The Stack Audit · Registry

Every platform, as a feed.

The whole board as one machine-readable file, keyed by contract address. Free to consume, so any tool can resolve a token to the platform that deployed it and whether that platform holds up.

GET https://thestackaudit.xyz/registry.json
CC-BYCORS openno key requiredregenerated on every board update

The layer beneath the coin scanners. A honeypot scanner tells you whether one coin can be sold. It cannot tell you what platform minted that coin, or whether that platform's factory is upgradeable under one key, whether its liquidity is structurally locked, or whether it leaks a provider key. This feed answers that second question for every platform on the board, so the tools that answer the first can cite it.

Start hereResolve a token

You have a token address and want to know what made it. The feed is keyed by every contract address the board knows, so resolution is a lookup, not a scan.

  1. Get the token's deployer. Read its on-chain creator, or the factory that emitted its launch event. That address is your key.
  2. Lowercase it and look it up in address_index. A hit returns {platform, role}. An alias hit returns a misattribution warning instead.
  3. Fetch the platform record by its id for the full verdict: tier, status, and the structured assessment.
// one file, cached ~5 min, safe to fetch from the browser
const reg = await (await fetch("https://thestackaudit.xyz/registry.json")).json();

function resolve(address) {
  const hit = reg.address_index[address.toLowerCase()];
  if (!hit)      return { known: false };            // not on the board
  if (hit.alias) return { warning: hit.note };       // misattribution flag
  const platform = reg.platforms.find(p => p.id === hit.platform);
  return { role: hit.role, platform };
}

// a fresh NOXA coin's factory:
resolve("0xDd84fDdEA1206115B37dbBC0ba5721530E1bA9C5");
// -> { role: "factory", platform: { name: "NOXA", tier: "t3", status: "relaunched",
//      assessment: { lp_custody: "locked", owner_model: "single_eoa", ... } } }

The alias branch is the part no coin scanner produces. Looking up a token that borrows a trusted name returns the correction, not a false match: 0xb541610e resolves to a warning that some "Rooket" tokens are actually NOXA launches, so a downstream tool never mis-attributes them.

ShapeWhat's in the file

fieldwhat it is
schema_versionSemVer. Pin to the major. Breaking field changes bump major; content changes do not.
generated_atISO-8601 UTC of the last rebuild.
chain{ name, chain_id: 4663 }.
counts{ platforms, launchpads, protocols, tools }.
definitionsEvery enum's allowed values, inline, so you need no prose to validate.
platforms[]One record per platform. The verdict lives here.
address_indexLowercased address to {platform, role}, or an alias warning. Your entry point.
aliases[]The misattribution layer: name collisions, mislabelled tokens, mirror domains, wallet-not-chain.

A platform record:

{
  "id": "noxa",
  "name": "NOXA",
  "category": "launchpad",
  "tier": "t3",
  "tier_label": "Contracts sound, operations unverified",
  "scan_depth": "contract",
  "checked": "2026-07-22",
  "status": "relaunched",
  "assessment": {
    "upgradeable": "immutable",
    "lp_custody":  "locked",
    "owner_model": "single_eoa",
    "web":         "na"
  },
  "contracts": [
    { "role": "factory", "address": "0xdd84fdde...", "proxy": false }
  ],
  "finding": "Bonding-curve pad that went dark in mid-July and has relaunched...",
  "board_url": "https://thestackaudit.xyz/#noxa"
}

Non-launchpad records carry adjacent: true plus a group. Protocols (DEXs, lending, yield, privacy pools: their own contracts route or hold funds) are tiered on the same t1–t7 scale with a full assessment, read through contract safety rather than rug path. Tools (read-only terminals, non-custodial frontends, agents) carry has_findings and no tier, since they custody nothing. The prose finding is always present.

ValuesEnums

Each field maps one-to-one from the board. The feed mirrors the board and never reinterprets it, so a value is only as strong as the human review behind it.

fieldvalues
grouplaunchpad · protocol · tool (non-launchpads also carry adjacent: true)
tiert1 … t7, or null for tools (launchpads and protocols are tiered)
scan_depthfull · contract
statuslive · relaunched · dead · pre_launch · superseded
upgradeableimmutable · upgradeable · unconfirmed · na
lp_custodylocked · burned · pullable · unconfirmed · na
owner_modelrenounced · none · single_eoa · multisig · timelock · custom · na
webcsp · clean · thin · leaked_key · na

ContractFreshness and stability

  1. ids are frozen. A platform keeps its id for life. Build your joins on it.
  2. Relaunches keep the id. When a platform redeploys, the new contract is added and the old one is marked status: "superseded", so a stale address still resolves and tells you it is stale. This is how the NOXA relaunch was caught.
  3. Every record is point-in-time. The checked date is when it was last verified against the chain. Contracts get redeployed and keys rotate; a verdict is true as of its date, not forever.
  4. Poll gently. The file is cached about five minutes. There is no rate limit, but there is no reason to fetch it more often than it changes.

TermsLicense and attribution

The feed is CC-BY 4.0. Use it in a product, a bot, a wallet, a dashboard, whatever you like. The only ask is a visible credit to The Stack Audit with a link back. That attribution is the whole deal: it keeps the work findable, and it costs you nothing.

Two honest limits. The feed is as good as the board and no better: it is one person's independent, reproducible review, not a certified audit, and no finding is a guarantee. And it covers Robinhood Chain only. If you need many chains shallow, other tools do that; this is one chain, deep.