Free · No signup · Runs in your browser

Is this TRC-20 contract safe? Paste the address, find out in seconds.

No install, no code to read. This checks any TRON contract — a presale, a token, anything — against 9 structural red flags in plain language, live against the real on-chain ABI.

How this works, in detail ↓ Prefer the command-line script? ↓

This isn't a generic "best practices" list. It's the exact set of checks that come from actually designing and shipping a presale contract honestly — each one maps to a specific, real way a presale contract can be built to work against the buyer instead of for them. AuditX's own AUDX presale contract is used below as a live, checkable example of what "passes" looks like.

Why the ABI matters more than the marketing

Every TRC-20/ERC-20-style contract exposes an ABI — a JSON list of every function it has. Unlike a website's claims, the ABI can't lie: if a function exists to move funds somewhere, it's in there. The fastest due-diligence step for any presale is reading the ABI before reading anything the team wrote about themselves.

The 8 checks

1. Withdraw destination — parameterized or fixed?

Look for a function like withdrawUsdt(uint256 amount) vs withdrawUsdt(uint256 amount, address to). If the destination is a function parameter, the owner can send collected funds anywhere, any time — including a fresh wallet you've never seen. If it's fixed at deployment, the owner is structurally limited to one address; check what that address actually is.

2. Unsold-token reclaim destination — same question.

Whatever function returns unsold tokens after the sale closes — a parameterized destination here is just as much of a red flag as on the withdraw function.

3. Can the price change after deployment?

Search the ABI for setPrice(), updateRate(), or configure(). A presale's entire value proposition is a fixed price — if the owner can change it after you've committed to buy, the "fixed price" claim is misleading.

4. Can the sale cap or pool size change?

setCap(), increaseSupply(), extendPool() — a pool that can grow after launch dilutes everyone who already bought in, with no way to know it happened until they check.

5. Who holds ownership, and can it be transferred?

transferOwnership() / renounceOwnership(). Ownership isn't automatically bad — a presale needs one to close the sale and withdraw proceeds. What matters is whether it's transferable to a new, unknown address at any time.

6. Can the owner pause or blacklist during an active sale?

pause(), blacklist(), setTradingEnabled() — mechanisms for selectively freezing specific buyers or the whole contract mid-sale.

7. Who can close the sale, and is there any refund path?

Check for a close() function and who can call it — should be owner-only. Then check honestly whether there's ANY refund mechanism if the sale closes early with money already collected. Most don't; that's normal, but it means reading the docs before sending money matters more, not less.

8. Is the contract even verified?

If you can't get a real ABI — source never published/verified on a block explorer — that's not a technical check, that's the whole due-diligence process failing before it starts. Treat an unverified sale contract as maximum risk regardless of what anyone tells you.

The script

Pulls a verified ABI straight from TronScan's public API (no key required) and flags any of the patterns above automatically. If the contract isn't verified, that failure IS the finding — the script says so instead of guessing.

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 presale contract red-flag checker.

Usage:
  python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

If --abi is omitted, the script pulls the contract's ABI live from the chain
via TronGrid. On TRON, a contract's ABI is written on-chain at deployment
time — unlike Ethereum, no separate "source verification" step is needed to
expose it. If a contract has no ABI on-chain at all, that failure IS the
finding — the script says so instead of guessing.

No API key required for the endpoints this script uses.
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
    ("withdraw", "to", "Withdraw function takes a destination address as a parameter — "
                        "funds are NOT limited to one fixed wallet."),
    ("reclaim", "to", "Unsold-token reclaim takes a destination address as a parameter — "
                       "same risk as an unlocked withdraw."),
    ("setprice", None, "Price can be changed after deployment — the 'fixed price' claim may not hold."),
    ("updaterate", None, "Rate/price appears changeable after deployment."),
    ("setcap", None, "Sale cap/pool size appears changeable after deployment."),
    ("increasesupply", None, "Contract can increase its own token supply after deployment."),
    ("pause", None, "Owner can pause the contract — funds/withdrawals could be frozen selectively."),
    ("blacklist", None, "Owner can blacklist addresses — could block specific buyers' refunds."),
    ("mint", None, "Contract (or its underlying token) has a mint function — supply is not fixed."),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"


def _base58_decode(s):
    num = 0
    for char in s:
        num = num * 58 + _B58_ALPHABET.index(char)
    n_bytes = (num.bit_length() + 7) // 8
    combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
    n_pad = len(s) - len(s.lstrip("1"))
    return b"\x00" * n_pad + combined


def tron_address_to_hex(address):
    """T... base58check address -> 21-byte hex (0x41 prefix + 20-byte address)."""
    raw = _base58_decode(address)
    return raw[:21].hex()


def fetch_contract_info(address):
    """Cosmetic metadata only (creation date, balance) — best-effort, not load-bearing."""
    url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
    try:
        with urllib.request.urlopen(url, timeout=15) as r:
            data = json.load(r)
    except Exception:
        return None
    entries = data.get("data", [])
    return entries[0] if entries else None


def fetch_contract_abi(address):
    """The real ABI, straight from the chain via TronGrid's wallet/getcontract."""
    hex_addr = tron_address_to_hex(address)
    body = json.dumps({"value": hex_addr}).encode()
    req = urllib.request.Request(
        TRONGRID_GETCONTRACT_API, data=body,
        headers={"Content-Type": "application/json"},
    )
    try:
        with urllib.request.urlopen(req, timeout=15) as r:
            data = json.load(r)
    except Exception:
        return None
    return data.get("abi", {}).get("entrys", [])


def load_abi(path):
    with open(path) as f:
        return json.load(f)


def scan_abi(abi):
    findings = []
    fn_names = [f.get("name", "") for f in abi
                if f.get("type", "").lower() == "function" and f.get("name")]
    fn_lower = {n.lower(): n for n in fn_names}

    for keyword, needs_addr_param, message in RISKY_PATTERNS:
        for lower_name, real_name in fn_lower.items():
            if keyword in lower_name:
                if needs_addr_param:
                    entry = next(f for f in abi if f.get("name") == real_name)
                    params = [p.get("type", "") for p in entry.get("inputs", [])]
                    if "address" not in params:
                        continue
                findings.append((real_name, message))

    if "transferownership" in fn_lower:
        findings.append((fn_lower["transferownership"],
                          "Ownership is transferable — today's team may not control it tomorrow."))

    return findings, fn_names


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("address")
    ap.add_argument("--abi", help="path to a local ABI JSON file")
    args = ap.parse_args()

    print(f"=== Presale audit: {args.address} ===\n")

    info = fetch_contract_info(args.address)
    if info:
        print(f"Contract created: {info.get('date_created', 'unknown')}")
        print(f"Balance: {info.get('balance', 0)}")
    print()

    abi = None
    if args.abi:
        abi = load_abi(args.abi)
        print(f"Loaded ABI from {args.abi} ({len(abi)} entries)\n")
    else:
        abi = fetch_contract_abi(args.address)
        if abi:
            print(f"Loaded ABI live from chain via TronGrid ({len(abi)} entries)\n")

    if not abi:
        print("NO ABI FOUND ON-CHAIN. On TRON, a contract's ABI is normally written")
        print("on-chain at deploy time — no separate 'verification' step is needed to")
        print("expose it. This means you cannot audit what you cannot read. Do not send")
        print("funds to a sale contract you can't inspect, and separately check whether")
        print("its source is verified on a block explorer like TronScan.")
        sys.exit(1)

    findings, fn_names = scan_abi(abi)

    print(f"Functions found ({len(fn_names)}): {', '.join(sorted(fn_names))}\n")

    if not findings:
        print("No red flags matched from this checklist. This does NOT mean the contract")
        print("is safe — it means it passed these structural checks. Still read the")
        print("actual source code before sending money.")
    else:
        print(f"{len(findings)} finding(s):\n")
        for fn, msg in findings:
            print(f"  ⚠ {fn}(): {msg}")

    print("\nThis script checks structure, not intent. A contract can pass every check")
    print("here and still be malicious in ways only a full manual code read will catch.")


if __name__ == "__main__":
    main()

A clean report is not a green light — it just means the contract didn't match these 8 specific patterns. It can't catch a subtly wrong fee calculation, a backdoor hidden inside a legitimately-named function, or a team that's honest today and disappears tomorrow. Treat this as the first ten minutes of due diligence, not the whole process. No automated script replaces a professional smart contract audit for anything beyond a small amount of money.

A real, checkable example of the "fixed destination" pattern: AuditX's own AUDX presale contract is public and verifiable on TronScan — its withdrawUsdt(uint256 amount) and reclaimUnsold() functions take no address parameter at all; destination wallets are fixed at deployment and can't be changed by anyone, including the owner. That's not a claim, it's checkable directly against the contract's own ABI, the same way this script checks any other contract.

More free security tools

Browse the full free library →

这不是一份泛泛而谈的"最佳实践"清单，而是我们自己动手设计并诚实地上线一个预售合约之后，真实总结出来的检查项——每一条都对应一种预售合约可能被设计成"坑买家而不是护买家"的具体真实手法。下文用 AuditX 自己的 AUDX 预售合约作为一个可以直接核实的"通过"范例。

为什么 ABI 比宣传文案更重要

每一个 TRC-20/ERC-20 风格的合约都会暴露一份 ABI——一份列出合约所有函数的 JSON 清单。跟网站上的宣传不同，ABI 不会撒谎：如果有一个函数能把资金转到某处，它就一定会出现在这里。对任何预售来说，最快的尽调步骤就是先读 ABI，再读团队自己写的介绍。

8 项检查

1. 提现地址——是参数，还是写死的？

看函数是 withdrawUsdt(uint256 amount) 这种，还是 withdrawUsdt(uint256 amount, address to) 这种。如果目标地址是函数的参数，那所有者随时可以把募集到的资金转去任何地方，包括一个你从没见过的新钱包。如果目标地址是部署时就写死的，所有者在结构上就被限制到一个地址——去查一下这个地址到底是不是公开披露过的。

2. 未售出代币的回收地址——同样的问题。

预售结束后把未售出代币收回的函数也是一样的逻辑：如果目标地址是参数，风险和不受限的提现函数一样大。

3. 部署之后价格能不能改？

在 ABI 里搜 setPrice()、updateRate()、configure() 之类的函数。预售的核心卖点就是固定价格——如果你已经决定要买了，所有者却还能改价格，那"固定价格"这个说法本身就是误导。

4. 售卖上限或池子大小能不能改？

setCap()、increaseSupply()、extendPool() 这类函数——池子上线后还能变大，会稀释所有已经买入的人，而且他们在自己去查之前根本不会知道发生了这件事。

5. 所有权归谁，能不能转移？

transferOwnership() / renounceOwnership()。所有权本身不是坏事——预售合约本来就需要一个所有者来关闭销售、提取资金。关键在于：这个所有权能不能随时转给一个全新的、未知的地址。

6. 销售进行中，所有者能不能暂停或拉黑？

pause()、blacklist()、setTradingEnabled()——这些都是可以在销售中途选择性冻结特定买家、或冻结整个合约的机制。

7. 谁能关闭销售？有没有退款路径？

找 close() 函数，看谁能调用它——应该只能是所有者。然后诚实地检查：如果销售提前关闭、钱已经收了，合约有没有任何退款机制？大部分都没有，这本身不算异常，但这意味着"打钱前先读文档"这件事更重要，而不是更不重要。

8. 合约到底有没有经过验证？

如果你根本拿不到真实的 ABI——源码从来没有在区块浏览器上公开验证过——这已经不是某一项技术检查了，而是整个尽调流程在起点就失败了。不管任何人怎么跟你说，一个未验证的销售合约都应该被当作最高风险对待。

脚本

直接从 TronScan 的公开 API 拉取已验证的 ABI（不需要 API key），自动标出上面提到的可疑模式。如果合约没有经过验证，这个"拿不到 ABI"的结果本身就是一个发现——脚本会如实说明，而不是瞎猜。

#!/usr/bin/env python3
"""
presale_audit.py — TRC-20 预售合约红旗检查脚本

用法:
  python3 presale_audit.py <contract_address> [--abi path/to/abi.json]

如果不传 --abi，脚本会直接从链上拉取合约的真实 ABI（通过 TronGrid）。
在 TRON 上，合约的 ABI 是部署时就写入链上的，不像以太坊那样需要单独的
"源码验证"步骤才能拿到。如果一个合约在链上完全没有 ABI，这个失败结果
本身就是发现——脚本会如实说明，而不是瞎猜。

本脚本用到的接口都不需要 API key。
"""
import sys
import json
import argparse
import urllib.request

TRONSCAN_CONTRACT_API = "https://apilist.tronscanapi.com/api/contract"
TRONGRID_GETCONTRACT_API = "https://api.trongrid.io/wallet/getcontract"

RISKY_PATTERNS = [
    ("withdraw", "to", "提现函数把目标地址作为参数——资金并未被限制到某一个固定钱包。"),
    ("reclaim", "to", "未售出代币回收函数把目标地址作为参数——风险和不受限的提现函数一样。"),
    ("setprice", None, "部署后价格可被更改——'固定价格' 的说法可能不成立。"),
    ("updaterate", None, "部署后费率/价格似乎可被更改。"),
    ("setcap", None, "部署后销售上限/池子大小似乎可被更改。"),
    ("increasesupply", None, "合约可以在部署后增发自身供应量。"),
    ("pause", None, "所有者可以暂停合约——资金/提现可能被选择性冻结。"),
    ("blacklist", None, "所有者可以拉黑地址——可能用于阻止特定买家退款。"),
    ("mint", None, "合约（或其底层代币）存在增发函数——供应量并非固定。"),
]

_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"


def _base58_decode(s):
    num = 0
    for char in s:
        num = num * 58 + _B58_ALPHABET.index(char)
    n_bytes = (num.bit_length() + 7) // 8
    combined = num.to_bytes(n_bytes, "big") if n_bytes else b""
    n_pad = len(s) - len(s.lstrip("1"))
    return b"\x00" * n_pad + combined


def tron_address_to_hex(address):
    """T... base58check 地址 -> 21 字节十六进制（0x41 前缀 + 20 字节地址）"""
    raw = _base58_decode(address)
    return raw[:21].hex()


def fetch_contract_info(address):
    """仅用于展示的元数据（创建时间、余额）——尽力而为，不是关键路径。"""
    url = f"{TRONSCAN_CONTRACT_API}?contract={address}"
    try:
        with urllib.request.urlopen(url, timeout=15) as r:
            data = json.load(r)
    except Exception:
        return None
    entries = data.get("data", [])
    return entries[0] if entries else None


def fetch_contract_abi(address):
    """真实的 ABI，通过 TronGrid 的 wallet/getcontract 直接从链上读取。"""
    hex_addr = tron_address_to_hex(address)
    body = json.dumps({"value": hex_addr}).encode()
    req = urllib.request.Request(
        TRONGRID_GETCONTRACT_API, data=body,
        headers={"Content-Type": "application/json"},
    )
    try:
        with urllib.request.urlopen(req, timeout=15) as r:
            data = json.load(r)
    except Exception:
        return None
    return data.get("abi", {}).get("entrys", [])


def load_abi(path):
    with open(path) as f:
        return json.load(f)


def scan_abi(abi):
    findings = []
    fn_names = [f.get("name", "") for f in abi
                if f.get("type", "").lower() == "function" and f.get("name")]
    fn_lower = {n.lower(): n for n in fn_names}

    for keyword, needs_addr_param, message in RISKY_PATTERNS:
        for lower_name, real_name in fn_lower.items():
            if keyword in lower_name:
                if needs_addr_param:
                    entry = next(f for f in abi if f.get("name") == real_name)
                    params = [p.get("type", "") for p in entry.get("inputs", [])]
                    if "address" not in params:
                        continue
                findings.append((real_name, message))

    if "transferownership" in fn_lower:
        findings.append((fn_lower["transferownership"],
                          "所有权可被转移——今天可信的团队，不代表明天还控制着这个合约。"))

    return findings, fn_names


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("address")
    ap.add_argument("--abi", help="本地 ABI JSON 文件路径")
    args = ap.parse_args()

    print(f"=== 预售合约审查: {args.address} ===\n")

    info = fetch_contract_info(args.address)
    if info:
        print(f"合约创建时间: {info.get('date_created', 'unknown')}")
        print(f"余额: {info.get('balance', 0)}")
    print()

    abi = None
    if args.abi:
        abi = load_abi(args.abi)
        print(f"已从 {args.abi} 加载 ABI（{len(abi)} 条）\n")
    else:
        abi = fetch_contract_abi(args.address)
        if abi:
            print(f"已通过 TronGrid 从链上加载 ABI（{len(abi)} 条）\n")

    if not abi:
        print("链上找不到 ABI。在 TRON 上，合约的 ABI 通常是部署时就写入链上的，")
        print("不需要单独的'验证'步骤。这意味着你没法审查一段读不到的代码。")
        print("不要把资金打给一个你无法查看代码的销售合约，也建议另外去")
        print("TronScan 这类区块浏览器确认一下源码是否经过验证。")
        sys.exit(1)

    findings, fn_names = scan_abi(abi)

    print(f"发现的函数（共 {len(fn_names)} 个）: {', '.join(sorted(fn_names))}\n")

    if not findings:
        print("这份清单里没有匹配到红旗。这不代表合约就是安全的——")
        print("只代表它通过了这些结构性检查。发送资金前仍然要读实际源码。")
    else:
        print(f"共 {len(findings)} 项发现:\n")
        for fn, msg in findings:
            print(f"  ⚠ {fn}(): {msg}")

    print("\n本脚本检查的是结构，不是意图。一个合约可以通过这里的每一项检查，")
    print("仍然以只有完整人工代码审查才能发现的方式作恶。")


if __name__ == "__main__":
    main()

报告干净不等于可以放心买——只说明合约没有匹配上这 8 种特定模式。它抓不住一个算错的手续费逻辑、一个藏在正常命名函数里的后门，也抓不住一个今天诚实、明天跑路的团队。把这当成尽调的头十分钟，而不是全部流程。任何自动化脚本都无法替代针对较大金额的专业智能合约审计。

"目标地址写死"这个模式的真实、可核实的例子：AuditX 自己的 AUDX 预售合约在 TronScan 上公开可查——它的 withdrawUsdt(uint256 amount) 和 reclaimUnsold() 函数都不接受地址参数，目标钱包在部署时就写死了，包括所有者在内的任何人都无法更改。这不是一句宣传语，而是可以直接对照合约 ABI 核实的事实，和这个脚本检查其他合约的方式完全一样。

Is this TRC-20 contract safe? Paste the address, find out in seconds.

Why the ABI matters more than the marketing

The 8 checks

The script

More free security tools

Rug Pull & Honeypot Contract Scanner

Token Approval Risk Auditor

Stablecoin Depeg Monitor

Multi-Sig Wallet Security Playbook

为什么 ABI 比宣传文案更重要

8 项检查

脚本

更多免费安全工具

拉盘/蜜罐合约扫描器

代币授权风险审计

稳定币脱锚监控

多签钱包安全手册