Audit proxy upgrade storage API
Compare the Solidity storage layout of an upgradeable implementation with a proposed replacement. Variables are matched by slot and offset, not by name. The types map is used for structs, mappings, dynamic arrays, and byte sizes. compatibility_status is compatible, incompatible, warnings, or indeterminate. risk_level is low, medium, high, or critical. A compatible result is not a claim that the upgrade is safe. No chain is queried.
The Audit proxy upgrade storage operation is part of the Transaction Intent Verification API on BRAINIAC.software. Compare the Solidity storage layout of an upgradeable implementation with a proposed replacement. Variables are matched by slot and offset, not by name. The types map is used for structs, mappings, dynamic arrays, and byte sizes. compatibility_status is compatible, incompatible, warnings, or indeterminate. risk_level is low, medium, high, or critical. A compatible result is not a claim that the upgrade is safe. No chain is queried. It is exposed as POST /api/v1/crypto-security/proxy-upgrade-storage-audit and priced at $0.05 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied transaction calldata, ABI, and declared intent processed locally Limitations: This is static calldata analysis. It does not read chain state, simulate execution, or decide whether a contract is malicious or whether a transaction will succeed. A function is decoded from the caller ABI, or from the standard ERC-20 transfer, transferFrom, approve, and increaseAllowance selectors when no ABI is supplied. Other functions are not inferred. If the selector is unknown, intent_match is indeterminate. Chain ID is accepted as a label and is not checked against a network. Unlimited approvals are the uint256 maximum encoded in the calldata. No allowance is read from a contract. Storage variables are matched by slot and offset. A matching name is not storage identity. A storage result of compatible does not prove that an upgrade is safe or that runtime behavior is unchanged. Struct, mapping, and dynamic-array layouts are compared only from the types map in the request. intent-safety reads the supplied transaction or EIP-712 message. A known selector later in multicall, aggregate, or execute calldata is reported as an inner call and can be a coincidence. storage-slot-grade treats the collision score as a weighted count of overlaps and moves, capped at 100. It is not a measured probability. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Verify transaction intent, Score transaction intent safety, Grade proxy storage slot changes. Open the group documentation for the full request schema, field notes, and response examples before integrating.
/api/v1/crypto-security/proxy-upgrade-storage-auditExample request
curl -i -X POST "https://www.brainiac.software/api/v1/crypto-security/proxy-upgrade-storage-audit" \
-H 'content-type: application/json' \
-H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
--data-binary @- <<'JSON'
{
"proxyPattern": "uups",
"currentMetadata": {
"contractName": "Box",
"compilerVersion": "0.8.24+commit.e11b9ed9"
},
"proposedMetadata": {
"contractName": "BoxV2",
"compilerVersion": "0.8.26+commit.8a97fa7a"
},
"current": {
"storage": [
{
"label": "value",
"offset": 0,
"slot": "0",
"type": "t_uint256",
"contract": "Box.sol:Box"
},
{
"label": "owner",
"offset": 0,
"slot": "1",
"type": "t_address",
"contract": "Box.sol:Box"
},
{
"label": "__gap",
"offset": 0,
"slot": "2",
"type": "t_array(t_uint256)50_storage",
"contract": "Box.sol:Box"
}
],
"types": {
"t_uint256": {
"encoding": "inplace",
"label": "uint256",
"numberOfBytes": "32"
},
"t_uint128": {
"encoding": "inplace",
"label": "uint128",
"numberOfBytes": "16"
},
"t_address": {
"encoding": "inplace",
"label": "address",
"numberOfBytes": "20"
},
"t_array(t_uint256)50_storage": {
"encoding": "inplace",
"label": "uint256[50]",
"numberOfBytes": "1600",
"base": "t_uint256"
},
"t_array(t_uint256)49_storage": {
"encoding": "inplace",
"label": "uint256[49]",
"numberOfBytes": "1568",
"base": "t_uint256"
}
}
},
"proposed": {
"storage": [
{
"label": "value",
"offset": 0,
"slot": "0",
"type": "t_uint256",
"contract": "BoxV2.sol:BoxV2"
},
{
"label": "owner",
"offset": 0,
"slot": "1",
"type": "t_uint256",
"contract": "BoxV2.sol:BoxV2"
},
{
"label": "extra",
"offset": 16,
"slot": "1",
"type": "t_uint128",
"contract": "BoxV2.sol:BoxV2"
},
{
"label": "__gap",
"offset": 0,
"slot": "2",
"type": "t_array(t_uint256)49_storage",
"contract": "BoxV2.sol:BoxV2"
}
],
"types": {
"t_uint256": {
"encoding": "inplace",
"label": "uint256",
"numberOfBytes": "32"
},
"t_uint128": {
"encoding": "inplace",
"label": "uint128",
"numberOfBytes": "16"
},
"t_address": {
"encoding": "inplace",
"label": "address",
"numberOfBytes": "20"
},
"t_array(t_uint256)50_storage": {
"encoding": "inplace",
"label": "uint256[50]",
"numberOfBytes": "1600",
"base": "t_uint256"
},
"t_array(t_uint256)49_storage": {
"encoding": "inplace",
"label": "uint256[49]",
"numberOfBytes": "1568",
"base": "t_uint256"
}
}
}
}
JSONAn unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.
FAQ
- Do I need an API key? No. Pay the listed USDC amount with x402.
- What network? Base (eip155:8453), USDC.
- Is this an official determination? No. Results are for human review against the cited sources.
Related operations
- Verify transaction intent — $0.04 USDC
- Score transaction intent safety — $0.04 USDC
- Grade proxy storage slot changes — $0.04 USDC