AntFleet

Disagreement · 74ff1b9c-anthropic-0

Basescan tokenholderlist endpoint requires PRO API key — growth skill will silently fail

solo Opus
repo 6f7fc663·PR #28·reviewed 1 week ago

Opus finding

Basescan tokenholderlist endpoint requires PRO API key — growth skill will silently fail

mediumbughigh
  • skills/vvvkernel-growth/SKILL.md:20-23
The Basescan `token / tokenholderlist` endpoint is a paid (PRO tier) endpoint and also requires an `apikey=` query parameter. The skill instructs WebFetch to call it with no API key and treats it as free/read-only (similar to the audit skill's claim that 'no key needed for source fetch'). In practice this URL will return an error JSON ({status:'0', message:'NOTOK'}) rather than a holder count, so the 'holders:<n>' log line and the holder metric fed into the Venice prompt will be wrong/empty every run. Additionally `offset=1` only returns one row, which cannot yield a total holder count regardless.

Recommendation

Either (a) drop the holder-count step, (b) document that BASESCAN_API_KEY is required and append `&apikey=$BASESCAN_API_KEY`, and use a free endpoint such as `stats/tokensupply` plus an indexer (Dune/Covalent) for holder counts, or (c) use `offset=10000` with pagination to actually count holders. Update the skill text accordingly.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →

From the same review

These findings passed the unanimous gate on the same PR review. The disagreement above was filtered out; the findings below were posted.