AI Web3 Invoicer.

Paste complex blockchain machine code. Get human-readable security analysis in milliseconds powered by AI.

Network

Sender (From)

Target / Program ID

Raw Hex Calldata / Instruction Data

Awaiting Data

Run an analysis to see the human-readable translation.

Transaction Details

Network

Sender

Target

Raw Calldata

No assets identified yet.

How It Works

Paste the Data

Grab the unreadable calldata or instruction payload from your wallet before you hit sign.

AI Analysis

Our edge functions query Gemini AI to cross-reference addresses and decode the smart contract intent.

Sign Safely

Review the color-coded risk assessment. Green means safe transfer, Red means potential drainer.

Frequently Asked Questions

Is this safe? Do you need my private keys?

Readable Receipt is a 100% read-only tool. We never ask for your private keys or seed phrase. We only analyze public blockchain transaction data.

What is "Calldata"?

Calldata is the raw, machine-readable hex code (like 0x095e...) that tells a smart contract what to do. Scammers hide malicious commands inside this unreadable data.

Why do you need the From and To addresses?

Context is everything. By knowing the target contract address, our AI can tell you "You are approving USDC" instead of just "You are approving a token."

Possible Web3 Scam

Learn to recognize the most common Web3 phishing attacks and wallet drainers before you click sign.

The Fake Mint Drainer (EVM)

Scammers clone a popular NFT project's website. When you click Mint, the calldata actually requests permission to transfer all your existing NFTs to their wallet.

Malicious Target: setApprovalForAll(address operator, bool approved)

0xa22cb465000000000000000000000000badc0de000...00000000000000000000000000000000000001

Gasless Permit Phishing (EVM)

A site asks you to simply "Verify your wallet" by signing a message. It costs zero gas, so it feels safe. In reality, you are signing an EIP-2612 Permit that lets them drain your ERC-20 tokens.

Malicious Target: permit() signature

0xd505accf000000000000000000000000attacker_address...

The Infinite Token Approval (EVM)

Many legitimate dApps use this, but malicious ones abuse it. You approve an infinite amount of USDC to save on future gas. If that contract gets hacked later, your wallet gets emptied.

Function: approve() (Max Uint256)

0x095ea7b3000000000000000000000000malicious_address_ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

Fake Airdrop Claim (Solana)

You try to claim a free token airdrop on Solana. The transaction simulates a token arriving, but hidden in the instruction data is a System Program transfer sending your SOL out.

Malicious Target: SystemProgram.transfer (hidden in payload)

Instruction: System Program
Type: Transfer
Destination: ScammerWallet...

Developer Integrations

Integrate the Readable Receipt translation engine directly into your own dApps, wallets, or backend security pipelines.

Response Schema

Our AI engine returns a standardized JSON object you can easily parse in your frontend UI to block malicious transactions automatically.

{
  "summary": "Granting permission to transfer all your NFTs.",
  "actionType": "escalate", // ignore | review | escalate
  "riskLevel": "high",
  "assets": [
    {
      "name": "BoredApeYachtClub",
      "amount": "All"
    }
  ]
}
                    

Backend Integration (Python)

Example showing how to route calldata through a Python backend to keep security checks server-side before serving to the client.

import requests

def analyze_transaction(calldata, from_addr, to_addr):
    url = "https://api.readablereceipt.dev/v1/analyze"
    payload = {
        "network": "EVM",
        "calldata": calldata,
        "from": from_addr,
        "to": to_addr
    }
    
    response = requests.post(url, json=payload)
    return response.json()
                    

Frontend Integration (Next.js / Vanilla TS)

Intercept a user's transaction before it reaches the wallet provider.

const response = await fetch('https://api.readablereceipt.dev/v1/analyze', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
        network: "Solana",
        calldata: "Base58_Instruction_Data...",
        from: "UserPublicKey",
        to: "TargetProgramID"
    })
});

const analysis = await response.json();
if (analysis.actionType === 'escalate') {
    // Block transaction and trigger Red Warning UI
    showWarningModal(analysis.summary);
}
                