Crypto & Web3 Security

class Web3SafetyGate {
  constructor(apiKey) {
    this.apiKey = apiKey;
    this.baseUrl = 'https://scamverify.ai/api/v1';
  }

  async checkUrl(url) {
    const response = await fetch(`${this.baseUrl}/url/lookup`, {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${this.apiKey}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ url }),
    });

    if (!response.ok) throw new Error(`API error: ${response.status}`);
    return response.json();
  }

  async checkPhone(phoneNumber) {
    const response = await fetch(`${this.baseUrl}/phone/lookup`, {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${this.apiKey}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ phone_number: phoneNumber }),
    });

    if (!response.ok) throw new Error(`API error: ${response.status}`);
    return response.json();
  }

  async preConnectCheck(dappUrl) {
    const result = await this.checkUrl(dappUrl);

    const assessment = {
      url: dappUrl,
      riskScore: result.risk_score,
      verdict: result.verdict,
      safe: false,
      warnings: [],
    };

    // Strict thresholds for wallet connections
    if (result.risk_score >= 30) {
      assessment.warnings.push({
        level: 'danger',
        message: `This site has a risk score of ${result.risk_score}/100. Do not connect your wallet.`,
        detail: result.explanation,
      });
      return assessment;
    }

    if (result.verdict === 'phishing' || result.verdict === 'malware') {
      assessment.warnings.push({
        level: 'danger',
        message: `This site has been identified as ${result.verdict} by threat intelligence sources.`,
      });
      return assessment;
    }

    // Check for domain age and suspicious patterns
    if (result.signals?.domain_age_days < 30) {
      assessment.warnings.push({
        level: 'caution',
        message: 'This domain was registered less than 30 days ago.',
      });
    }

    assessment.safe = assessment.warnings.length === 0 ||
      assessment.warnings.every(w => w.level === 'caution');

    return assessment;
  }

  async verifyOtcCounterparty(phoneNumber) {
    const result = await this.checkPhone(phoneNumber);

    return {
      phone: phoneNumber,
      riskScore: result.risk_score,
      lineType: result.signals.line_type,
      carrier: result.signals.carrier,
      ftcComplaints: result.signals.ftc_complaints,
      isDisposable: result.signals.line_type === 'voip' && result.risk_score >= 30,
      safe: result.risk_score < 40 && result.signals.ftc_complaints === 0,
      explanation: result.explanation,
    };
  }
}

// Usage: Pre-check before wallet connection (browser extension or DApp)
const gate = new Web3SafetyGate(process.env.SCAMVERIFY_API_KEY);

// API endpoint for a wallet browser extension
app.post('/api/safety/pre-connect', async (req, res) => {
  const { url } = req.body;

  const check = await gate.preConnectCheck(url);

  if (!check.safe) {
    return res.json({
      allow: false,
      warnings: check.warnings,
      recommendation: 'Do not connect your wallet to this site.',
    });
  }

  return res.json({
    allow: true,
    riskScore: check.riskScore,
  });
});

// API endpoint for P2P trade counterparty verification
app.post('/api/safety/verify-counterparty', async (req, res) => {
  const { phone } = req.body;

  const check = await gate.verifyOtcCounterparty(phone);

  if (!check.safe) {
    return res.json({
      proceed: false,
      reason: check.explanation,
      signals: {
        isDisposable: check.isDisposable,
        ftcComplaints: check.ftcComplaints,
        lineType: check.lineType,
      },
    });
  }

  return res.json({
    proceed: true,
    riskScore: check.riskScore,
    carrier: check.carrier,
  });
});

import requests
import os

class Web3SafetyGate:
    def __init__(self, api_key: str):
        self.api_key = api_key
        self.base_url = "https://scamverify.ai/api/v1"

    def _call_api(self, endpoint: str, body: dict) -> dict:
        response = requests.post(
            f"{self.base_url}{endpoint}",
            headers={
                "Authorization": f"Bearer {self.api_key}",
                "Content-Type": "application/json",
            },
            json=body,
        )
        response.raise_for_status()
        return response.json()

    def pre_connect_check(self, dapp_url: str) -> dict:
        result = self._call_api("/url/lookup", {"url": dapp_url})

        if result["risk_score"] >= 30:
            return {
                "safe": False,
                "risk_score": result["risk_score"],
                "reason": result["explanation"],
            }

        if result["verdict"] in ("phishing", "malware"):
            return {
                "safe": False,
                "risk_score": result["risk_score"],
                "reason": f"Site classified as {result['verdict']}",
            }

        return {
            "safe": True,
            "risk_score": result["risk_score"],
            "verdict": result["verdict"],
        }

    def verify_otc_counterparty(self, phone_number: str) -> dict:
        result = self._call_api("/phone/lookup", {"phone_number": phone_number})

        is_disposable = (
            result["signals"]["line_type"] == "voip"
            and result["risk_score"] >= 30
        )

        return {
            "safe": result["risk_score"] < 40
                and result["signals"]["ftc_complaints"] == 0,
            "risk_score": result["risk_score"],
            "is_disposable": is_disposable,
            "line_type": result["signals"]["line_type"],
            "explanation": result["explanation"],
        }