding(s):\n")
 for fn, msg in findings:
 print(f" ⚠ {fn}(): {msg}")

 print("\nThis script checks structure, not intent. A contract can pass every check")
 print("here and still be malicious in ways only a full manual code read will catch.")

if __name__ == "__main__":
 main()

その他の無料セキュリティツール

일반적인 "모범 사례" 목록이 아니라, 프리세일 계약을 정직하게 설계·출시한 경험에서 나온 검사 항목입니다. 각각이 구매자에게 불리하게 설계될 수 있는 실제 수법에 대응합니다. 아래에서는 Kinetix AUDX 프리세일 계약을 "통과" 예시로 사용합니다.

ABI가 마케팅보다 중요한 이유

TRC-20/ERC-20 스타일 계약은 ABI(모든 함수 JSON 목록)를 노출합니다. 웹사이트 주장과 달리 ABI는 거짓말하지 않습니다. 자금을 옮길 함수가 있으면 반드시 나옵니다. 프리세일의 가장 빠른 실사는 팀 소개보다 ABI를 먼저 읽는 것입니다.

8가지 검사

스크립트

TronScan 공개 API에서 검증된 ABI를 가져와 위 패턴을 자동으로 표시합니다. 미검증이면 추측하지 않고 그 실패 자체를 결과로 냅니다.

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
 python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
 ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
 "funds are NOT limited to one fixed wallet."),
 ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
 "same risk as an unlocked withdraw."),
 ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
 ("updaterate", None, "Rate/price appears changeable after deployment."),
 ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
 ("increasesupply", None, "Contract can increase its own token supply after deployment."),
 ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
 ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
 ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def _base58_decode(s):
 num = 0
 for char in s:
 num = num * 58 + _B58_ALPHABET.index(char)
 n_bytes = (num.bit_length() + 7) // 8
 combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
 n_pad = len(s) - len(s.lstrip("1"))
 return b"\x00" * n_pad + combined

def tron_address_to_hex(address):
 """T.. base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
 raw = _base58_decode(address)
 return raw[:21].hex()

def fetch_contract_info(address):
 """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
 url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
 try:
 with urllib.request.urlopen(url, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 entries = data.get("data", [])
 return entries[0] if entries else None

def fetch_contract_abi(address):
 """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
 hex_addr = tron_address_to_hex(address)
 body = json.dumps({"value": hex_addr}).encode()
 req = urllib.request.Request(
 TRONGRID_GETCONTRACT_API, data=body,
 headers={"Content-Type": "application/json"},
 )
 try:
 with urllib.request.urlopen(req, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 return data.get("abi", {}).get("entrys", [])

def load_abi(path):
 with open(path) as f:
 return json.load(f)

def scan_abi(abi):
 findings = []
 fn_names = [f.get("name", "") for f in abi
 if f.get("type", "").lower() == "function" and f.get("name")]
 fn_lower = {n.lower(): n for n in fn_names}

 for keyword, needs_addr_param, message in RISKY_PATTERNS:
 for lower_name, real_name in fn_lower.items():
 if keyword in lower_name:
 if needs_addr_param:
 entry = next(f for f in abi if f.get("name") == real_name)
 params = [p.get("type", "") for p in entry.get("inputs", [])]
 if "address" not in params:
 continue
 findings.append((real_name, message))

 if "transferownership" in fn_lower:
 findings.append((fn_lower["transferownership"],
 "Ownership is transferable — today's team may not control it tomorrow."))

 return findings, fn_names

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("address")
 ap.add_argument("--abi", help="path to a local ABI JSON file")
 args = ap.parse_args()

 print(f"=== Presale audit: {args.address} ===\n")

 info = fetch_contract_info(args.address)
 if info:
 print(f"Contract created: {info.get('date_created', 'unknown')}")
 print(f"Balance: {info.get('balance', 0)}")
 print()

 abi = None
 if args.abi:
 abi = load_abi(args.abi)
 print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
 else:
 abi = fetch_contract_abi(args.address)
 if abi:
 print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

 if not abi:
 print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
 print("on-chain at deploy time — no separate 'verification' step is needed to")
 print("expose it. This means you cannot audit what you cannot read. Do not send")
 print("funds to a sale contract you can't inspect, and separately check whether")
 print("its source is verified on a block explorer like TronScan.")
 sys.exit(1)

 findings, fn_names = scan_abi(abi)

 print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

 if not findings:
 print("No red flags matched from this checklist. This does NOT mean the contract")
 print("is safe — it means it passed these structural checks. Still read the")
 print("actual source code before sending money.")
 else:
 print(f"{len(findings)} finding(s):\n")
 for fn, msg in findings:
 print(f" ⚠ {fn}(): {msg}")

 print("\nThis script checks structure, not intent. A contract can pass every check")
 print("here and still be malicious in ways only a full manual code read will catch.")

if __name__ == "__main__":
 main()

더 많은 무료 보안 도구

No es una lista genérica de «buenas prácticas». Son comprobaciones nacidas de diseñar y lanzar un contrato de preventa con honestidad — cada una mapea a una forma real de perjudicar al comprador. Abajo usamos el contrato de preventa AUDX de Kinetix como ejemplo verificable de «aprobado».

Por qué el ABI importa más que el marketing

Todo contrato estilo TRC-20/ERC-20 expone un ABI — lista JSON de funciones. A diferencia del sitio, el ABI no miente: si hay una función para mover fondos, está ahí. El paso más rápido de due diligence es leer el ABI antes que el texto del equipo.

Las 8 comprobaciones

El script

Obtiene el ABI verificado de la API pública de TronScan y marca estos patrones automáticamente. Si no está verificado, ese fallo ES el hallazgo — no inventa resultados.

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
 python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
 ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
 "funds are NOT limited to one fixed wallet."),
 ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
 "same risk as an unlocked withdraw."),
 ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
 ("updaterate", None, "Rate/price appears changeable after deployment."),
 ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
 ("increasesupply", None, "Contract can increase its own token supply after deployment."),
 ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
 ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
 ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def _base58_decode(s):
 num = 0
 for char in s:
 num = num * 58 + _B58_ALPHABET.index(char)
 n_bytes = (num.bit_length() + 7) // 8
 combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
 n_pad = len(s) - len(s.lstrip("1"))
 return b"\x00" * n_pad + combined

def tron_address_to_hex(address):
 """T.. base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
 raw = _base58_decode(address)
 return raw[:21].hex()

def fetch_contract_info(address):
 """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
 url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
 try:
 with urllib.request.urlopen(url, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 entries = data.get("data", [])
 return entries[0] if entries else None

def fetch_contract_abi(address):
 """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
 hex_addr = tron_address_to_hex(address)
 body = json.dumps({"value": hex_addr}).encode()
 req = urllib.request.Request(
 TRONGRID_GETCONTRACT_API, data=body,
 headers={"Content-Type": "application/json"},
 )
 try:
 with urllib.request.urlopen(req, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 return data.get("abi", {}).get("entrys", [])

def load_abi(path):
 with open(path) as f:
 return json.load(f)

def scan_abi(abi):
 findings = []
 fn_names = [f.get("name", "") for f in abi
 if f.get("type", "").lower() == "function" and f.get("name")]
 fn_lower = {n.lower(): n for n in fn_names}

 for keyword, needs_addr_param, message in RISKY_PATTERNS:
 for lower_name, real_name in fn_lower.items():
 if keyword in lower_name:
 if needs_addr_param:
 entry = next(f for f in abi if f.get("name") == real_name)
 params = [p.get("type", "") for p in entry.get("inputs", [])]
 if "address" not in params:
 continue
 findings.append((real_name, message))

 if "transferownership" in fn_lower:
 findings.append((fn_lower["transferownership"],
 "Ownership is transferable — today's team may not control it tomorrow."))

 return findings, fn_names

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("address")
 ap.add_argument("--abi", help="path to a local ABI JSON file")
 args = ap.parse_args()

 print(f"=== Presale audit: {args.address} ===\n")

 info = fetch_contract_info(args.address)
 if info:
 print(f"Contract created: {info.get('date_created', 'unknown')}")
 print(f"Balance: {info.get('balance', 0)}")
 print()

 abi = None
 if args.abi:
 abi = load_abi(args.abi)
 print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
 else:
 abi = fetch_contract_abi(args.address)
 if abi:
 print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

 if not abi:
 print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
 print("on-chain at deploy time — no separate 'verification' step is needed to")
 print("expose it. This means you cannot audit what you cannot read. Do not send")
 print("funds to a sale contract you can't inspect, and separately check whether")
 print("its source is verified on a block explorer like TronScan.")
 sys.exit(1)

 findings, fn_names = scan_abi(abi)

 print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

 if not findings:
 print("No red flags matched from this checklist. This does NOT mean the contract")
 print("is safe — it means it passed these structural checks. Still read the")
 print("actual source code before sending money.")
 else:
 print(f"{len(findings)} finding(s):\n")
 for fn, msg in findings:
 print(f" ⚠ {fn}(): {msg}")

 print("\nThis script checks structure, not intent. A contract can pass every check")
 print("here and still be malicious in ways only a full manual code read will catch.")

if __name__ == "__main__":
 main()

Más herramientas de seguridad gratis

Это не общий список «лучших практик», а проверки из опыта честного проектирования и запуска пресейл-контракта — каждая соответствует реальному способу навредить покупателю. Ниже контракт пресейла AUDX от Kinetix — проверяемый пример «прошёл».

Почему ABI важнее маркетинга

Контракты TRC-20/ERC-20-стиля открывают ABI — JSON-список функций. В отличие от сайта, ABI не врёт: если есть функция перевода средств, она там. Самый быстрый due diligence — читать ABI до текстов команды.

8 проверок

Скрипт

Тянет верифицированный ABI из публичного API TronScan и автоматически помечает эти паттерны. Если контракт не верифицирован, этот сбой и есть находка — без догадок.

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
 python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
 ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
 "funds are NOT limited to one fixed wallet."),
 ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
 "same risk as an unlocked withdraw."),
 ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
 ("updaterate", None, "Rate/price appears changeable after deployment."),
 ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
 ("increasesupply", None, "Contract can increase its own token supply after deployment."),
 ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
 ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
 ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def _base58_decode(s):
 num = 0
 for char in s:
 num = num * 58 + _B58_ALPHABET.index(char)
 n_bytes = (num.bit_length() + 7) // 8
 combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
 n_pad = len(s) - len(s.lstrip("1"))
 return b"\x00" * n_pad + combined

def tron_address_to_hex(address):
 """T.. base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
 raw = _base58_decode(address)
 return raw[:21].hex()

def fetch_contract_info(address):
 """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
 url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
 try:
 with urllib.request.urlopen(url, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 entries = data.get("data", [])
 return entries[0] if entries else None

def fetch_contract_abi(address):
 """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
 hex_addr = tron_address_to_hex(address)
 body = json.dumps({"value": hex_addr}).encode()
 req = urllib.request.Request(
 TRONGRID_GETCONTRACT_API, data=body,
 headers={"Content-Type": "application/json"},
 )
 try:
 with urllib.request.urlopen(req, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 return data.get("abi", {}).get("entrys", [])

def load_abi(path):
 with open(path) as f:
 return json.load(f)

def scan_abi(abi):
 findings = []
 fn_names = [f.get("name", "") for f in abi
 if f.get("type", "").lower() == "function" and f.get("name")]
 fn_lower = {n.lower(): n for n in fn_names}

 for keyword, needs_addr_param, message in RISKY_PATTERNS:
 for lower_name, real_name in fn_lower.items():
 if keyword in lower_name:
 if needs_addr_param:
 entry = next(f for f in abi if f.get("name") == real_name)
 params = [p.get("type", "") for p in entry.get("inputs", [])]
 if "address" not in params:
 continue
 findings.append((real_name, message))

 if "transferownership" in fn_lower:
 findings.append((fn_lower["transferownership"],
 "Ownership is transferable — today's team may not control it tomorrow."))

 return findings, fn_names

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("address")
 ap.add_argument("--abi", help="path to a local ABI JSON file")
 args = ap.parse_args()

 print(f"=== Presale audit: {args.address} ===\n")

 info = fetch_contract_info(args.address)
 if info:
 print(f"Contract created: {info.get('date_created', 'unknown')}")
 print(f"Balance: {info.get('balance', 0)}")
 print()

 abi = None
 if args.abi:
 abi = load_abi(args.abi)
 print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
 else:
 abi = fetch_contract_abi(args.address)
 if abi:
 print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

 if not abi:
 print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
 print("on-chain at deploy time — no separate 'verification' step is needed to")
 print("expose it. This means you cannot audit what you cannot read. Do not send")
 print("funds to a sale contract you can't inspect, and separately check whether")
 print("its source is verified on a block explorer like TronScan.")
 sys.exit(1)

 findings, fn_names = scan_abi(abi)

 print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

 if not findings:
 print("No red flags matched from this checklist. This does NOT mean the contract")
 print("is safe — it means it passed these structural checks. Still read the")
 print("actual source code before sending money.")
 else:
 print(f"{len(findings)} finding(s):\n")
 for fn, msg in findings:
 print(f" ⚠ {fn}(): {msg}")

 print("\nThis script checks structure, not intent. A contract can pass every check")
 print("here and still be malicious in ways only a full manual code read will catch.")

if __name__ == "__main__":
 main()

Другие бесплатные инструменты безопасности

Đây không phải danh sách "best practices" chung chung, mà các kiểm tra từ việc thiết kế và ra mắt hợp đồng presale trung thực — mỗi mục tương ứng một cách thực tế có thể hại người mua. Bên dưới dùng hợp đồng presale AUDX của Kinetix làm ví dụ "pass" có thể kiểm chứng.

Vì sao ABI quan trọng hơn marketing

Mọi hợp đồng kiểu TRC-20/ERC-20 đều lộ ABI — danh sách JSON các hàm. Khác website, ABI không nói dối: nếu có hàm chuyển tiền, nó sẽ có. Bước due diligence nhanh nhất là đọc ABI trước nội dung của team.

8 kiểm tra

Script

Lấy ABI đã verify từ API công khai TronScan và gắn cờ các mẫu trên. Nếu chưa verify, thất bại đó CHÍNH LÀ kết quả — không đoán mò.

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
 python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
 ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
 "funds are NOT limited to one fixed wallet."),
 ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
 "same risk as an unlocked withdraw."),
 ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
 ("updaterate", None, "Rate/price appears changeable after deployment."),
 ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
 ("increasesupply", None, "Contract can increase its own token supply after deployment."),
 ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
 ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
 ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def _base58_decode(s):
 num = 0
 for char in s:
 num = num * 58 + _B58_ALPHABET.index(char)
 n_bytes = (num.bit_length() + 7) // 8
 combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
 n_pad = len(s) - len(s.lstrip("1"))
 return b"\x00" * n_pad + combined

def tron_address_to_hex(address):
 """T.. base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
 raw = _base58_decode(address)
 return raw[:21].hex()

def fetch_contract_info(address):
 """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
 url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
 try:
 with urllib.request.urlopen(url, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 entries = data.get("data", [])
 return entries[0] if entries else None

def fetch_contract_abi(address):
 """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
 hex_addr = tron_address_to_hex(address)
 body = json.dumps({"value": hex_addr}).encode()
 req = urllib.request.Request(
 TRONGRID_GETCONTRACT_API, data=body,
 headers={"Content-Type": "application/json"},
 )
 try:
 with urllib.request.urlopen(req, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 return data.get("abi", {}).get("entrys", [])

def load_abi(path):
 with open(path) as f:
 return json.load(f)

def scan_abi(abi):
 findings = []
 fn_names = [f.get("name", "") for f in abi
 if f.get("type", "").lower() == "function" and f.get("name")]
 fn_lower = {n.lower(): n for n in fn_names}

 for keyword, needs_addr_param, message in RISKY_PATTERNS:
 for lower_name, real_name in fn_lower.items():
 if keyword in lower_name:
 if needs_addr_param:
 entry = next(f for f in abi if f.get("name") == real_name)
 params = [p.get("type", "") for p in entry.get("inputs", [])]
 if "address" not in params:
 continue
 findings.append((real_name, message))

 if "transferownership" in fn_lower:
 findings.append((fn_lower["transferownership"],
 "Ownership is transferable — today's team may not control it tomorrow."))

 return findings, fn_names

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("address")
 ap.add_argument("--abi", help="path to a local ABI JSON file")
 args = ap.parse_args()

 print(f"=== Presale audit: {args.address} ===\n")

 info = fetch_contract_info(args.address)
 if info:
 print(f"Contract created: {info.get('date_created', 'unknown')}")
 print(f"Balance: {info.get('balance', 0)}")
 print()

 abi = None
 if args.abi:
 abi = load_abi(args.abi)
 print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
 else:
 abi = fetch_contract_abi(args.address)
 if abi:
 print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

 if not abi:
 print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
 print("on-chain at deploy time — no separate 'verification' step is needed to")
 print("expose it. This means you cannot audit what you cannot read. Do not send")
 print("funds to a sale contract you can't inspect, and separately check whether")
 print("its source is verified on a block explorer like TronScan.")
 sys.exit(1)

 findings, fn_names = scan_abi(abi)

 print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

 if not findings:
 print("No red flags matched from this checklist. This does NOT mean the contract")
 print("is safe — it means it passed these structural checks. Still read the")
 print("actual source code before sending money.")
 else:
 print(f"{len(findings)} finding(s):\n")
 for fn, msg in findings:
 print(f" ⚠ {fn}(): {msg}")

 print("\nThis script checks structure, not intent. A contract can pass every check")
 print("here and still be malicious in ways only a full manual code read will catch.")

if __name__ == "__main__":
 main()

Thêm công cụ bảo mật miễn phí

Isto não é uma lista genérica de «boas práticas». São checks nascidos de desenhar e lançar um contrato de pré-venda com honestidade — cada um mapeia uma forma real de prejudicar o comprador. Abaixo usamos o contrato de pré-venda AUDX da Kinetix como exemplo verificável de «passou».

Porque o ABI importa mais do que o marketing

Todo contrato estilo TRC-20/ERC-20 expõe um ABI — lista JSON de funções. Ao contrário do site, o ABI não mente: se existe função para mover fundos, está lá. O passo mais rápido de due diligence é ler o ABI antes do texto da equipa.

As 8 verificações

O script

Obtém o ABI verificado da API pública do TronScan e marca estes padrões automaticamente. Se não estiver verificado, essa falha É o achado — sem inventar resultados.

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
 python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
 ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
 "funds are NOT limited to one fixed wallet."),
 ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
 "same risk as an unlocked withdraw."),
 ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
 ("updaterate", None, "Rate/price appears changeable after deployment."),
 ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
 ("increasesupply", None, "Contract can increase its own token supply after deployment."),
 ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
 ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
 ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"

def _base58_decode(s):
 num = 0
 for char in s:
 num = num * 58 + _B58_ALPHABET.index(char)
 n_bytes = (num.bit_length() + 7) // 8
 combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
 n_pad = len(s) - len(s.lstrip("1"))
 return b"\x00" * n_pad + combined

def tron_address_to_hex(address):
 """T.. base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
 raw = _base58_decode(address)
 return raw[:21].hex()

def fetch_contract_info(address):
 """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
 url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
 try:
 with urllib.request.urlopen(url, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 entries = data.get("data", [])
 return entries[0] if entries else None

def fetch_contract_abi(address):
 """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
 hex_addr = tron_address_to_hex(address)
 body = json.dumps({"value": hex_addr}).encode()
 req = urllib.request.Request(
 TRONGRID_GETCONTRACT_API, data=body,
 headers={"Content-Type": "application/json"},
 )
 try:
 with urllib.request.urlopen(req, timeout=15) as r:
 data = json.load(r)
 except Exception:
 return None
 return data.get("abi", {}).get("entrys", [])

def load_abi(path):
 with open(path) as f:
 return json.load(f)

def scan_abi(abi):
 findings = []
 fn_names = [f.get("name", "") for f in abi
 if f.get("type", "").lower() == "function" and f.get("name")]
 fn_lower = {n.lower(): n for n in fn_names}

 for keyword, needs_addr_param, message in RISKY_PATTERNS:
 for lower_name, real_name in fn_lower.items():
 if keyword in lower_name:
 if needs_addr_param:
 entry = next(f for f in abi if f.get("name") == real_name)
 params = [p.get("type", "") for p in entry.get("inputs", [])]
 if "address" not in params:
 continue
 findings.append((real_name, message))

 if "transferownership" in fn_lower:
 findings.append((fn_lower["transferownership"],
 "Ownership is transferable — today's team may not control it tomorrow."))

 return findings, fn_names

def main():
 ap = argparse.ArgumentParser()
 ap.add_argument("address")
 ap.add_argument("--abi", help="path to a local ABI JSON file")
 args = ap.parse_args()

 print(f"=== Presale audit: {args.address} ===\n")

 info = fetch_contract_info(args.address)
 if info:
 print(f"Contract created: {info.get('date_created', 'unknown')}")
 print(f"Balance: {info.get('balance', 0)}")
 print()

 abi = None
 if args.abi:
 abi = load_abi(args.abi)
 print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
 else:
 abi = fetch_contract_abi(args.address)
 if abi:
 print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

 if not abi:
 print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
 print("on-chain at deploy time — no separate 'verification' step is needed to")
 print("expose it. This means you cannot audit what you cannot read. Do not send")
 print("funds to a sale contract you can't inspect, and separately check whether")
 print("its source is verified on a block explorer like TronScan.")
 sys.exit(1)

 findings, fn_names = scan_abi(abi)

 print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

 if not findings:
 print("No red flags matched from this checklist. This does NOT mean the contract")
 print("is safe — it means it passed these structural checks. Still read the")
 print("actual source code before sending money.")
 else:
 print(f"{len(findings)} finding(s):\n")
 for fn, msg in findings:
 print(f" ⚠ {fn}(): {msg}")

 print("\nThis script checks structure, not intent. A contract can pass every check")
 print("here and still be malicious in ways only a full manual code read will catch.")

if __name__ == "__main__":
 main()

Mais ferramentas de segurança grátis