zerodust — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited zerodust (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Paused. ZeroDust's agent interface is paused: the hosted MCP endpoint and agent API keys are switched off and the agent packages are deprecated on npm. The public API, the SDK and the local MCP server still work with your own key; for people, the place to sweep is https://zerodust.xyz.
ZeroDust sweeps 100% of native gas tokens from EVM chains, leaving exactly zero balance. It uses EIP-7702 sponsored execution so users never pay gas directly.
The user never pays gas. ZeroDust's sponsor pays gas and is reimbursed from the swept amount.
Choose based on your context:
| Approach | Best For | Requires |
|---|---|---|
| SDK (TypeScript) | Apps, agents with private keys | npm install @zerodust/sdk |
| REST API | Any language, server-side | HTTP client |
| MCP Server | AI agents via Model Context Protocol | MCP-compatible client |
import { ZeroDustAgent } from '@zerodust/sdk';
import { privateKeyToAccount } from 'viem/accounts';
const agent = new ZeroDustAgent({
account: privateKeyToAccount('0x...'),
environment: 'mainnet',
});
// Check what can be swept
const balances = await agent.getSweepableBalances();
// Sweep one chain (Arbitrum -> Base)
const result = await agent.sweep({
fromChainId: 42161,
toChainId: 8453,
destination: '0x...',
});
// Or sweep ALL chains to Base
const results = await agent.sweepAll({ toChainId: 8453 });Prove it before moving anything. Pass dryRun: true to run the whole flow - real quote, real EIP-712 typed data, all three real signatures - and stop before submitting. Nothing is broadcast and no balance changes.
const check = await agent.sweep(
{ fromChainId: 42161, toChainId: 8453 },
{ dryRun: true }
);
check.dryRun; // true
check.sweepId; // undefined - nothing was submitted
check.quote?.estimatedReceive; // what would have arrivedThere is no testnet environment (the API serves no testnet chains), so dryRun is the way to validate an integration safely.
# 1. Check balances
curl https://api.zerodust.xyz/balances/0xYOUR_ADDRESS?testnet=false
# 2. Get quote
curl "https://api.zerodust.xyz/quote?fromChainId=42161&toChainId=8453&userAddress=0x...&destination=0x..."
# 3. Get signing data
curl -X POST https://api.zerodust.xyz/authorization \
-H "Content-Type: application/json" \
-d '{"quoteId": "uuid-from-step-2"}'
# 4. Submit signed sweep
curl -X POST https://api.zerodust.xyz/sweep \
-H "Content-Type: application/json" \
-d '{
"quoteId": "...",
"signature": "0x...",
"eip7702Authorization": {...},
"revokeAuthorization": {...}
}'
# 5. Check status
curl https://api.zerodust.xyz/sweep/SWEEP_IDLocal stdio only: npx @zerodust/mcp-server (the hosted endpoint is switched off). It can sweep, because the key stays on the agent's machine.
| Tool | Purpose |
|---|---|
zerodust_get_chains | List supported chains |
zerodust_get_balances | Find stranded gas across all chains |
zerodust_get_quote | Price emptying a chain to zero |
zerodust_get_sweep_status | Check a submitted sweep |
zerodust_list_sweeps | List past sweeps |
zerodust_info | Service details, pricing, integration |
zerodust_get_agent_address | Show the signing wallet and its allowlist |
zerodust_sweep | Empty one chain to exactly zero |
zerodust_sweep_all | Empty every chain with a balance |
The sweep tools accept dryRun: true, which rehearses the whole flow and moves nothing. Use it first.
Sweeping requires ZERODUST_ALLOW_EXECUTE=true plus a signing key. The key can come from a signer module returning a viem LocalAccount (Turnkey, Privy, KMS), an encrypted V3 keystore, a key file, or ZERODUST_PRIVATE_KEY inline. Funds can only go to the agent's own address unless ZERODUST_ALLOWED_DESTINATIONS lists more.
The live list is GET https://api.zerodust.xyz/chains (the EIP-7702 chains, swept by the sponsor) and GET https://api.zerodust.xyz/direct/chains (chains without EIP-7702, swept by the wallet itself with transactions the API plans). The table is in the repository README.
Cross-chain sweeps go through Relay, Across, Stargate or Gas.zip (best output wins), to any EVM chain one of them delivers native gas to. A few chains have no bridge at times; GET /chains shows which.
| Balance | Fee |
|---|---|
| Under $1 | 5% of balance (no minimum) |
| $1 - $5 | $0.05 (minimum) |
| $5 - $50 | 1% of balance |
| Over $50 | $0.50 (maximum) |
Gas costs (~1-3%) are included and paid by ZeroDust's sponsor, reimbursed from the sweep.
For the complete API reference with all endpoints, request/response schemas, and error codes, see references/API.md.
For SDK usage patterns including the Agent module, see references/SDK.md.
Mainnet address (same on every chain via CREATE2):
0x3732398281d0606aCB7EC1D490dFB0591BE4c4f2~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.