Potential Risks
DISCLAIMER // NFA // DYOR
This analysis is based on observations of the contract behavior. We are not smart contract security experts. This document aims to explain what the contract appears to do based on the code. It should not be considered a comprehensive security audit or financial advice. Always verify critical information independently and consult with blockchain security professionals for important decisions.
⊙ generated by robots | curated by humans
| METADATA | |
|---|---|
| Contract Address | 0x0000006d...32a9a8 (etherscan) |
| Network | Ethereum Mainnet |
| Analysis Date | 2026-08-09 |
Overview
A risk assessment was conducted against the ZorgConviction governor as part of the broader contract analysis. The assessment examined centralization characteristics, trust assumptions, economic vectors, complexity surface area, and external dependencies across the verified Solidity source (873 lines, plus three inherited Solady libraries), together with the two replaceable rendering contracts and the governance stack that holds the admin role.
The contract is a non-upgradeable Conviction Voting layer over the zFi TokenList registry. It escrows three assets per position — one zOrgz NFT, an explicit ZORG share amount, and a mandatory ETH principal — and issues a transferable ERC721 receipt that carries the allocation right and the withdrawal right together. Because it holds real value on behalf of holders, the assessment covered both the custody path and the governance path, and each was evaluated against what the code enforces rather than what the surrounding interface presents.
Two structural properties shaped the review. The escrow accounting is checkable from outside the contract, and both invariants the contract asserts internally were reproduced independently at the snapshot block. The mechanism's output, by contrast, is advisory: it is a score in this contract's storage that the registry it ranks does not consume, and the interface that presents it is replaceable. The boundary between those two facts is where most of the findings sit.
Findings Summary
The assessment identified 18 findings across four severity tiers and five risk categories. No critical-severity issues were found. The findings concentrate on the powers retained by the immutable admin and by an emergency role that is not currently installed, on irreversible options a holder can exercise against their own position, on the gap between the stake a participant locks and the effect that stake actually purchases, and on the consequences of pairing an immutable governor with a replaceable presentation layer.
| SEVERITY | COUNT |
|---|---|
| Critical | 0 |
| High | 3 |
| Medium | 6 |
| Low | 5 |
| Informational | 4 |
| CATEGORY | FINDINGS |
|---|---|
| Complexity | 7 |
| Trust Assumption | 4 |
| Centralization | 3 |
| Economic | 2 |
| External Dependency | 2 |
Report Availability
The detailed findings for this assessment are not publicly available at this time. The full report includes specific descriptions of each finding, affected code paths, severity justification, and suggested questions for contract owners and integrators.
If you are the contract owner, an integrator, or a security researcher with a legitimate interest in the full findings, you are welcome to request this portion of the report (no guarantees).