Transaction Security

Analyzes a blockchain transaction before / after execution to identify security risks. The API inspects transaction calldata, detects dangerous patterns (e.g. unlimited approvals), evaluates dApp and domain reputation, and returns an overall risk score with detailed explanations. This endpoint is designed for wallets, signing flows, and transaction confirmation screens.

POST /v2/hashdit/transaction-security

Transaction Security

cURL

curl --request POST \
  --url https://service.hashdit.io/v2/hashdit/transaction-security \
  --header 'Content-Type: <content-type>' \
  --header 'X-API-KEY: <x-api-key>' \
  --data '
{
  "chainId": "56",
  "from": "0xB59274D0468eA82Dc48De42488b5dfA5F7fb4A06",
  "to": "0x12BB890508c125661E03b09EC06E404bc9289040",
  "data": "0x095ea7b3...",
  "nonce": 6,
  "value": 0,
  "type": 2,
  "gas": 340800,
  "maxFeePerGas": 3497787365,
  "maxPriorityFeePerGas": 1000000000,
  "dappUrl": "https://mov-ai.com/eh?hello=ke"
}
'

200

{
  "chain": "bsc",
  "from": "0xb59274d0468ea82dc48de42488b5dfa5f7fb4a06",
  "to": "0x12bb890508c125661e03b09ec06e404bc9289040",
  "function": "approve(address,uint256)",
  "params": {
    "0": "0x0000000000001fF3684f28c67538d4D072C22734",
    "1": 1.157920892373162e+77
  },
  "overall_risk": 5,
  "risk_description": "Critical Risk",
  "risk_details": [
    {
      "name": "unlimited_approval",
      "risk": 3,
      "risk_name": "Medium Risk",
      "description": "Unlimited token approval detected."
    },
    {
      "name": "is_in_blist",
      "risk": 5,
      "risk_name": "Critical Risk",
      "description": "There are potential risks in the dApp based on the threat intelligence."
    }
  ],
  "scanned_time": 1766097400,
  "status": {
    "domain_security": "completed",
    "tx_security": "completed"
  }
}

Headers

X-API-KEY · string · required

Your HashDit API key

Content-Type · string · default: application/json · required

Must be set to application/json

X-DITING-API-DEBUG · enum<string>

Optional debug flag (1 enables verbose analysis)

Available options: 0, 1

Body

application/json

Transaction to analyze

chainId · string · required

The network chain ID. See Supported Chains for a complete list of supported networks for this endpoint.

Example:

"56"

from · string · required

Sender address.

Example:

"0xB59274D0468eA82Dc48De42488b5dfA5F7fb4A06"

to · string · required

Target contract address or recipient address.

Example:

"0x12BB890508c125661E03b09EC06E404bc9289040"

data · string · required

Hex-encoded transaction calldata.

Example:

"0x095ea7b3..."

nonce · number · required

Transaction nonce.

Example:

6

value · number · required

Native token value. Measured in wei.

Example:

0

gas · number · required

Gas limit.

Example:

340800

type · enum<number>

Transaction type. E.g. 0 for legacy transactions, 2 for EIP-1559.

Available options: 0, 2

maxFeePerGas · number

Max fee per gas (EIP-1559).

Example:

3497787365

maxPriorityFeePerGas · number

Priority fee per gas (EIP-1559).

Example:

1000000000

dappUrl · string

Originating dApp URL for domain risk analysis.

Example:

"https://mov-ai.com/eh?hello=ke"

Response

200

application/json

Successful response

chain · string

Blockchain identifier.

Example:

"bsc"

from · string

Sender address.

Example:

"0xb59274d0468ea82dc48de42488b5dfa5f7fb4a06"

to · string

Target contract address or recipient address.

Example:

"0x12bb890508c125661e03b09ec06e404bc9289040"

function · string

Decoded function signature.

Example:

"approve(address,uint256)"

params · object

Decoded function parameters.

Example:

{
  "0": "0x0000000000001fF3684f28c67538d4D072C22734",
  "1": 1.157920892373162e+77
}

value · number

Native token value. Measured in wei.

Example:

0

gas_used · number

Gas used (if simulated).

overall_risk · enum<number>

Overall risk score (0-5). Higher values indicate higher risk.

Available options: 0, 1, 2, 3, 4, 5

risk_description · string

Human-readable risk level (e.g. Critical Risk).

Example:

"Critical Risk"

risk_details · object[]

Detailed list of detected risks.

Show child attributes

scanned_time · number

Unix timestamp of analysis.

Example:

1766097400

status · object

Show child attributes

url · string

dApp URL used for domain analysis (if provided).

Example:

"https://mov-ai.com/eh?hello=ke"