Address Poisoning Detection
Provides contextual analysis of addresses and tokens to detect spoofing-based poisoning attacks. Evaluates whether an address or token is dangerous in the context of a specific user and asset.
curl --request POST \
--url https://service.hashdit.io/v2/hashdit/address-poisoning \
--header 'Content-Type: application/json' \
--header 'X-API-KEY: <x-api-key>' \
--data '
{
"chainId": "56",
"address": "0x364e5f2a4e90cbaf0a2ee58f602fa9c5d70121f5",
"userAddress": "0x364e5f2a4e90cbaf0a2ee58f602fa9c5d70121f5",
"tokenAddress": "0x364e5f2a4e90cbaf0a2ee58f602fa9c5d70121f5"
}
'{
"code": "0",
"status": "ok",
"data": {
"target_address": {
"is_poisoning": "0",
"mimics_user": "0",
"mimics_exchange": "0"
},
"token_address": {
"is_poisoning": "0",
"mimics_top_token": "0",
"matched_token": ""
},
"user_address_input": "0x364e5f2a4e90cbaf0a2ee58f602fa9c5d70121f5",
"target_address_input": "0x364e5f2a4e90cbaf0a2ee58f602fa9c5d70121f5",
"token_address_input": "0x364e5f2a4e90cbaf0a2ee58f602fa9c5d70121f5"
}
}camelCase and snake_case. See Request Field Names."0" and "1", not booleans. "0" is truthy in JavaScript. Compare against "1".Request
OnlychainId and address are required.
| Field | Required | When omitted |
|---|---|---|
chainId | Yes | — |
address | Yes | — |
userAddress | No | Mimicry-against-the-user check is skipped. |
tokenAddress | No | Token-mimicry check is skipped. |
chainId also accepts "tron", "trx", "ct_195", or "728126428" for TRON. See Supported Chains.
Integration Notes
- Branch on
is_poisoning. It is the aggregate verdict. The individual flags explain why — use them for the warning copy, not for the decision. - Compare against the string
"1". Every flag is a string.if (row.is_poisoning)is always true. userAddressunlocks the highest-signal check. Without it,mimics_usercan only ever be"0"— and that is the check that catches the classic poisoning attack. Send the connected wallet address whenever you have it."0"means nothing was detected, not that the address is verified safe. It is not a positive safety claim.token_addressis{}when you did not ask about a token. Test for the flag’s presence, not for a truthy object.
Headers
Your HashDit API key
Body
Address and token context for poisoning analysis
The network chain ID. EVM numeric IDs, or for TRON any of "tron", "trx", "ct_195", or "728126428". See Supported Chains for the full list.
"56"
The address to analyze. 0x hex on EVM chains; base58 (T…, 34 characters) on TRON.
"0x938915fd4b7c188a211113ed655ae1f18c334146"
Optional. The connected wallet address. When omitted, the mimicry-against-the-user check is skipped.
"0x938915fd4b7c188a21ad73ed655ae1f18c334146"
Optional. Token contract to check for impersonation. When omitted, the token-mimicry check is skipped.
"0x55d39f326f99059ff775485246999027b3197956"
Was this page helpful?