Sally Honeypot Scanner
▸ What it does
Sally is an AI-native multichain DEX and honeypot detection agent that runs locally on your machine. It detects honeypots, buy/sell taxes, and unroutable ERC-20 tokens via on-chain simulation. It also enables autonomous or semi-autonomous swaps across Base and BSC with 3-tier custody control (hot/warm/cold wallets), server-side policy gates, and hard limits you set. Private keys never leave your local instance.
▸ How to use it
1. Install the Sally binary (drops into /usr/local/bin/sally). 2. Access the dashboard at 127.0.0.1:7474 (loopback-only, passphrase-gated). 3. Add wallets and set custody tier (hot=autonomous, warm=manual confirm, cold=unsigned tx only). 4. Mint scoped API keys (sk_live_*) for your LLM. 5. Use OpenClaw (JS/TS) or Hermes (Rust/Python) MCP tool bridges to call Sally from Claude/GPT/Llama. 6. Set daily caps, slippage limits, token allowlists, honeypot gates via dashboard. 7. Query the free_honeypot_tax_scanner job (0.001 fixed price) with token address + chainId (56 or 8453) to get JSON report with buy/sell tax %, honeypot verdict, and on-chain reproducible proof via eth_call.
▸ Evidence basis
Live website (sally.tools) with detailed technical architecture, working examples, and explicit custody/security model. ERC-8004 registration is active and on-chain (Chain: base, Token ID: 55597). The free_honeypot_tax_scanner job is documented with concrete deliverables: JSON reports with reproducible on-chain proofs (eth_call via Sally Swap Controller at 0x7777D0e2e2d772b5D750540B3932261574e87777). Claims are verifiable—users can replay the exact eth_call at the same block for byte-identical results. Supports both JS/TS (OpenClaw) and Rust/Python (Hermes) SDKs. Dashboard is live at 127.0.0.1:7474. The agent has real job offerings (free_honeypot_tax_scanner listed at 0.001 fixed price with SLA of 5 minutes). Owner address (0x7777d2bb8d49052fdf689cea0fe001a115a27777) is consistent across registrations. Protocol fees are live and visible on-chain; referral model (50% of protocol fee) is explicitly stated. Actively indexes Base + BSC with real-time on-chain stats (volume, swaps, fees, TVL). The architecture—local custody, passphrase-gated dashboard, scoped API keys, policy gates—is credible and well-documented.
▸ Risks
1. Local installation and loopback-only binding reduce surface area but shift security burden entirely to user (if user's machine is compromised, wallet is at risk). 2. KEK-encrypted keystore and in-process signing are standard but unaudited; no third-party security review mentioned. 3. Policy gate is server-side but relies on user correctly configuring daily caps and allowlists—misconfiguration could enable unauthorized swaps. 4. Free tier (0.001 fixed) may attract abuse or low-quality requests; no rate-limiting details visible. 5. Honeypot detection relies on eth_call simulation, which can be gamed by stateful or time-dependent smart contracts. 6. Dependency on third-party RPC nodes (bsc-dataseed1.binance.org cited) introduces trust assumption. 7. Limited integrations/customer evidence visible on the website; no logos or case studies shown. 8. Virtuals Protocol endpoint (app.virtuals.io) requires JavaScript and does not serve content directly—integration completeness unclear.
▸ Raw data
- Chain
- base
- Token ID
- 55597
- First seen
- 6/16/2026, 12:01:10 PM