Transaction Security — EVM / TRON Flattened

POST

hashdit

transaction-security

curl --request POST \
  --url https://service.hashdit.io/v2/hashdit/transaction-security \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --data '{
    "dapp_url": "https://pancakeswap.finance/swap",
    "evm_transactions": [
      {
        "chain_id": 56,
        "from": "0x8894E0a0c962CB723c1976a4421c95949bE2D4E3",
        "to": "0x55d398326f99059ff775485246999027b3197955",
        "value": "0",
        "data": "0x095ea7b300000000000000000000000010ed43c718714eb63d5aa57b78b54704e256024effffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
      }
    ]
  }'

curl --request POST \
  --url https://service.hashdit.io/v2/hashdit/transaction-security \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --data '{
    "evm_transactions": [
      {
        "name": "Native Transfer of 1 BNB",
        "chain_id": "56",
        "from": "0x000000000000000000000000000000000000dead",
        "to": "0x6ad549e6312114e646f30cDDde75e15a96d86233",
        "value": "1000000000000000000",
        "data": "0x",
        "gasLimit": 21000
      }
    ]
  }'

curl --request POST \
  --url https://service.hashdit.io/v2/hashdit/transaction-security \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --data '{
    "evm_transactions": [
      {
        "name": "ERC20 Transfer 1 BUSD",
        "chain_id": "56",
        "from": "0xD920d10d29Ea69F91859Af3C495F25F7E7acD953",
        "to": "0x55d398326f99059ff775485246999027b3197955",
        "value": "0x0",
        "block_height": "79151135",
        "data": "0xa9059cbb0000000000000000000000006ad549e6312114e646f30cddde75e15a96d862330000000000000000000000000000000000000000000000000de0b6b3a7640000",
        "gasLimit": "60000"
      }
    ]
  }'

curl --request POST \
  --url https://service.hashdit.io/v2/hashdit/transaction-security \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --data '{
    "dapp_url": "https://app.tronlink.org/send",
    "evm_transactions": [
      {
        "chain_id": "tron",
        "from": "TRYtrEkTFiZbuuzt7o7ac7TVeEC5PLsnQa",
        "to": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t",
        "value": "0",
        "data": "0xa9059cbb000000000000000000000000aae8e079b632f89a3591a3c2264076a8e1536f570000000000000000000000000000000000000000000000000000000000989680",
        "gas": "65000"
      }
    ]
  }'

{
  "code": "0",
  "status": "ok",
  "data": {
    "exec_summary": {
      "result_code": "000000000",
      "result_description": "Successful simulation.",
      "error_data": null
    },
    "results": [
      {
        "revert": false,
        "platform": "bsc",
        "approve_changes": [
          {
            "token_address": "0x55d398326f99059ff775485246999027b3197955"
          }
        ]
      }
    ],
    "transaction_info": {
      "transaction_type": "approve",
      "primary_action": "approve",
      "actions": [
        "approve"
      ],
      "decoded_call": {
        "selector": "0x095ea7b3",
        "function_name": "approve",
        "function_signature": "approve(address,uint256)",
        "params": [
          {
            "name": "spender",
            "type": "address",
            "value": "0x10ed43c718714eb63d5aa57b78b54704e256024e"
          },
          {
            "name": "amount",
            "type": "uint256",
            "value": "115792089237316195423570985008687907853269984665640564039457584007913129639935"
          }
        ]
      }
    },
    "security": {
      "overall_score": 3,
      "overall_risk_level": "Medium Risk",
      "recommended_action": "WARN",
      "risk_details": [
        {
          "name": "tx_unlimited_approval",
          "description": "Grants the spender an unlimited allowance."
        }
      ]
    }
  }
}

Synchronous endpoint

Networks: all supported EVM chains, plus TRON. See Supported Chains.

Assess a transaction before signing, identify the requested action, and return a direct ALLOW, WARN, or BLOCK recommendation.

This established integration keeps its current request and response field names. Do not rename protocol or simulation fields such as gasLimit, tokenName, or tokenPriceUSD.

Forwarding an unsigned TronWeb transaction? Use TRON Raw for a separate request form.

Quick Start

curl --request POST \
  --url https://service.hashdit.io/v2/hashdit/transaction-security \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --data '{
    "dapp_url": "https://pancakeswap.finance/swap",
    "evm_transactions": [
      {
        "chain_id": 56,
        "from": "0x8894E0a0c962CB723c1976a4421c95949bE2D4E3",
        "to": "0x55d398326f99059ff775485246999027b3197955",
        "value": "0",
        "data": "0x095ea7b300000000000000000000000010ed43c718714eb63d5aa57b78b54704e256024effffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
      }
    ]
  }'

curl --request POST \
  --url https://service.hashdit.io/v2/hashdit/transaction-security \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --data '{
    "evm_transactions": [
      {
        "name": "Native Transfer of 1 BNB",
        "chain_id": "56",
        "from": "0x000000000000000000000000000000000000dead",
        "to": "0x6ad549e6312114e646f30cDDde75e15a96d86233",
        "value": "1000000000000000000",
        "data": "0x",
        "gasLimit": 21000
      }
    ]
  }'

curl --request POST \
  --url https://service.hashdit.io/v2/hashdit/transaction-security \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --data '{
    "evm_transactions": [
      {
        "name": "ERC20 Transfer 1 BUSD",
        "chain_id": "56",
        "from": "0xD920d10d29Ea69F91859Af3C495F25F7E7acD953",
        "to": "0x55d398326f99059ff775485246999027b3197955",
        "value": "0x0",
        "block_height": "79151135",
        "data": "0xa9059cbb0000000000000000000000006ad549e6312114e646f30cddde75e15a96d862330000000000000000000000000000000000000000000000000de0b6b3a7640000",
        "gasLimit": "60000"
      }
    ]
  }'

curl --request POST \
  --url https://service.hashdit.io/v2/hashdit/transaction-security \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --data '{
    "dapp_url": "https://app.tronlink.org/send",
    "evm_transactions": [
      {
        "chain_id": "tron",
        "from": "TRYtrEkTFiZbuuzt7o7ac7TVeEC5PLsnQa",
        "to": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t",
        "value": "0",
        "data": "0xa9059cbb000000000000000000000000aae8e079b632f89a3591a3c2264076a8e1536f570000000000000000000000000000000000000000000000000000000000989680",
        "gas": "65000"
      }
    ]
  }'

{
  "code": "0",
  "status": "ok",
  "data": {
    "exec_summary": {
      "result_code": "000000000",
      "result_description": "Successful simulation.",
      "error_data": null
    },
    "results": [
      {
        "revert": false,
        "platform": "bsc",
        "approve_changes": [
          {
            "token_address": "0x55d398326f99059ff775485246999027b3197955"
          }
        ]
      }
    ],
    "transaction_info": {
      "transaction_type": "approve",
      "primary_action": "approve",
      "actions": [
        "approve"
      ],
      "decoded_call": {
        "selector": "0x095ea7b3",
        "function_name": "approve",
        "function_signature": "approve(address,uint256)",
        "params": [
          {
            "name": "spender",
            "type": "address",
            "value": "0x10ed43c718714eb63d5aa57b78b54704e256024e"
          },
          {
            "name": "amount",
            "type": "uint256",
            "value": "115792089237316195423570985008687907853269984665640564039457584007913129639935"
          }
        ]
      }
    },
    "security": {
      "overall_score": 3,
      "overall_risk_level": "Medium Risk",
      "recommended_action": "WARN",
      "risk_details": [
        {
          "name": "tx_unlimited_approval",
          "description": "Grants the spender an unlimited allowance."
        }
      ]
    }
  }
}

More Request Examples

The examples below use the default simulate: true. Send exactly one flattened transaction in evm_transactions.

EVM

Unlimited Approval
Native Transfer
ERC-20 Transfer

{
  "dapp_url": "https://pancakeswap.finance/swap",
  "evm_transactions": [
    {
      "chain_id": 56,
      "from": "0x8894E0a0c962CB723c1976a4421c95949bE2D4E3",
      "to": "0x55d398326f99059ff775485246999027b3197955",
      "value": "0",
      "data": "0x095ea7b300000000000000000000000010ed43c718714eb63d5aa57b78b54704e256024effffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
    }
  ]
}

{
  "evm_transactions": [
    {
      "name": "Native Transfer of 1 BNB",
      "chain_id": "56",
      "from": "0x000000000000000000000000000000000000dead",
      "to": "0x6ad549e6312114e646f30cDDde75e15a96d86233",
      "value": "1000000000000000000",
      "data": "0x",
      "gasLimit": 21000
    }
  ]
}

{
  "evm_transactions": [
    {
      "name": "ERC20 Transfer 1 BUSD",
      "chain_id": "56",
      "from": "0xD920d10d29Ea69F91859Af3C495F25F7E7acD953",
      "to": "0x55d398326f99059ff775485246999027b3197955",
      "value": "0x0",
      "block_height": "79151135",
      "data": "0xa9059cbb0000000000000000000000006ad549e6312114e646f30cddde75e15a96d862330000000000000000000000000000000000000000000000000de0b6b3a7640000",
      "gasLimit": "60000"
    }
  ]
}

TRON

TRON Flattened

{
  "dapp_url": "https://app.tronlink.org/send",
  "evm_transactions": [
    {
      "chain_id": "tron",
      "from": "TRYtrEkTFiZbuuzt7o7ac7TVeEC5PLsnQa",
      "to": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t",
      "value": "0",
      "data": "0xa9059cbb000000000000000000000000aae8e079b632f89a3591a3c2264076a8e1536f570000000000000000000000000000000000000000000000000000000000989680",
      "gas": "65000"
    }
  ]
}

Request Fields

string

required

Your HashDit API key. Missing or invalid keys return HTTP 401. Keep the key on a trusted server.

string

Full URL of the dApp that initiated the transaction. Recommended because the domain can provide a risk signal even when the destination contract is new. Alias: dappUrl.

object[]

required

Exactly one flattened transaction. Use this shape for EVM, or for TRON when you have already converted the transaction into the common format. Alias: transactions.

Show EVM / TRON flattened transaction fields

Only chain_id, from, and to are required. In production, send the complete transaction object available to the wallet so the analysis matches what the user is being asked to sign.

string

required

Network chain ID, such as 1 or "56". JSON integers and strings are accepted. Use "tron" or 728126428 for TRON. Alias: chainId. See Supported Chains.

string

required

Signer’s address: a 0x address on EVM chains or a Base58 T... address on TRON.

string

required

Target contract or recipient address.

string

Native asset amount in the smallest unit: wei on EVM and sun on TRON. JSON integers and numeric strings are accepted. Defaults to 0.

string

Hex-encoded calldata. Use "0x" for a plain transfer. Alias: input; send only one of the two names.

string

Gas limit. JSON integers and numeric strings are accepted. Alias: gasLimit.

string

Gas price for a legacy transaction. JSON integers and numeric strings are accepted. Alias: gasPrice.

string

EIP-1559 maximum fee per gas, normally used with type: 2. Alias: maxFeePerGas.

string

EIP-1559 priority fee per gas. Alias: maxPriorityFeePerGas.

string

Sender nonce. JSON integers and numeric strings are accepted.

string

EIP-2718 transaction type, normally 0 or 2. JSON integers and numeric strings are accepted.

string

Block to simulate against. Defaults to the latest block; TRON always uses current state. Alias: blockHeight.

string

Optional client-defined label. It is returned unchanged and is not used during analysis.

TRON-only flattened fieldsThese fields apply only when evm_transactions[].chain_id identifies TRON. Prefer tron_transactions when forwarding a transaction created by TronWeb.

string

TRC-10 asset ID. Send together with token_value. Alias: tokenId.

string

TRC-10 amount. Alias: tokenValue or call_token_value.

object

Optional Stake 2.0 freeze or unfreeze operation. If you provide freeze_balance, include action, resource, and amount. Alias: freezeBalance.

Show Freeze balance fields

string

freeze or unfreeze.

string

BANDWIDTH, ENERGY, or TRON_POWER; numeric values 0, 1, or 2 are also accepted.

string

Amount in sun. JSON integers and numeric strings are accepted.

object

Optional Stake 2.0 delegate or undelegate operation. If you provide delegate_resource, include action, resource, and amount. Alias: delegateResource.

Show Delegate resource fields

string

delegate or undelegate.

string

BANDWIDTH or ENERGY; numeric values 0 or 1 are also accepted.

string

Amount in sun. JSON integers and numeric strings are accepted.

boolean

Set to true to claim matured Stake 2.0 unfreeze entries. Alias: withdrawExpireUnfreeze.

boolean

default:"true"

Keep true for the fullest assessment. Set to false only when you want a verdict without execution results and accept that execution-dependent risk signals are unavailable.

Response Fields

string

required

API result code. "0" indicates success; non-zero values indicate an error.

string

required

Request status. A successful completed response returns "ok".

object

required

Summary of the action requested by the submitted transaction. This describes intent; it is separate from the security verdict and simulation result, and remains available when simulation is disabled or cannot complete.

Show Transaction information fields

string

required

Canonical business category for the transaction title and primary client flow. Use other when the request does not map to a more specific category.

string

required

Main recognized action, such as approve, transfer, swap, or contract_call. A supported swap takes precedence; otherwise, multiple distinct business actions produce batch.

string[]

required

Recognized actions in first-seen order, without duplicates. Execution wrappers appear before the command actions they contain.

object | null

required

Decoded top-level contract call. It is null for native transfers and when no ABI-style call can be decoded.

string | null

required

Four-byte function selector with a 0x prefix, or null when unavailable.

string | null

required

Decoded function name, or null when it cannot be determined.

string | null

required

Canonical function signature, such as approve(address,uint256), or null when unavailable.

object[] | null

required

Ordered decoded parameters. An empty array means the decoded function has no parameters; null means the parameters could not be decoded.

string

required

Parameter name. It can be an empty string when the ABI does not provide one.

string

required

Canonical ABI type, such as address, uint256, bytes, or an array type.

string | boolean | array

required

Decoded value. Integers and fixed-point values are decimal strings in raw units; bytes are hex strings; booleans are JSON booleans; arrays preserve their original order. Tuples are arrays of parameter objects with the same name, type, and value fields.

integer

required

Risk score from 0 to 5; higher values indicate greater risk.

string

required

Human-readable risk level corresponding to overall_score.

string

Signing-flow decision: ALLOW, WARN, or BLOCK.

object[]

Triggered security findings. Use name for logic and description for display.

Show Risk detail fields

string

required

Stable finding identifier for application logic.

string

required

Human-readable explanation to show to the user.

How to Use the Response

Transaction intent is not a security verdict. Use transaction_info to explain what the user is being asked to do, security to decide whether the transaction is safe to sign, and simulation results only to describe predicted execution effects. Use recommended_action as the signing decision:

Value	Meaning	Suggested UI behavior
`ALLOW`	No risk worth interrupting the user for was detected.	Continue to the normal confirmation screen.
`WARN`	The user should understand one or more risks before signing.	Show every `risk_details[].description` and require confirmation.
`BLOCK`	Strong evidence indicates that the transaction may harm the user.	Advise against signing and stop the default flow.

Show every risk_details[].description so the user understands why a warning or block was returned. Use risk_details[].name for application logic because identifiers are stable while descriptions can improve over time. Use transaction_type for the transaction title and main client flow:

`transaction_type`	Suggested title
`transfer`	Transfer
`swap`	Swap
`approve`	Approve
`revoke`	Revoke
`contract_deployment`	Contract deployment
`mint`	Mint
`sale`	Sale
`listing`	Listing
`make_offer`	Make offer
`place_bid`	Place bid
`signature_request`	Signature request
`other`	Transaction

An explicit other is authoritative; do not replace it by matching primary_action, a function name, a selector, or a risk finding. If an older response omits transaction_type, you may fall back to your existing title logic. Use a generic title for an unrecognized future category. primary_action and actions provide more detailed intent and can include values such as execute, batch, contract_call, or unknown. Clients should accept additional action values so new classifications do not break an existing integration. Use decoded_call when available for a more specific display, and preserve large decoded integer values as strings to avoid precision loss.

Risk Level Reference

Score	Risk level	Recommended action
`0`	`No Obvious Risk`	`ALLOW`
`1`	`Caution`	`ALLOW`
`2`	`Low Risk`	`WARN`
`3`	`Medium Risk`	`WARN`
`4`	`High Risk`	`BLOCK`
`5`	`Significant Risk`	`BLOCK`

Numeric Fields

Every int | string field in this request — value, gas, gas_price, max_fee_per_gas, max_priority_fee_per_gas, nonce, type, block_height, token_id, token_value, and the amount inside freeze_balance and delegate_resource — accepts all three of:

Form	Example
JSON number	`1000000`
Decimal string	`"1000000"`
`0x`-prefixed hex	`"0xf4240"`

The three are equivalent. Send strings above 2^53 so JavaScript callers do not lose precision. A hex string must carry the 0x prefix: "f4240" is a 400.

Errors and Retry Guidance

HTTP status	Example status	When it happens
`400`	`invalid request`	A required field is missing, a value cannot be read, two aliases disagree, more than one transaction was sent, or the chain is unsupported.
`401`	Authentication error	`X-API-KEY` is missing or invalid.
`429`	`too many requests`	The caller exceeded its request limit.
`500`	`internal server error`	HashDit could not complete the request.

Correct 400 errors before retrying. Back off with jitter after 429; retry 500 only a bounded number of times. Error responses include a detail or message explaining the failure:

{
  "code": "-1",
  "status": "invalid request",
  "detail": "send exactly one transaction; batch analysis is not supported"
}

API Documentation

Endpoints

Transaction Security — EVM / TRON Flattened

Quick Start

More Request Examples

EVM

TRON

Request Fields

Response Fields

How to Use the Response

Risk Level Reference

Numeric Fields

Errors and Retry Guidance

​Quick Start

​More Request Examples

​EVM

​TRON

​Request Fields

​Response Fields

​How to Use the Response

​Risk Level Reference

​Numeric Fields

​Errors and Retry Guidance

Quick Start

More Request Examples

EVM

TRON

Request Fields

Response Fields

How to Use the Response

Risk Level Reference

Numeric Fields

Errors and Retry Guidance