Censorship Resistance · C1
Admin pause, freeze, or blacklist over the payment path
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained?
Why it matters
A pause or blacklist key is a single point at which a third party can halt your receivables or single out your counterparties. The question for a risk committee is not whether such a key exists but who holds it, how many signers it takes, and how much notice you get before it is used.
A score of 3 needs onchain evidence about the deployed contracts, not only source code at a commit.
Scoring anchors
| No pause, freeze, blacklist, or relayer/allowlist role that can stop settlement exists in the settlement contracts. | |
| Such a role exists and is held by a Safe of at least 2-of-3 with disclosed signers, no enabled module or guard that bypasses the threshold, behind a timelock at least as long as the documented user exit, with its scope documented in code or NatSpec. | |
| Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only. | |
| Role is EOA-held or undisclosed, or can target individual addresses with no notice. | |
| No admissible evidence submitted yet. Counts as 0 in the pillar. |
Admissible evidence
- Role holders read onchain (owner(), AccessControl role members, pauser/guardian storage) verified
- Safe threshold and owners read onchain verified
- Timelock contract and its delay read onchain verified
- Source at a pinned commit showing what the role can reach verified
- Safe modules (getModulesPaginated) and guard (storage slot 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8) read onchain verified
Common failures
- Pauser is a single EOA described as "the team".
- Multisig threshold is 1-of-N, which is an EOA with extra steps.
- Blacklist inherited from a token is mistaken for a provider role (score that under C5).
Current ratings
| Provider | Score | Finding |
|---|---|---|
| Aleo (credits.aleo private transfers) | credits.aleo itself has no admin, pause or blacklist. But the node software has a built-in restrictions list that, once a release containing entries is adopted by the validator committee, makes the chain reject named programs, functions or public argument values such as a specific address, from a chosen block height. The list is empty today. Private transfers cannot be targeted by address because their arguments are encrypted, but the whole transfer_private function could be restricted. Provable maintains the only node implementation we found, and 23 validators decide whether to run a release. Judgment call: there is no key, but an address-level filter is designed into consensus and can be activated by one release with no enforced delay, so we score 1, not 2. | |
| AnomaPay | A 3-of-5 Safe with no modules or guard can stop the protocol adapter for good, and it also owns the RISC Zero verifier whose pause stops the adapter. There is no timelock, and we found no public list of signers. The stop is global, not per-address. Scored 1. | |
| Avalanche Card | There are no assessable settlement contracts. The card agreement lets the provider and issuer suspend an individual card or account with or without notice, which meets anchor 0 ("can target individual addresses with no notice"). | |
| Avici Card | No settlement contract could be assessed. The terms let Avici and the issuer block an individual's card and account at their discretion, with no notice period. That meets anchor 0. | |
| Aztec (Alpha mainnet private token transfers) | The rollup contracts have no pause, freeze or blacklist, the Rollup is not a proxy, and the reference Token contract has none either. The committee of staked sequencers can censor by omission, but the escape hatch gives a bonded outsider periodic block-production windows. Any particular token on Aztec is deployed by a third party whose contracts may add controls; the one bridge we sampled (Nyx.money TokenVaultPortal) is Ownable. Judgment call: the substance supports 3 for the protocol layer, but the rollup contracts live on Ethereum while this row's chain is aztec:mainnet, so the dashboard cannot record the onchain reads as onchain evidence (see notes), and third-party token controls are unknown; we take 2. | |
| Bitget Wallet Card | A single EOA holds the admin and operator roles on the card authorizer and the cash tokens. It can pause card authorizations or all transfers of a currency, and Fiat24 operators can set an individual account to Soft- or Hard-Blocked, which the token contract enforces on every transfer. The terms allow card blocks and account suspension without notice. EOA-held role that can target individual accounts with no notice, so 0. | |
| Blanksquare (Shielder) | A 2-of-5 Safe owns the Shielder and can pause it, which stops deposits and withdrawals alike. The Safe has no modules or guard, but there is no timelock, and we found no public list of the signers. Pause is global; there is no per-address blacklist in the contract. Scored 1: a multisig role that misses the timelock and signer-disclosure conditions. | |
| COCA Card | No settlement contract could be assessed. The terms let COCA suspend or limit an individual's use at its discretion with no notice period, and the card itself is run by an unnamed third party. Anchor 0 (can target individuals with no notice). | |
| Coinbase Commerce (Onchain Payment Protocol) | One externally owned account can pause every payment method of both Base Transfers contracts at once, with no multisig and no timelock. The same key can appoint a sweeper (see S1). Pause is global; the contract has no per-address blacklist. A second control sits outside the contract: every payment needs a TransferIntent signed by its operator, and for Commerce payments that operator is Coinbase, which can decline to sign for any payer or merchant without notice (README L60-L65). The contracts were not paused at block 52285285. | |
| Curvy | Shielding a payment into the pool needs the operator. That role is held by a single EIP-7702-delegated EOA, and per the docs it acts only after Global Ledger screening, so it can refuse individual portals without notice. Direct shielding is disabled. AUTHORITY_ROLE (Safe 4-of-6, no timelock) can switch it on or off, replace verifiers and rewire or upgrade the vault and aggregator. Withdrawals and portal recovery have no pause. Scored 0: an EOA-held role that can target individual payees. | |
| Daimo Pay | There is no pause, freeze, or blacklist function in the settlement contracts. The contracts do hold a control the C1 anchors name explicitly: a relayer allowlist that a single EOA owner sets through setRelayer, with no timelock. Only allowlisted relayers can forward a deposit to the payee. The owner can stop all settlement by removing every relayer. Any relayer can decline a single deposit address, or refund it early to its refundAddress, without notice. Funds in an unforwarded deposit address can still be refunded by anyone once expiresAt passes. Under the updated anchor the cell is 0 on two counts: the role is EOA-held (the owner has no code, so there is no Safe, module, guard, or signer set to read), and relayers can act on individual deposit addresses with no notice. | |
| Deblock Card | No admissible evidence yet. | |
| Ethena Pay | Every card spend needs a co-signature from Ethena Pay's executor EOA, and the BatchExecutor that relays spends has an owner pause and recipient blocklist held by a 5-of-10 Safe with undisclosed signers and no timelock. The Card Terms let Ethena Pay and the issuer block transactions for any reason, so an individual cardholder can be cut off with no notice. The user's own funds are not frozen by these powers (direct mode, see S4), but the payment path is. Judgment call: as for other card products, the documented per-account block meets anchor 0. | |
| ether.fi Cash | A pause key that halts all card settlement is held by an EOA (and by a 1-of-6 Safe) with no timelock. No contract role can blacklist a single Safe onchain; per-card blocking happens offchain, where the cardholder terms let ether.fi and the issuer deny transactions without notice. ADMIN_ROLE, a 3-of-6 Safe with no timelock, can also de-list a withdrawable asset or raise the withdrawal delay at once. An EOA-held role scores 0. | |
| Exa Card | Three things can stop card settlement. A single EOA owns the Pauser, which can pause the exaUSDC market and so freeze every card debit and every user withdrawal, with no notice or timelock. Card collections run only through Exa's keeper EOA. The card terms let Exa and the issuer block transactions and suspend accounts. The longer-standing PAUSER_ROLE sits with a 3-of-6 Safe (undisclosed signers, no timelock). An EOA-held pause meets anchor 0. | |
| Fluidkey | Payments are ordinary transfers into user-owned 1-of-1 Safes built on Safe's immutable 1.3.0 singleton; no Fluidkey role can pause, freeze or block them onchain. The optional earn module lets Fluidkey's relayers push received funds into preconfigured vaults, which is a custody question (S1), not a block. Refusal of service happens off-chain, in address issuance (C3, C4). | |
| Fuse Card | Onchain, no one can pause or freeze the user's Squads accounts: the program has no such instruction and is immutable, and neither Squads nor Bridge holds a member key. The card itself can be blocked or cancelled by Lead Bank or Bridge "with or without notice", and every card settlement depends on Bridge using its spending limit. Judgment call: the documented per-card block without notice meets anchor 0, as in Gnosis Pay; the onchain layer alone would score 3. | |
| Gnosis Pay | Funds at rest cannot be frozen: the account Safe has no guard, its only modules are the user's Delay and Roles modifiers, and Gnosis Pay holds no key over them. Card settlement is different. Every card spend is Spender.spend(), which only an enabled delegate can call, and the one delegate is EOA 0x9c48bc73... A single EOA can stop or selectively withhold settlement, which meets anchor 0 on its own. The delegate list is controlled by spender Safe 0x896a695d... It is 2-of-3, its three EOA signers are not named in any document I found, it has no guard, and there is no timelock (the documented user exit is 3 minutes). It misses every anchor-2 condition. Module check (red team R7): the spender Safe's only module is the spender modifier itself (avatar = target = owner = the Safe). Through it, one delegate key can make the Safe call execTransactionWithRole on any account it names. The inner payload is fixed to token.transfer(receiver, amount), the modifier's generic exec functions are emptied, and changing delegates, owners or settings still needs 2 signatures. On user accounts the payload is limited by each account's Roles scope, read from the setup events (see S1): one token, receiver = settlement Safe 0x4822521E..., amount within the daily allowance. So the module does bypass the 2-of-3 threshold, but only to pull up to each account's remaining allowance into Gnosis Pay's settlement Safe. Separately, the Terms let Gnosis Pay block an individual card on Monavate's instruction. The EOA-held delegate (verified) and the card-block power (documented) each meet anchor 0. | |
| HesabPay | HesabPay can suspend or terminate individual accounts, including on government order, and the terms state no notice period or appeal path. There are no settlement contracts; the role holder is HesabPay itself. Judgment call: anchor 0 ("can target individual addresses with no notice") applied to account-level suspension in a custodial ledger. | |
| Hinkal | The contracts have no explicit pause, freeze or blacklist. A timelocked role can still stop settlement: it can swap the helper that computes every proof's public inputs, swap or remove verifiers, and edit the relayer allowlist. HinkalTimelockController holds that power on Ethereum, with a 6-hour delay. Its proposer, executor, canceller and admin is a 2-of-3 Safe with no modules or guard. We found no disclosure of the signers, and no document sets the delay against a user exit. The factory 0x0c61…923c also still holds DEFAULT_ADMIN_ROLE, but its bytecode has no call path to Hinkal's admin functions. That contract is unverified, so we judge this from its function selectors only. Scored 1: a multisig behind a timelock, but the signers are undisclosed. | |
| Holyheld Card | The top-up contract has a pause (setPaused, pauseOperation) and an emergencyTransfer, and the role that controls them (DEFAULT_ADMIN_ROLE, which also administers TRUSTED_PAUSER_ROLE) is held by a single EOA. There is no multisig and no timelock. The implementation is unverified, so the exact scope of each function cannot be read from source; the selectors are present in the deployed bytecode. On the card side, the Terms let Holyheld suspend service and account access. | |
| Houdini Swap | Two parties can stop an individual payment. Houdini can disable any wallet or identifier at its sole discretion, for any or no reason. The exchange partner holding the deposit can hold the swap pending KYC, and Houdini cannot override that. Neither power is constrained by a multisig, a timelock or notice. | |
| Hyperbeat Card | Hyperbeat can block an individual user's access to the card and Platform with no stated notice. The settlement and operator contracts are not verified, so who holds any onchain pause or role cannot be read. Judgment call: documented per-account blocking with no notice meets anchor 0. | |
| Jupiter Card | No admissible evidence yet. | |
| M-Pesa | No admissible evidence yet. | |
| MetaMask Card | FoxConnect has no pause or blacklist, but every card settlement is a withdraw() that only an allowlisted operator can call, and the operators are EOAs run by Baanx. Any one of them can stop or selectively skip settlement, which meets anchor 0 on its own. The operator list is set by a 2-of-4 Safe with undisclosed signers, no modules, no guard and no timelock. On the excluded US deployment the owner is a single EOA. On the card side, Monavate's terms allow it to close or suspend a card immediately. Both the EOA-held settlement role (verified) and the documented card suspension meet anchor 0. | |
| Opera MiniPay | Blueboard can cut an individual user off from the MiniPay app at any time with no notice, which blocks the MiniPay payment path for that user. MiniPay has no settlement contracts of its own: transfers are plain stablecoin transfers on Celo, and issuer freeze powers over USDC and USDT belong under C5. Judgment call: scored 0 on the termination power over the app path. The user's keys stay with the user (see C2 and S4), so the funds themselves are not frozen by this power. | |
| Monero | The consensus rules contain no admin key, pause, freeze, blacklist or allowlist role, and recipients are one-time addresses that a filter could not target. The core team runs the MoneroPulse DNS domains, which publish checkpoints; nodes look them up by default but only enforce them if the operator opts in. Rule changes need a hard fork that miners and node operators choose to run. Judgment call: the substance is anchor 3, but a 3 needs onchain evidence about a deployed contract, which a chain with no contract addresses cannot supply, so we take 2. | |
| Nullmask | A single EOA decides, deposit by deposit, whether funds enter the pool, and the operator's keys can pause withdrawals with no notice and no maximum length. Scored 0: EOA-held role that can target individual addresses. | |
| Oobit Card | Oobit and the issuer can block transactions and suspend an individual account. No notice period or appeal is stated. No settlement contract was found to assess. Judgment call: anchor 0 ("can target individual addresses with no notice"), applied to account-level suspension as for HesabPay. | |
| Payy Card | Onchain, a 2-of-4 Safe with undisclosed signers, no modules, no guard and no timelock owns the rollup. It can stop settlement (remove the prover or verifier) and can rewrite the state root outright. Payy's own EOA is the only prover, so it can also leave any transaction out of a block. Off-chain, the Terms let Payy restrict an individual's access without notice, and card use can be suspended with immediate effect. Judgment call: the onchain role alone would score 1 (multisig, no timelock, undisclosed signers), but the documented per-user restriction without notice meets anchor 0. | |
| Phantom Cash | The bank and the program manager can block or cancel an individual card with or without notice. That meets anchor 0. No settlement contract was identified to assess further. | |
| Plasma One | The card settlement contracts are controlled by a single Rain EOA, and the Card Terms let Plasma and Rain block any cardholder's transactions at any time. Users cannot pull collateral out without a Rain signature because unsigned timelock withdrawals are switched off. EOA-held role with per-account blocking, so 0. | |
| Privacy Pools (0xbow) | Two roles can stop or block settlement. The ASP postman, a single EOA, posts the association root; a deposit whose label is not in the latest root cannot be withdrawn privately, so the postman can exclude individual deposits without notice. Its only remaining exit is ragequit, which returns funds to the original depositor, not to a payee. OWNER_ROLE, held by a 2-of-4 Safe with no modules, guard or timelock, can wind down a pool (stopping deposits) and upgrade the Entrypoint. Scored 0: an EOA holds a role that can target individual deposits. The 0xbow terms describe this screening (see C4). | |
| Railgun | Pause, upgrade and token blocklisting sit with RAIL token governance: ProxyAdmin is owned by the Delegator, which is owned by the Voting contract, and no other address holds pause permission today (three EOA pausers granted in 2021 were revoked). A pause takes at least 7 days from the vote being called, and a pause would also stop unshielding. Nothing in the contracts blocks individual addresses. Judgment call: anchor 2 is written for a Safe; we treat public onchain token voting with a 7-day minimum execution delay as meeting it, since user exit (unshield) is immediate. No notice channel beyond the onchain proposal is named in the repo. | |
| Request Network | The core payment contracts, ERC20FeeProxy and EthereumFeeProxy, have no pause, freeze, blacklist, or admin of any kind. The conversion path, used for invoices denominated in fiat, does have one. The owner of Erc20ConversionProxy can swap the code it delegatecalls into, and an admin of ChainlinkConversionPath can change or remove price feeds. Either change halts conversion payments, and new code could be written to block chosen addresses. Both roles are held by a 3-of-7 Safe with no modules and no guard. There is no timelock, and the signers are not disclosed. The Safe is named as admin in the repo (Admin artifact, smart-contracts README L282). Judgment call: we score 1 and not 0. The anchor-1 case covers a multisig with no timelock and undisclosed signers. We read anchor 0's "target individual addresses" as a native blacklist function, and none exists. Payers on non-conversion requests can avoid this role entirely by calling ERC20FeeProxy, which on its own would score 3. Outside Base, the same Safe signer set (3-of-7) can remove the open hash submitter from the Gnosis RequestHashStorage whitelist, which would stop new requests being stored (see notes). | |
| Rizon Card | Rizon and the issuer can block individual cardholders' transactions and suspend accounts at their discretion. No contract-level role could be read, because no Rizon contract address is published (see notes). | |
| SafePal Card | A single EOA holds the admin and operator roles on the card authorizer and the cash tokens. It can pause card authorizations or all transfers of a currency, and Fiat24 operators can set an individual account to Soft- or Hard-Blocked, which the token contract enforces on every transfer. The terms allow card blocks and account suspension without notice. EOA-held role that can target individual accounts with no notice, so 0. | |
| Solayer Card (Emerald Card / Solayer Pay) | Solayer and the issuer can suspend an individual account or card, or deny any transaction, without cause or notice. Anchor 0. No settlement contract was found to assess. | |
| Tongo (confidential ERC-20 on Starknet) | The settlement contracts have no pause, freeze, blacklist or upgrade path. At Starknet block 16117583, get_tongo_config on the USDC, STRK and ETH v2 ledgers returned owner 0x3bb4…a4e7 and no auditor (Option::None). The owner can therefore only allow or refuse external transfers from other ledgers, which ordinary transfers within a ledger do not use. The docs' phrase "full control of the contract" overstates what the code allows. Judgment call: the substance fits 3, but 3 needs onchain evidence, and the schema cannot hold Starknet addresses, so 2. | |
| Tornado Cash (Classic pools) | The pool contracts that hold and release funds have no pause, freeze, blacklist or allowlist. Their one admin role, operator, could only swap the verifier, and it reads as the zero address onchain on every pool that has it; the two newer DAI pools have no operator at all. The verifier has no admin. TORN governance does control a gate one step out: the optional TornadoRouter checks an upgradeable InstanceRegistry and RelayerRegistry, so governance could disable an instance on the router path. Judgment call: we score the pools as the settlement contracts and give 3, because a payer and payee can call the pools directly (C2) and the router gate does not reach that path. | |
| Tria | Tria and the issuer can block an individual cardholder's transactions and suspend the account with no stated notice. No settlement contracts are published, so no onchain role can be read. Judgment call: documented per-account blocking meets anchor 0. | |
| Tuyo Card | Tuyo can suspend an individual's access at its sole discretion, with no notice period stated. The card issuer's own terms were not public to me. The FAQ says withdrawals to the user's own wallet still work when an account is restricted, but that is exit, not payment. Judgment call: per-user suspension with no stated notice meets anchor 0. The account contracts would not support a pause. | |
| Umbra Cash | The contract cannot pause, freeze or block addresses, and withdrawals are untouched by any admin. But the owner, a single EOA, can set the per-payment toll to any value, which would make new sends uneconomic or impossible for everyone, with no delay. The toll is 0 today. Judgment call: a toll is an anti-spam fee, not a pause, but because it is unbounded and EOA-held it can stop settlement, so anchor 0 (EOA-held role). | |
| Wirex One | There is no pause flag, but there is a stronger power. A single oracle EOA, set in a registry whose owner and admin is one EOA, both decides and executes every debit from user wallets, and the Terms let Wirex block addresses. No multisig, no timelock, and it can target individual wallets. The Terms' statement that Wirex cannot move a user's assets does not match FundsManagement's oracle path. | |
| Wise | Wise can suspend, restrict or close an individual customer's account, including their ability to send or withdraw money. Notice may come after the fact, or not at all where that would be unlawful or compromise security, and closure can be without notice. The power is held by Wise unilaterally and is not limited by any multisig or timelock. | |
| WORM (BETH proof-of-burn) | No one can stop, freeze or block a burn or mint. Burning is a plain ETH transfer to an address with no known key. Minting is open to any caller with a valid proof. BETH has no owner, and its one-time initializer has been cleared onchain. The Staking contract it pays a fee into also has no admin. | |
| XPlace Card | XPlace can freeze or block an individual account, its wallet interactions, or the card without prior notice, and it need not say why. That meets anchor 0. The lending market behind XPlace collateral could not be identified onchain, so the market owner's powers inside Kamino were not assessed. Card blocking by Rain sits offchain. | |
| Zcash (shielded transfers) | The Zcash consensus rules contain no admin key, pause, freeze, blacklist or allowlist role, and shielded addresses are not visible to anyone who could filter them. The rules can still be changed by coordinated node releases that miners and node operators adopt: in June 2026 the node teams shipped an emergency soft fork that disabled the whole Orchard pool for 1,174 blocks (about a day) without advance notice, to contain a balance-violation bug, documented after the fact in ZIP 257. That power is pool-wide, not per-address, and depends on miner adoption. Zebra releases also stop running 84 days after release, which forces operators to choose new software regularly. Judgment call: the substance is close to anchor 3 (no role that can target users), but the dashboard needs onchain evidence about a deployed contract for a 3, which a chain with no contract addresses cannot supply, and the June 2026 no-notice pool halt is recorded here, so we take 2. | |
| zERC20 (zBNB on BNB Chain) | The settlement contracts carry two stop powers. The Blocklist owner, a 3-of-4 Safe with undisclosed EOA signers, can add any address at once, with no timelock or notice. The token then refuses every transfer to or from that address, including funds already sitting at a burn address meant for that recipient. The Verifier owner, a second 3-of-4 Safe with the same signers, can pause all proofs and teleports with activateEmergency. Neither Safe has a module or a guard. Scored 0 because the role can target individual addresses with no notice. The docs say the list follows OFAC; that is a policy statement, not a constraint in code. |