Contract Analysis

DISCLAIMER // NFA // DYOR

This analysis is based on observations of the contract behavior. We are not smart contract security experts. This document aims to explain what the contract appears to do based on the code. It should not be considered a comprehensive security audit or financial advice. Always verify critical information independently and consult with blockchain security professionals for important decisions.

⊙ generated by robots | curated by humans

Analysis Date: 2026-08-09

Metadata

Primary Contract

PROPERTY	VALUE
Contract Address	`0x0000006d...32a9a8` (etherscan)
Network	Ethereum Mainnet
Contract Type	Standalone ERC721 (Solady base)
Deployment Date	2026-08-06 08:37:11 UTC
Deployment Block	25,694,754
Contract Creator	`0xacFbA7ce...de4082` (etherscan)
Creation TX	`0x8848f7d7...c82ec3` (tx)
Compiler Version	Solidity v0.8.36, optimizer on (200 runs), EVM target `prague`
Total Functions	81 Application Binary Interface (ABI) entries, of which 35 are declared in this contract's own source
External Contract Dependencies	7
Upgrade Mechanism	☒ None — the governor itself is not upgradable; two rendering dependencies are replaceable
Verification Status	☑ Verified on Etherscan (exact match)
Audit Status	☒ No audit report located

TYPE	ADDRESS	NOTES
Admin (`dao`)	`0x5E58BA0e...74053E` (etherscan)	Immutable. A 45-byte ERC-1167 clone of a Moloch implementation. Sole holder of `onlyDAO`
Bond token (`shares`)	`0x00a6bA94...2dCb12` (etherscan)	ZORG, "zOrg Shares". Also an ERC-1167 clone. Escrowed as bond weight
Custody NFT (`zorgz`)	`0x00000000...6b63A6` (etherscan)	zOrgz. One zOrgz is escrowed per bond; the receipt reuses its token id
Registry (`tokenList`)	`0x00000060...531524` (etherscan)	Read-only. Only `isListed(uint256)` is ever called. See the TokenList analysis
Naming (`weiNames`)	`0x00000000...c242EB` (etherscan)	Wei Name Service. Holds `zorg.wei`; the emergency role is the `exec.zorg.wei` subdomain
Renderer	`0x0000006b...E29979` (etherscan)	DAO-replaceable. Serves `html()`. Already swapped once, 2026-08-07
Receipt art	`0x0000007f...DD1eD9` (etherscan)	DAO-replaceable. Serves `tokenURI()`. Original deployment value, not yet changed
Deployer funder	`0x1C0Aa8cC...855A20` (etherscan)	z0r0z's canonical Externally Owned Account (EOA). Sent 0.02 ETH to the deployer on 2026-08-03

Executive Summary

ZorgConviction applies Conviction Voting to the zFi TokenList registry. A holder locks one zOrgz NFT, an explicit amount of ZORG governance shares, and at least 0.01 ETH into the contract; in return the contract mints a transferable ERC721 receipt that reuses the escrowed zOrgz token id. The receipt is the only thing that can direct that bond's weight at a listing, so selling the receipt sells the position along with its withdrawal right.

The weight a receipt directs does not sit still. Each listing carries an accumulator that moves toward its live support by closing half the remaining gap every Conviction Half-Life — currently three days. The score a client reads (supportOf) is live direct support plus that accrued component, so a listing supported for a week outranks one that received the same allocation an hour ago, and support withdrawn decays away rather than vanishing.

The relationship to the registry is one-directional and narrow. ZorgConviction declares a single-method interface against TokenList and calls isListed(uint256) in exactly one place, to reject allocations to ids the registry does not carry. It never writes to the registry. TokenList's own ordering field, rank, remains onlyOwner under a separate 2-of-3 multisig. Two independent orderings therefore exist for the same set of listings: a curator-set weight stored in the registry, and a stake-weighted score stored here. Nothing on-chain reconciles them. A consumer that sorts "by conviction" is reading this contract and ignoring the registry's own field.

The Moloch DAO is an immutable, unbounded admin: it can execute arbitrary calls through the governor, subject to two invariants that protect escrowed ZORG and user ETH but leave everything else reachable. It can also install an emergency operator whose credential is a transferable name — whoever holds exec.zorg.wei can pause the system and, once paused, execute arbitrary calls under the same invariants. That role is not installed as of the snapshot. The escrow additionally depends on ZORG remaining transferable; the constructor refuses to deploy against a share token that is locked at deploy time, and the source states that the DAO locking it afterwards would make unbond impossible for bonds that already exist.

At the snapshot block there are 7 bonds across 4 addresses holding 371,470 ZORG (about 5.0% of supply), 0.07 ETH held against 0.07 ETH of recorded liabilities, and 8 listings carrying allocated weight. Two bonds have been made permanent through eternalize, which forfeits the zOrgz and ZORG and hands the ETH principal to the DAO. One of those — receipt 9953, held by 0x1C0Aa8cC...855A20 (etherscan) — was eternalized while still at lock tier 0, which pins its rate at 1.00× permanently. The contract is three days old, unaudited, and holds no upgrade path of its own.

Architecture

graph TB
    subgraph Actors
        H["Receipt Holder<br/>(4 addresses)"]
        DAO["zOrg Moloch DAO<br/>0x5E58BA0e...74053E"]
        EX["exec.zorg.wei holder<br/>NOT INSTALLED"]
    end

    subgraph Governor["ZorgConviction — 0x0000006d...32a9a8"]
        RCPT["Receipt ERC-721<br/>id = escrowed zOrgz id"]
        ESC["Escrow<br/>zOrgz + ZORG + ETH principal"]
        CONV["Conviction ledger<br/>listingId to weight + accumulator"]
        LOY["Loyalty accounting<br/>reward index + ETH credits"]
    end

    subgraph Deps["External Contracts"]
        TL["TokenList<br/>0x00000060...531524"]
        ZZ["zOrgz ERC-721<br/>0x00000000...6b63A6"]
        SH["ZORG Shares<br/>0x00a6bA94...2dCb12"]
        WNS["Wei Name Service<br/>0x00000000...c242EB"]
        RN["Renderer (replaceable)"]
        RA["ReceiptArt (replaceable)"]
    end

    H -->|"bondZorgz / topUpZorg"| ESC
    H -->|"allocate"| CONV
    H -->|"unbond / decreaseBond / claimLoyalty"| ESC
    H -->|"eternalize — irreversible"| ESC

    DAO -->|"execute, setHalfLife, setLockTier,<br/>setEthBondTerms, setRenderer,<br/>releaseTreasuryEth, resume"| Governor
    DAO -.->|"installExecRoleName"| EX
    EX -.->|"emergencyPause then emergencyExecute"| Governor

    CONV -->|"isListed only"| TL
    ESC --> ZZ
    ESC --> SH
    Governor --> WNS
    Governor --> RN
    Governor --> RA

    TL -.->|"no write path"| TL

    style CONV fill:#e1f0ff
    style ESC fill:#ffe1e1
    style EX fill:#fff4d6

System Overview

A bond is created by bondZorgz(receiptId, weight[, tier]). The caller must own the zOrgz with that id, must have approved both the zOrgz and the ZORG amount to the governor, and must send at least ethBondTerms.minimumBond (0.01 ETH) with the call. The contract pulls the ZORG, records the ETH as refundable principal with a 7-day maturity, pulls the zOrgz through a gated onERC721Received, and mints the receipt to the caller.

allocate(receiptId, listingId, amount) then points some or all of that bond at a listing. The sum of a receipt's allocations may never exceed its bonded weight, so each unit of weight has exactly one destination at a time. The amount recorded against the listing is the raw allocation scaled by the receipt's lock-tier boost, capped at 1.5×.

Escrows three assets and enforces a one-source-per-unit accounting invariant on allocations.
Lets holders exit: decreaseBond returns part of a bond, unbond burns the receipt and returns everything, and both remain callable while the contract is paused.
Does not write to TokenList — no path exists to change a listing's rank.
Exposes no enumeration of receipts or listings. Iterating the set that carries support requires replaying Allocated logs.
Verifies nothing about a listing beyond its presence in the registry. Conviction behind a token records who staked, not whether the token is sound.

Design Patterns Used

Escrow receipt as authority: the receipt NFT, not the depositing address, holds the allocation right and the withdrawal right. Transferring it moves the whole position, so an address that has sold its stake retains no ability to direct that weight.
Vote Escrow with a transferable position: longer lock tiers earn a larger multiplier on the same deposit, capped at 1.5×. Unlike veCRV the escrow receipt is an ordinary transferable NFT, so the locked voting position is itself a tradable asset.
Terms snapshotting: lock tiers and ETH bond terms are DAO-configurable menus, but each receipt copies the terms it selected at mint. A later DAO change cannot rewrite a live holder's exit right, boost, or early-exit quote.
Exponential decay with exact composition: _advance closes half the gap per halfLife using powWad(0.5e18, elapsed/halfLife). Because halving composes exactly, advancing once over a long interval equals advancing repeatedly over short ones, so repeated allocate calls against a listing change nothing.
Pull payments: ETH owed to a user is credited to ethCredits and withdrawn separately, so a recipient that rejects ETH cannot trap a zOrgz or its shares inside the governor.
Invariant assertion over denylist: the DAO's execute re-checks the governor's ZORG balance and total ETH liability after the call rather than relying only on forbidden targets. Moloch's public Ragequit burns the caller's shares, which would reduce escrow without either denylisted address appearing in the call.
Rendering split out of the core: tokenURI and html() forward to separate contracts, which keeps the governor inside EIP-170. Runtime bytecode is 20,324 bytes, leaving 4,252 bytes of headroom.

Access Control

Roles & Permissions

ROLE	ASSIGNED BY	REVOKABLE	CALL COUNT
`dao`	Constructor (immutable)	No — immutable, with no transfer or renounce path	Unlimited
Emergency operator	`installExecRoleName` by `dao`, one-shot; identity is whoever holds the `exec.zorg.wei` name	Yes — `burnExecRole()` by `dao`, one-way	Unlimited while installed and not revoked
Receipt holder	`bondZorgz` (mint), or receiving the receipt by transfer	Yes — by transferring or burning the receipt	Unlimited, scoped to owned receipts
Anyone	—	N/A	View functions, plus `claimZorgWei` (already consumed)

Permission Matrix

FUNCTION	DAO	EMERGENCY OPERATOR	RECEIPT HOLDER	ANYONE
`bondZorgz`	☒	☒	☒	☑ (any zOrgz owner)
`allocate`	☒	☒	☑	☒
`topUpZorg` / `increaseBond`	☒	☒	☑	☒
`decreaseBond` / `unbond`	☒	☒	☑	☒
`selectLockTier`	☒	☒	☑	☒
`eternalize`	☒	☒	☑	☒
`claimLoyalty`	☒	☒	☑	☒
`withdrawEthCredit`	☒	☒	☒	☑ (own credit only)
`setHalfLife` / `setLockTier` / `setEthBondTerms`	☑	☒	☒	☒
`setRenderer` / `setReceiptArt`	☑	☒	☒	☒
`installExecRoleName` / `burnExecRole` / `resume`	☑	☒	☒	☒
`releaseTreasuryEth`	☑	☒	☒	☒
`execute`	☑	☒	☒	☒
`emergencyPause`	☒	☑	☒	☒
`emergencyExecute`	☒	☑ (only while paused)	☒	☒

Time Locks & Delays

ACTION	TIME LOCK	CAN CANCEL	PURPOSE
DAO parameter changes (`setHalfLife`, `setLockTier`, `setEthBondTerms`, renderers)	None at this contract; whatever delay the Moloch DAO imposes upstream	N/A	☒ Immediate from the governor's perspective
`execute` / `emergencyExecute`	None	N/A	☒ Immediate, bounded only by the two post-call invariants
`unbond` on a tier-0 receipt	None — callable immediately	N/A	◇ Redeeming before the 7-day ETH maturity costs the 20% early-exit tax rather than being blocked
`unbond` on a tier 1/2/3 receipt	90 / 180 / 365 days from bond or last top-up	No	☑ Hard commitment selected by the holder, snapshotted at bond time
`decreaseBond`	Later of the lock unlock time and the ETH maturity	No	☑ The maturity gate blocks a top-up-and-exit harvest of pending early-exit taxes
`eternalize`	Permanent	No	☒ Irreversible by design; no recovery path exists

Economic Model

Funding Sources & Sinks

Three assets enter the contract and are accounted separately.

ASSET	ENTERS VIA	LEAVES VIA	ACCOUNTING
ZORG shares	`bondZorgz`, `topUpZorg` / `increaseBond`	`decreaseBond`, `unbond`	`bondedWeight[receiptId]`, summed in `totalLoyaltyWeight`
zOrgz NFT	`bondZorgz` (one per receipt)	`unbond` only	Implicit — custody is the escrow
ETH	`bondZorgz` (`msg.value`), bare `receive()`	`withdrawEthCredit`, `releaseTreasuryEth`, DAO `execute` surplus	`totalEthPrincipal` + `loyaltyRewardReserve` + `treasuryEth` + `totalEthCredits`

Fee Structure

FEE	AMOUNT	TRIGGER	RECIPIENT
Minimum ETH bond	0.01 ETH (`ethBondTerms.minimumBond`)	Every `bondZorgz`	Held as refundable principal, returned in full at maturity
Early-exit tax	20% of principal (`earlyExitTaxBps` = 2,000)	`unbond` before `maturityAt`	Split 50/50 (`treasuryShareBps` = 5,000) between `treasuryEth` and the loyalty pool
Eternalization forfeit	100% of principal, plus the zOrgz and all bonded ZORG	`eternalize`	ETH to `treasuryEth`; zOrgz and ZORG are permanently immobilised in the contract

The DAO may rewrite all four ETH-bond parameters for future bonds. setEthBondTerms bounds maturity at 365 days and both bps figures at 10,000, but places no upper bound on minimumBond — only that it be non-zero. An earlyExitTaxBps of 10,000 (a 100% tax) is within range.

Economic Invariants

sum(allocationOf[receiptId][*]) == allocatedByBond[receiptId] <= bondedWeight[receiptId]. Enforced on every allocate and re-checked on decreaseBond.
sum(bondedWeight) == totalLoyaltyWeight == ZORG balance of the contract. Verified at the snapshot: 371,470 ZORG on all three.
address(this).balance >= totalEthPrincipal + loyaltyRewardReserve + treasuryEth + totalEthCredits. Asserted after every execute and emergencyExecute. Verified at the snapshot: 0.07 ETH held against 0.05 + 0 + 0.02 + 0.
The ZORG balance may not decrease across a DAO execute. Asserted directly.
A bond cannot be emptied by decreaseBond — total == 0 reverts, so a zero-weight receipt that bondZorgz would still read as unbonded cannot exist.

Live Position Snapshot

Block 25,714,806. Effective weight is the raw allocation scaled by the receipt's boost.

Listing ids for ordinary Ethereum tokens are the token address read as a number, so the id column below is the subject's own address. The Tacit entry is a foreign listing and carries a wider hashed id instead.

LISTING ID	SUBJECT	EFFECTIVE WEIGHT	ACCRUED CONVICTION	SCORE
`0`	ETH (native)	156,850	11,031	167,881
`0xe64b4fb0...086ae8`	TAC — Tacit Coin, Bitcoin-rooted (tacitscan)	127,500	17,053	144,553
`0x00a6bA94...2dCb12`	ZORG (etherscan)	127,500	17,043	144,543
`0x00000000...6b63A6`	zOrgz (etherscan)	1,432	200	1,632
`0xC02aaA39...756Cc2`	WETH (etherscan)	900	372	1,272
`0x7f39C581...5E2cA0`	wstETH (etherscan)	800	319	1,119
`0xae7ab965...d7fE84`	stETH (etherscan)	750	188	938
`0xae78736C...fc6393`	rETH (etherscan)	700	200	900

The second-largest concentration of conviction sits behind an asset with no Ethereum contract at all. TAC is the Tacit Coin listing, a Bitcoin-rooted asset the registry stores as a foreign listing with synced = false — its name, symbol and decimals were typed in by the curator rather than read from a token. Conviction weight does not change that.

Summary of Observations

The contract's scope is narrow. It escrows three assets, tracks who staked what behind which registry id, decays that support toward a target on a fixed half-life, and exposes the result as a read-only score. It does not touch the registry it reads from, and it custodies nothing it cannot return — with one deliberate exception. The accounting we could check holds exactly: bonded weight matches the ZORG balance, and the ETH balance matches recorded liabilities to the wei.

Three behaviours are worth isolating. Only allocation increases are gated on paused and on isListed, so a holder can always withdraw support from a listing that has been delisted or from a system that has been paused — which keeps a curator delisting or an emergency pause from becoming permanent confiscation of every bond pointed at that listing. The DAO's escape hatch asserts a balance invariant rather than relying on a denylist alone. The decay function uses exact halving rather than a rational approximation, and because halving composes exactly, repeated allocate calls against a listing change nothing.

The Moloch DAO is an immutable admin with an arbitrary-call function. The two invariants protect escrowed ZORG and user ETH but nothing else, and the escrowed zOrgz are protected by a target denylist rather than the same kind of assertion. The emergency operator role is a transferable name — whoever holds exec.zorg.wei can pause the contract and then execute arbitrary calls under those same invariants. That role is not installed at the snapshot, so the emergency path is currently unreachable; installing it is a single DAO call.

eternalize permanently forfeits the zOrgz and every bonded ZORG share, and it does not check the receipt's lock tier. selectLockTier refuses to run on an eternal bond, so a receipt eternalized at tier 0 is fixed at a 1.00× rate with no way to raise it. Receipt 9953, held by the address that funded the deployment, is in exactly that state with 10,000 ZORG behind it. A warning was added to the renderer's interface copy the next day, but the renderer is replaceable and the governor is not, so a later renderer can drop that warning while the behaviour underneath stays fixed.

Conviction here is advisory. supportOf is a number in this contract's storage; TokenList's rank is set by a 2-of-3 multisig and is unaffected by it. Whether a bonded position moves a token up a wallet or swap interface depends on that interface reading this contract rather than the registry's field, and the reference interface html() is served by a DAO-replaceable renderer that has already been swapped once. The stake is escrowed and time-locked; the effect it purchases is a convention, not an on-chain guarantee.

This analysis was performed for educational purposes. It is not a security audit and not financial advice. The contract is three days old at the time of writing, has no located audit, and has seen 7 bonds across 4 addresses — too little history to support any claim about how it behaves under adversarial conditions.

References

RESOURCE	NOTES
ZorgConviction on Etherscan	Verified source, ABI, and event log
TokenList Contract Analysis	The registry this contract reads; explains listing ids, `rank`, and the multisig owner
zOrg Moloch DAO	The sole `onlyDAO` holder; ERC-1167 clone with 21 proposals at snapshot
Solady ERC721	Base implementation; explains the non-sequential storage layout
Solady FixedPointMathLib	`powWad`, `divWad`, `fullMulDiv` — the decay and boost arithmetic
z0r0z Entity Profile	Deployment attribution and the wider zFi stack
EIP-1167: Minimum Proxy Contract	The clone pattern used by both the DAO and the ZORG share token
EIP-4906: Metadata Update Extension	The events this contract does not emit when `setReceiptArt` changes every receipt

Change Log

DATE	AUTHOR	NOTES
2026-08-09	Artificial.	Generated by robots. Gas: 385 tok
2026-08-09	Denizen.	Reviewed, edited, and curated by humans.