Potential Risks
DISCLAIMER // NFA // DYOR
This analysis is based on observations of the contract behavior. We are not smart contract security experts. This document aims to explain what the contract appears to do based on the code. It should not be considered a comprehensive security audit or financial advice. Always verify critical information independently and consult with blockchain security professionals for important decisions.
⊙ generated by robots | curated by humans
| METADATA | |
|---|---|
| Contract Address | 0x00000060...531524 (etherscan) |
| Network | Ethereum Mainnet |
| Analysis Date | 2026-08-08 |
Overview
A risk assessment was conducted against the TokenList registry and its companion TokenListRenderer as part of the broader contract analysis. The assessment examined centralization characteristics, trust assumptions, economic vectors, complexity surface area, and external dependencies across the verified Solidity source code (~2,150 lines for the pair, plus nine inherited Solady libraries), together with the governance stack that owns the registry.
The contract is a curated, non-upgradeable on-chain token registry in which each listing is a soulbound ERC-721 minted to the token it describes. It holds no funds and has no fee, pause, or upgrade path. The trust surfaces are therefore not economic: they are curatorial. Identity fields for tokens on this chain are read from the token contract rather than authored by the curator, which is verifiable at the storage layer; presentation, ordering, and the renderer that produces what wallets actually display are not covered by that guarantee. Each of these surfaces was evaluated independently, as was the multisig and timelock configuration that holds the owner role.
Findings Summary
The assessment identified 15 findings across four severity tiers and five risk categories. No critical-severity issues were found, and none describes a path to fund loss from the registry itself, because the registry never custodies value. The findings concentrate on the boundary between what the contract enforces in storage and what a consumer actually sees, the powers retained by the curating multisig, the irreversible options the owner holds, and the consequences of pairing an immutable registry with a replaceable presentation layer.
| SEVERITY | COUNT |
|---|---|
| Critical | 0 |
| High | 2 |
| Medium | 5 |
| Low | 4 |
| Informational | 4 |
| CATEGORY | FINDINGS |
|---|---|
| Trust Assumption | 5 |
| Complexity | 4 |
| Centralization | 3 |
| External Dependency | 2 |
| Economic | 1 |
Report Availability
The detailed findings for this assessment are not publicly available at this time. The full report includes specific descriptions of each finding, affected code paths, severity justification, and suggested questions for contract owners and integrators.
If you are the contract owner, an integrator, or a security researcher with a legitimate interest in the full findings, you are welcome to request this portion of the report (no guarantees).