What we check — and what we can't see

Only public blockchain data: balances, transaction history, and standing token permissions for the addresses you paste. This is the same data any blockchain explorer shows anyone. A public address works like an account number — people can send money to it, and anyone can view its history. Taking money out requires secret keys, which we never ask for and never want.

We keep no account of who scanned what. A scan result page (the shareable link) stores only the report itself.

When you use a trading site, you often grant its contract a standing permission to spend a token from your wallet — like a direct-debit authorization. These never expire on their own, and old "unlimited" permissions are the most common way wallets are drained years later.

We list every open permission on Ethereum, Base, Arbitrum and Polygon, then flag: permissions to contracts on public scam blacklists (we use Scam Sniffer's open database); unlimited permissions to contracts nobody can identify — the classic drainer pattern; unlimited permissions with real money exposed today; and unlimited permissions more than a year old. Permissions on worthless spam tokens are deliberately not flagged — they would bury the findings that matter.

Attackers plant addresses in your history that visually mimic your real contacts — matching the first and last four characters, the only ones people check. They do it with zero-value transfers and tiny "dust" payments. If you later copy an address from your history, you pay the attacker. Documented losses exceed $83M.

We build the set of addresses you genuinely transact with, then look for strangers in your history that mimic them, and for the zero-value transfer trick itself. On Bitcoin, we flag dust payments — tiny amounts sent to track you or bait you.

The grade starts at 100 points and subtracts a fixed, published weight per finding — largest for permissions to known scam contracts, smaller for hygiene issues like stale permissions. Repeats of the same issue count less each time, so one spammy wallet can't bury a real drain risk. A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, F below. The same input always produces the same grade — no AI decides your risk. AI is used for exactly one thing: phrasing the findings in plain language, with the facts and numbers locked.

Honesty is the product, so: we can't see phishing emails or fake support calls; we can't see what you sign inside a wallet at the moment you click (your wallet's built-in warnings do that); we can't see exchange accounts; and a brand-new scam contract may not be on any blacklist yet. Canary is an early-warning service, not a guarantee.