AUTOMATON COLONY 🛡️

🤖 AI contract screening on Base
⛓️ Every report anchored on-chain by its hash
🔍 Says what it could NOT verify
💸 From $3.49 refunded by escrow
🌍 11 languages

[AUTOMATON COLONY 🛡️ @automatoncolony]

Automaton Colony is live on Base 🔍

Contract-screening reports sealed by their hash on-chain, so anyone can verify nobody edited them. USDC in escrow: no report by the deadline, automatic refund.

Every report says what it could NOT verify.

Free check: https://t.co/4O7wZIzOeP

[Binance @binance]

They called it luck. We call it BUIDL

[AUTOMATON COLONY 🛡️ @automatoncolony]

The delivered report, exactly as the buyer downloads it. Risk 70/100 on the analyzed token, a hard alert on holder concentration, evidence hash and model in the open. The honest parts are the product.

[AUTOMATON COLONY 🛡️ @automatoncolony]

Today the Sniper Pass completed its first full run on Base mainnet: paid in USDC, report generated on a live token, hash sealed on-chain, funds released only after the buyer's signature. Three minutes end to end.

Operator test purchase, not a customer. We test with real money on the real chain, and every step is a public event on the escrow: 0x85b98F29C0d52c435a4514A6f4843c3b7B6bc06e

This is what "noted" turned into by lunchtime.

[Base @base]

@automatoncolony noted

[AUTOMATON COLONY 🛡️ @automatoncolony]

@SingItAgent Same rail, different corner: we sell the due-diligence
layer. Machine-readable contract security reports, priced
in USDC on Base, sealed on-chain.

Your agents buy things. Ours reads the contract first.
x402 is where they meet.

[AUTOMATON COLONY 🛡️ @automatoncolony]

@isitnuel @base The upside of a one-person shop: the whole loop lives in one
head. We hit a Base-specific gap (B20 tokens invisible to
every security tool), built the fix, and had it in
production the same week. No standup required.

Batches isn't BS though. Applying with exactly that story.

[AUTOMATON COLONY 🛡️ @automatoncolony]

@iruletrenches Tried a different weapon this morning: a specific report.
B20 native tokens read as empty bytecode to every security
tool on Base. Posted the docs gap, had a "noted" from the
team in under a minute.

Bullying is louder. Specifics get answered.

[AUTOMATON COLONY 🛡️ @automatoncolony]

@elonfartbutt @base Wrong shop. We don't deploy memecoins, we autopsy them.

When you find your 10k play on Base, paste it into our free
check first: it reads the mint, pause and blacklist powers
before they read your wallet.

[Base @base]

@automatoncolony noted

[AUTOMATON COLONY 🛡️ @automatoncolony]

Merchant view from the long tail: one-person shop selling
machine-readable contract security reports in USDC on Base.

Accepting x402 is the easy part. Return 402, verify the
signature, serve the report.

The gap is everything after payment: refunds, SLAs, what
happens when the paid response is wrong. We had to build an
escrow for exactly that. Default-everywhere needs remedies,
not just checkout.

[AUTOMATON COLONY 🛡️ @automatoncolony]

@CoinbaseDev @ErikVoorhees Machine-readable contract security reports, priced in USDC
on Base. x402 makes the buyer an agent instead of a wallet
click. This is the rail we were waiting for.

[AUTOMATON COLONY 🛡️ @automatoncolony]

The other half of this story is what agents buy. An agent
about to ape into a token needs the same thing a human does:
someone to read the contract first.

We sell machine-readable security reports on Base contracts,
priced in USDC on Base. x402 is the missing rail so an agent
can buy one mid-decision, no account, no key. Moving it up
our roadmap today.

[Base @base]

@ErikVoorhees based

[AUTOMATON COLONY 🛡️ @automatoncolony]

Immutable means the code at that address never changes.
That part is true.

A proxy sidesteps it. The contract you're checking is just
a signpost pointing at a second contract where the real
code lives. The signpost never changes. Where it points
can, any time.

Same address, same balances, new rules tomorrow.

BaseScan tells you if it's a proxy. Then the only question
left is who can move the pointer.

[AUTOMATON COLONY 🛡️ @automatoncolony]

Immutable code, mutable behaviour.

A proxy's own bytecode never changes. All it does is
delegatecall to an address kept in a storage slot, and
storage is writable. Same address, same balances, new
logic tomorrow.

Read this slot on the token:
0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc

Anything but zero and you're talking to a proxy. Then the
real question is who can write it.

Truly immutable means no delegatecall, no admin, no upgrade
path. Rarer than the word suggests.

[AUTOMATON COLONY 🛡️ @automatoncolony]

@zafiraAlreem Yeah

[AUTOMATON COLONY 🛡️ @automatoncolony]

Automaton Colony is live on Base 🔍

Contract-screening reports sealed by their hash on-chain, so anyone can verify nobody edited them. USDC in escrow: no report by the deadline, automatic refund.

Every report says what it could NOT verify.

Free check: https://t.co/4O7wZIzOeP

[AUTOMATON COLONY 🛡️ @automatoncolony]

Checked one today: cap 1B, nothing paused, no transfer policies, and not one role ever granted.

It launched with no admin at all. Nobody can mint or pause it.

That's a real finding, and you only get it by reading the factory. Interfaces: https://t.co/WvPT6N39M6

[AUTOMATON COLONY 🛡️ @automatoncolony]

4 of the 10 biggest Base gainers this week have no bytecode.

eth_getCode returns one byte: 0xef.

Most scanners read that, find nothing, and print "no issues found".

B20 tokens run as Rust inside the node. You have to ask the factory instead.

[AUTOMATON COLONY 🛡️ @automatoncolony]

What you can actually read, at an anchored block:

• isB20() on the factory
• supplyCap(), pausedFeatures(), policyId(scope)
• role holders, replayed from RoleGranted / RoleRevoked

"No source to verify" is not a finding. Reading the factory is.