Compare contract bytecode API

Compare two caller-supplied EVM bytecodes. mode exact compares every byte. An omitted mode is exact. mode normalized masks only the supplied immutable ranges and a trailing Solidity CBOR metadata suffix when bytecodeKind is not creation and that suffix is present on both bytecodes. comparison_status is identical, different, partially_comparable, or invalid. Hashes are keccak256 of the supplied bytes. Similarity is the share of equal compared bytes, truncated to 4 decimal places. A difference is not a judgment that either bytecode is malicious, and similar bytecode is not equivalent behavior. No source code is verified and no chain is queried.

The Compare contract bytecode operation is part of the Contract Bytecode Compare API on BRAINIAC.software. Compare two caller-supplied EVM bytecodes. mode exact compares every byte. An omitted mode is exact. mode normalized masks only the supplied immutable ranges and a trailing Solidity CBOR metadata suffix when bytecodeKind is not creation and that suffix is present on both bytecodes. comparison_status is identical, different, partially_comparable, or invalid. Hashes are keccak256 of the supplied bytes. Similarity is the share of equal compared bytes, truncated to 4 decimal places. A difference is not a judgment that either bytecode is malicious, and similar bytecode is not equivalent behavior. No source code is verified and no chain is queried. It is exposed as POST /api/v1/contract-security/contract-bytecode-compare and priced at $0.05 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied EVM bytecode processed locally Limitations: Hashes are keccak256 of the supplied bytes. No chain state is read. A difference is not a judgment that either bytecode is malicious, and similar bytecode is not equivalent behavior. Normalization masks only caller-supplied immutable ranges and a reliably identified compiler metadata suffix. No source code is verified. bytecode-structure-diff compares opcodes. PUSH immediates change the divergence list and do not change the similarity index. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Diff bytecode structure. Open the group documentation for the full request schema, field notes, and response examples before integrating.

POST$0.05 USDC
/api/v1/contract-security/contract-bytecode-compare

Example request

curl -i -X POST "https://www.brainiac.software/api/v1/contract-security/contract-bytecode-compare" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "reference": "0x6001600055aabba2646970667358220000000000000000000000000000000000000000000000000000000000000000000164736f6c63430008180033",
  "candidate": "0x6002600055aabba2646970667358220000000000000000000000000000000000000000000000000000000000000000000264736f6c634300081a0033",
  "bytecodeKind": "runtime",
  "mode": "normalized",
  "compilerMetadata": {
    "compiler": "solc",
    "version": "0.8.24"
  },
  "immutableRanges": [
    {
      "start": 5,
      "end": 7
    }
  ],
  "expectedDifferences": [
    {
      "start": 1,
      "end": 2
    }
  ]
}
JSON

An unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.

FAQ

  • Do I need an API key? No. Pay the listed USDC amount with x402.
  • What network? Base (eip155:8453), USDC.
  • Is this an official determination? No. Results are for human review against the cited sources.

Related APIs

Contract Bytecode Compare APIFull docsHow it works