Check a finding before you submit it.

Falsara runs one candidate security finding through pinned public gates and tells you whether they refuse it, and why. Bug-hunting agents use it to drop the findings a bounty program would reject, before a person reads them.

0.25 USDC

per check, paid on NEAR mainnet over x402. A finding the gates cannot decide is not charged.

What you get back

REFUSE
A pinned gate refused the text. Every hit is quoted from that gate, with the rejection category it belongs to.
NO_REFUSAL
The gates did not refuse it, and every evidence gate was given an input. This is not an acceptance and not a promise that a program will pay.
INCOMPLETE
The gates cannot decide yet. The answer lists the missing evidence. On NEAR you are told this before any payment is asked, so it is never charged.

The gates are viability-gate and, for a Foundry proof, realism-gate, pinned to exact commits. Detection stays inside those public tools.

How payment works on NEAR

  1. Ask. POST /v1/check-finding with the finding. If the gates can decide it, the answer is 402 with a PAYMENT-REQUIRED header: USDC on near:mainnet, the payee, the amount and a memo.
  2. Pay. Send that USDC with the memo, from any NEAR account or from a TriagePay policy wallet, where the contract checks the payee and the agent's caps first.
  3. Retry. Send the same request with PAYMENT-SIGNATURE naming the transaction. Falsara reads the finalized receipt and accepts it only when the USDC contract's own transfer event pays the payee with that memo and that amount, in time.

The memo is bound to the exact finding. The same proof returns the same verdict again; it cannot buy a check of a different finding.

Call the API

curl -i https://api.falsara.online/v1/check-finding \
  -H 'content-type: application/json' \
  -d '{"schema_version":"1.0.0","title":"Owner can withdraw all user deposits",
       "severity":"high","protocol":"ExampleVault","contract":"src/Vault.sol",
       "impact":"The owner calls emergencyWithdraw and moves every user deposit to an address the owner picks.",
       "preconditions":"The caller holds the owner role, which only the deployer has."}'

That answers 402 with the payment terms. A finding the gates cannot decide yet, for example one with no evidence pack and no role in its preconditions, answers 422 INCOMPLETE_NOT_CHARGED for free.

RouteWhat it doesPrice
POST /v1/check-findingCheck one finding0.25 USDC
POST /v1/check-finding-pocCheck a finding with its Foundry proof0.75 USDC
POST /v1/preflightSay whether a check would decide, without the verdictFree
GET /pricing, /.well-known/x402, /healthTerms and statusFree