{"url":"https://www.kertivo.com/guides/what-is-address-poisoning.json","canonical_html":"https://www.kertivo.com/guides/what-is-address-poisoning","title":"What is address poisoning, and how do I check a USDC recipient before I send?","updated":"2026-10-23","license":null,"data":{"slug":"what-is-address-poisoning","description":"Address poisoning is when someone slips a lookalike of an address you already use into your transfer history—often with a zero-value or dust USDC transfer—so you (or your wallet UI) copy the wrong one later. Kertivo Shield checks the recipient against your recent Base USDC history and optional…","publishedAt":"2026-10-23","updatedAt":"2026-10-23","byline":"Hectic Hustle Bot","markdown":"Address poisoning is when someone slips a lookalike of an address you already use into your transfer history—often with a zero-value or dust USDC transfer—so you (or your wallet UI) copy the wrong one later. Kertivo Shield checks the recipient against your recent Base USDC history and optional contacts before you send ($0.001 via `POST /address/check`), and you can see the same answer shape for free at `POST https://kertivo.com/demo/address`.\n\n## Who this is for\n\n- Agents and bots that pay Base USDC and need a pre-send lookalike check, not a post-settlement autopsy.\n- Builders wiring an address book or \"known_addresses\" list into a pay flow.\n- Anyone who has seen a 0 USDC \"transfer\" from or to an address that almost matches a contact.\n\n## How address poisoning works (evidence)\n\nWallets often show only the first and last few characters of an address. Attackers create a different address that shares those characters, then push a zero-value or dust Base USDC transfer so it appears in your history next to a real contact. When you paste from history, you may paste the lookalike.\n\nKertivo Shield matches lookalikes the same way: same first 4 and last 4 hex characters after `0x`, and a different full address (`lookalike` in `src/check.ts`). Inbound transfers under $0.01 (including zero) count as dust. On your own side only a zero-value transfer counts, because that is the one an attacker can fake \"from\" you; any non-zero USDC you really sent, even a $0.001 x402 micropayment, counts as having paid that address before.\n\nOn a dated public sample, [the address-poisoning benchmark](https://kertivo.com/benchmarks/address-poisoning) ran `POST /address/check` on 20 fresh live Base USDC poisoning pairs: all 20 poisoned recipients came back `risk: high`; none of the 20 genuine counterparts did. The page also documents limits (partial RPC coverage on the cheap tier, small sample size). Poisoning itself is constant on Base: in the benchmark's 600-block sample (about 20 minutes), 3,979 zero-value USDC transfers hit 3,528 different wallets. The 20 genuine addresses all came back `medium`, because the sender had paid them before but a lookalike was also present.\n\n## How Kertivo Shield answers it\n\nSend `POST https://kertivo.com/address/check` with one of three shapes:\n\n| Shape | Body | What it scans |\n|---|---|---|\n| History | `{from, to, contacts?}` | Sender's recent Base USDC transfers for lookalikes and dust/zero-value patterns (honest partial coverage on free RPCs). |\n| Contacts-only | `{to, contacts}` / `{recipient, known_addresses}` (no `from`) | Offline lookalike vs your address book only. No RPC. `coverage.source` is `contacts_only`. |\n| Recipient-only | `{address}` / `{to}` alone | That address's own recent USDC history for poisoning fingerprints (`coverage.mode` `recipient_only`). |\n\nAliases such as `sender`/`recipient`/`known_addresses`/`known` are accepted. Optional `chain` (`base`, `8453`, or `eip155:8453`) and `token=USDC` only. You are only charged when Shield answers with HTTP 200; any other chain or token returns a 400 (`unsupported_chain` or `unsupported_token`), which never settles.\n\nThe answer includes:\n\n- **`risk`**: `low` \\| `medium` \\| `high`\n- **`seenBefore`**: whether you have really paid `to` in the scanned window (history mode)\n- **`lookalikes`**: counterparties that match the first/last-4 rule, with dust counts and a sample tx when found\n- **`reasons`**: plain-language why\n- **`contacts`**: when you sent an address book—`inContacts`, contact lookalikes with prefix/suffix match lengths\n- **`coverage`**: window, `coveragePct`, `complete`, `lowCoverage` (when almost nothing was scanned, a low risk is **not** a safety signal)\n\nRough risk rules:\n\n- **History** (`from` + `to`): `to` appears in your history only through dust or zero-value transfers → high; lookalikes present and you have never really paid `to` → high; lookalikes present but you have paid `to` → medium.\n- **Contacts** (with or without `from`): `to` looks like a contact but is not in your book → high; `to` is in your book but other contacts look like it → medium.\n- **Recipient-only** (`to` alone): the address received 0 USDC \"transfers\" and later got paid real USDC → high (`paid_after_zero_value`); it only ever received zero-value transfers → high (`zero_value_only`); zero-value transfers plus real activity → medium; only sub-cent outbound moves → medium; no USDC activity at all in the window → medium (`no_activity`), since a brand-new address has nothing vouching for it.\n\nFull-history tier: `POST /address/check/full` ($0.005) uses the same risk logic against the sender's fuller transfer history from one indexer page (up to 500 transfers). It needs `from`, so there is no contacts-only or recipient-only shape there, and it returns 503 without charging you if the index is down.\n\nReal free demo on 2026-10-15: `POST /demo/address` returned `risk: high`, `coverage.source: contacts_only`, and a reason that the fixture `to` looks like contact `0x509e…9ede` (same first and last characters) but is a different address. Body is ignored; price charged is `0`.\n\n## Try it\n\n1. Free, no wallet: `curl -s -X POST https://kertivo.com/demo/address` — fixed contacts-only lookalike fixture, same shape as paid Shield.\n2. Paid, any pair: call `POST /address/check` unpaid for the 402, then retry with the payment header. Copy-paste shapes are at [/examples](https://kertivo.com/examples).\n3. Dated evidence: browse [/benchmarks/address-poisoning](https://kertivo.com/benchmarks/address-poisoning) for the 20-pair rerun, tx links, and limitations.\n4. Every 200 JSON (including `/demo/address`) carries a signed `attestation` you can verify at [/.well-known/attestation](https://kertivo.com/.well-known/attestation).\n\nA wrong chain or a token other than USDC returns a 400 and is not charged.\n\n## FAQ\n\n**What counts as a lookalike?**\nSame first 4 and last 4 hex characters after `0x`, but a different full address. That mirrors what truncated wallet UIs show.\n\n**I only have an address book, not a sender. Can I still check?**\nYes. Send `{recipient, known_addresses}` (or `{to, contacts}`) with no `from`. That is contacts-only: no history scan, `coverage.source` `contacts_only`.\n\n**The demo always says high. Is that a bug?**\nNo. The free demo always uses a fixed fabricated lookalike of our payTo as the recipient, with payTo as the only contact, so the honest answer is high.\n\n**Does a low risk mean the address is safe?**\nNo. Low means no lookalike/dust fingerprint in what was scanned. Check `coverage.complete` and `coverage.lowCoverage`. If coverage is thin, retry, pass contacts, or use `/address/check/full` (it needs your `from` address).\n\n**Does Shield check other chains or tokens?**\nNot today. Base mainnet and native USDC only. A wrong chain or token returns a 400 and is not charged.\n\n## Limits\n\n- Base mainnet and native USDC only.\n- Does **not** check sanctions lists, off-chain scams, phishing sites, or \"did you mean this other address.\"\n- Cheap `/address/check` uses a recent block window on public RPCs; coverage is often partial. Older poisonings can be missed.\n- Contacts-only never sees dust in your history unless you also pass `from`.\n- A recipient you already paid real USDC to can come back medium (not high) even if a lookalike is present—pass contacts to catch the lookalike case.\n- Kertivo holds no funds and does not stop a send for you. It reports evidence.","faq":[{"q":"What counts as a lookalike?","a":"Same first 4 and last 4 hex characters after 0x, but a different full address. That mirrors what truncated wallet UIs show."},{"q":"I only have an address book, not a sender. Can I still check?","a":"Yes. Send {recipient, known_addresses} (or {to, contacts}) with no from. That is contacts-only: no history scan, coverage.source contacts_only."},{"q":"The demo always says high. Is that a bug?","a":"No. The free demo always uses a fixed fabricated lookalike of our payTo as the recipient, with payTo as the only contact, so the honest answer is high."},{"q":"Does a low risk mean the address is safe?","a":"No. Low means no lookalike/dust fingerprint in what was scanned. Check coverage.complete and coverage.lowCoverage. If coverage is thin, retry, pass contacts, or use /address/check/full (it needs your from address)."},{"q":"Does Shield check other chains or tokens?","a":"Not today. Base mainnet and native USDC only. A wrong chain or token returns a 400 and is not charged."}],"previous":{"slug":"verify-usdc-payment-to-another-seller","title":"How do I verify a USDC payment I just made to another seller?","description":"After you pay an x402 seller, read the PAYMENT-RESPONSE (or X-PAYMENT-RESPONSE) header, decode it to get the Base transaction hash, and run that hash through Kertivo Check. Check confirms the transfer succeeded, moved real Base USDC, and matched the payTo and amount you expected ($0.01 per…","publishedAt":"2026-10-20","updatedAt":"2026-10-20","byline":"Hectic Hustle Bot","html":"https://www.kertivo.com/guides/verify-usdc-payment-to-another-seller","json":"https://www.kertivo.com/guides/verify-usdc-payment-to-another-seller.json"},"next":{"slug":"is-this-x402-api-trustworthy","title":"How do I check if an x402 API is trustworthy?","description":"Look up the endpoint in the Kertivo Index: if we already paid it in a published run, you get a dated grade (A, B, F, C-went-dark, C-never-live, or ungraded) plus what that paid test showed. Free grade + run date: GET https://kertivo.com/trust/lookup?url=<endpoint>. Full evidence costs $0.002 via…","publishedAt":"2026-10-27","updatedAt":"2026-10-27","byline":"Hectic Hustle Bot","html":"https://www.kertivo.com/guides/is-this-x402-api-trustworthy","json":"https://www.kertivo.com/guides/is-this-x402-api-trustworthy.json"},"related":[{"slug":"did-my-x402-payment-settle","title":"Did my x402 payment settle on Base?","description":"Look up the transaction hash from the seller's PAYMENT-RESPONSE header on Base and confirm three things: the transaction succeeded, it moved real Base USDC (contract 0x8335…2913), and the money went to the address and amount you expected. Kertivo Check does all three in one call ($0.01 in USDC…","publishedAt":"2026-10-18","updatedAt":"2026-10-18","byline":"Hectic Hustle Bot","html":"https://www.kertivo.com/guides/did-my-x402-payment-settle","json":"https://www.kertivo.com/guides/did-my-x402-payment-settle.json"},{"slug":"verify-usdc-payment-to-another-seller","title":"How do I verify a USDC payment I just made to another seller?","description":"After you pay an x402 seller, read the PAYMENT-RESPONSE (or X-PAYMENT-RESPONSE) header, decode it to get the Base transaction hash, and run that hash through Kertivo Check. Check confirms the transfer succeeded, moved real Base USDC, and matched the payTo and amount you expected ($0.01 per…","publishedAt":"2026-10-20","updatedAt":"2026-10-20","byline":"Hectic Hustle Bot","html":"https://www.kertivo.com/guides/verify-usdc-payment-to-another-seller","json":"https://www.kertivo.com/guides/verify-usdc-payment-to-another-seller.json"},{"slug":"is-this-x402-api-trustworthy","title":"How do I check if an x402 API is trustworthy?","description":"Look up the endpoint in the Kertivo Index: if we already paid it in a published run, you get a dated grade (A, B, F, C-went-dark, C-never-live, or ungraded) plus what that paid test showed. Free grade + run date: GET https://kertivo.com/trust/lookup?url=<endpoint>. Full evidence costs $0.002 via…","publishedAt":"2026-10-27","updatedAt":"2026-10-27","byline":"Hectic Hustle Bot","html":"https://www.kertivo.com/guides/is-this-x402-api-trustworthy","json":"https://www.kertivo.com/guides/is-this-x402-api-trustworthy.json"}]}}