Censorship Resistance · C5
Inherited freeze exposure disclosed
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees?
Why it matters
A censorship-resistant contract settling in a freezable stablecoin on a centralized sequencer inherits both of those controls. Payees should be told which ones they are accepting.
Scoring anchors
| Supported tokens and chains enumerated in code and docs, with issuer freeze/blacklist powers and sequencer or forced-inclusion assumptions stated to payees. | |
| Enumerated in code, assumptions not stated. | |
| Enumerated in docs only. | |
| Not enumerated, or misstated. | |
| No admissible evidence submitted yet. Counts as 0 in the pillar. |
Admissible evidence
- Token allowlist in contracts or SDK config at a pinned commit verified
- L2BEAT entry for the primary chain (sequencer assumptions) documented
Common failures
- Token list lives only in a hosted API response.
Current ratings
| Provider | Score | Finding |
|---|---|---|
| Aleo (credits.aleo private transfers) | Native credits have no issuer freeze, and the chain has a validator committee rather than a sequencer. Other tokens on Aleo, including stablecoin programs that Provable publishes as compliant-stablecoin examples, are out of scope here and may carry freeze lists. Neither the CLI nor the SDK tells payees about the committee or restrictions-list assumptions. Scored 2: enumerated in code, assumptions not stated. | |
| AnomaPay | Supported tokens appear only in documentation and the launch post (ETH, USDC, USDT, XAN, with a $500 beta deposit cap claimed there); the forwarder holds whatever ERC20 is wrapped. No statement to payees about issuer freeze powers or BNB Chain's validator set. Scored 1: enumerated in docs only. | |
| Avalanche Card | The binding card agreement lists supported blockchains that omit Avalanche, while marketing names Avalanche-native collateral (AVAX, WAVAX). No issuer freeze or sequencer assumptions are stated. Judgment call: the chain enumeration in the terms is wrong for this product, which meets "misstated" (0). | |
| Avici Card | The token (USDC) is named, but the chain holding card collateral is not, and no freeze or sequencer assumptions are stated. Judgment call: without a chain, the dependencies are not enumerated, so 0. | |
| Aztec (Alpha mainnet private token transfers) | The rail does not enumerate the tokens a payee might receive: Fee Juice cannot be transferred, and payable assets are app-deployed token contracts bridged through third-party portals with their own owners, which the protocol neither lists nor describes. The sequencer, escape-hatch and upgrade assumptions are stated in the Alpha documentation. Scored 0: tokens not enumerated. | |
| Bitget Wallet Card | The four cash tokens are enumerated in the contract and in Fiat24's developer docs. Bitget's card pages do not tell cardholders about the issuer's operator powers, the sanctions oracle or Arbitrum's sequencer. Enumerated in code, assumptions not stated, so 2. | |
| Blanksquare (Shielder) | We found no enumeration of supported Base mainnet tokens in public code or docs, and no statement to users about issuer freeze powers (USDC is held by the pool) or Base's sequencer and forced-inclusion assumptions. The pool held about 0.078 ETH and 48.2 USDC at our block. Scored 0: not enumerated. | |
| COCA Card | Neither the card's settlement token nor its chain is enumerated, and no freeze or sequencer assumptions are stated. Provider's own description, so 0. | |
| Coinbase Commerce (Onchain Payment Protocol) | Chains and Transfers addresses are listed in the repo, and the SDK checkout's settlement token, USDC on Base, is in code. The hosted checkout's accepted-token list lives only in the closed API. Nothing in the repo, the SDK, or the Terms tells payees that Circle can freeze USDC or that Base runs a centralized sequencer. Judgment call: we score 2 and not 1, because the enumeration for the public path is in code. The hosted checkout's list being API-only is the listed common failure, and it keeps the cell from 3. | |
| Curvy | Supported tokens are enumerated onchain in the vault registry, and the SDK reads them from the API. A search of the docs repo finds no statement that USDC or USD₮0 can freeze the vault address, and nothing on Arbitrum sequencer or forced-inclusion assumptions. Scored 2: enumerated in code, assumptions not stated. | |
| Daimo Pay | Tokens and chains are listed in code and in the docs. Neither the repo nor docs.daimo.com tells payees that USDC, USDT, and EURC issuers can freeze balances. Neither tells them that Base and the other L2 destinations depend on a centralized sequencer. A search of SDK, docs, and README for freeze, blacklist, and sequencer found nothing. | |
| Deblock Card | No admissible evidence yet. | |
| Ethena Pay | Spendable tokens (USDe and USDC) are enumerated in verified onchain factory config. USDC carries Circle's blacklister and pauser, and payees are not told about these powers or about Avalanche's validator set. The Card Terms' Supported Blockchains list does not name Avalanche (it reserves the right to add others). Judgment call: onchain config read from a verified-source factory counts as "enumerated in code"; the generic chain list is not treated as a misstatement because it is explicitly open-ended. 2. | |
| ether.fi Cash | Tokens and the chain are enumerated in versioned config. USDC carries Circle's blacklist and pause powers, and Optimism runs a single sequencer. Neither is stated to cardholders; the risks page stays generic. Enumerated in code, assumptions not stated = 2. | |
| Exa Card | Chain and tokens are enumerated in code. USDC carries a Circle blacklister, the exaUSDC market can be paused (C1), and OP Mainnet has a single sequencer. None of this is stated to cardholders in the help center or the terms I read. Enumerated in code, assumptions not stated, so 2. | |
| Fluidkey | Chains are listed in the docs; tokens are an open set. We found no statement that USDC or other issuers can freeze funds in a stealth account, or about Base's sequencer. Judgment call: an open token set is not enumerated, so 0, as for Railgun. | |
| Fuse Card | USDC on Solana is the only card asset. That shows in the onchain spending-limit configuration and in the docs. Circle's freeze authority over USDC is not stated in the Fuse Terms, the support page or the cardholder agreement. Judgment call: onchain configuration counts as "enumerated in code"; assumptions not stated, so 2. | |
| Gnosis Pay | Tokens and chain are enumerated in code. Each one carries an issuer freeze: Monerium's blacklist validator can ban addresses for EURe and GBPe, and the bridged USDC contract has a blacklister and pauser. Neither the Terms nor the docs tell cardholders about these powers. Gnosis Chain is an L1 with no sequencer, which is also not stated. Enumerated in code, assumptions not stated, so 2. | |
| HesabPay | No admissible evidence yet. | |
| Hinkal | Users are told plainly that token issuers can blacklist the Hinkal contract. The token list itself, however, is a hosted API response, documented in the API reference but not enumerated in code or onchain. Ethereum L1 has no sequencer, so no sequencer assumption is needed for this unit. Judgment call: issuer freeze risk is disclosed, and the token list exists only in the documented API, so we score 1 (docs only). | |
| Holyheld Card | Supported tokens exist only in a hosted API response, and no document lists them with their issuers' freeze powers. The sample top-up used USDC, whose issuer can blacklist addresses; that is not stated to users. Not enumerated, so 0. | |
| Houdini Swap | Supported chains are enumerated in docs, and tokens through the hosted API. Issuer freeze or blacklist powers (USDT, USDC) and L2 sequencer assumptions are not stated to payees. Docs only, so 1. | |
| Hyperbeat Card | No admissible evidence yet. | |
| Jupiter Card | Tokens and chains are listed in docs only, with no statement of issuer freeze powers or sequencer assumptions for Arbitrum and Base. 1. | |
| M-Pesa | No admissible evidence yet. | |
| MetaMask Card | Tokens and chains are enumerated in code. The tokens carry issuer controls: USDC has a blacklister and a pauser, and mUSD can freeze accounts and force transfers. Linea also runs a centralised sequencer. None of these assumptions appears in the MetaMask support pages or the Crypto Life terms I read. Enumerated in code, assumptions not stated, so 2. | |
| Opera MiniPay | The chain and supported tokens are listed in docs. No user-facing document read states the USDC and USDT issuers' freeze or blacklist powers or the Celo sequencer assumptions. No MiniPay code is public, so the token list cannot be shown in code. | |
| Monero | The rail carries one asset, XMR, on one proof-of-work chain, so there is no issuer freeze and no sequencer to inherit. The upgrade schedule is published in the README. Neither the GUI nor the CLI states to payees that the chain depends on scheduled hard forks and miner adoption. Scored 2: enumerated in code, assumptions not stated. | |
| Nullmask | Supported tokens are not enumerated in docs or public code. The terms do warn that a stablecoin issuer can freeze the pool. Scored 0: not enumerated. | |
| Oobit Card | Tokens and chains are enumerated in docs only, and the two lists disagree. Freeze powers of USDT and USDC issuers are not stated. 1. | |
| Payy Card | The token (USDC) and chain (Ethereum) are enumerated in code and onchain. The Terms, privacy policy and card docs do not mention Circle's freeze powers. They also do not say that the Payy rollup has a single Payy-run prover and no forced-inclusion path. Enumerated in code, assumptions not stated, so 2. | |
| Phantom Cash | The token and chain are enumerated in docs (CASH on Solana). The issuer's powers are misstated: the FAQ says no partner can pull CASH out of a Cash account, but the mint carries a permanent delegate that can move or burn any holder's CASH, and a freeze authority. Solana has no sequencer, which is not stated either. Misstated, so 0. | |
| Plasma One | The collateral asset (USDT0) is enumerated in onchain Coordinator config read from verified source, and the Terms warn that stablecoin issuers can freeze addresses, without naming USDT0's blocklist. Plasma's validator set and inclusion assumptions are not stated. Judgment call: the generic freeze warning is not a per-token statement, so 2, not 3. | |
| Privacy Pools (0xbow) | Tokens and pools are enumerated in code and onchain. We found no statement in the repos or terms that USDC and USDT can freeze a pool or the Entrypoint, which would lock every deposit in that pool. Ethereum L1 has no sequencer. Scored 2: enumerated in code, assumptions not stated. | |
| Railgun | Chains are enumerated in shared-models, but tokens are an open set, and we found no statement in the repos or docs that issuer freezes (USDC, USDT) can lock the RAILGUN contract's balance of a token. Judgment call: an open token set cannot be enumerated, and the anchor names "not enumerated" as 0; we take the lower anchor. | |
| Request Network | Tokens and chains are listed in code and on the supported-chains docs page. The docs then tell payees that freezing and seizure risks do not apply, although the main settlement assets, USDC and USDT, can be frozen by their issuers. Base, the primary chain, also runs on a single centralized sequencer, and the docs do not mention it. A search of the docs for freeze, blacklist, and sequencer found only the passage above. Judgment call: we score 0 and not 2. The enumeration in code would justify 2, but anchor 0 includes "misstated", and the docs misstate the freeze risk. | |
| Rizon Card | The card terms name chains but not tokens, and Rizon's own help centre gives a different chain list. Neither states the issuers' freeze powers or the sequencer assumptions. Judgment call: tokens are not enumerated and the chain lists conflict, so 0, not 1. | |
| SafePal Card | The four cash tokens are enumerated in the contract and in Fiat24's developer docs. Users are told about one freeze case (sending tokens to an unregistered address) but not about the issuer's operator powers, the sanctions oracle or Arbitrum's sequencer. Judgment call: a partial freeze statement does not meet "stated to payees", so 2. | |
| Solayer Card (Emerald Card / Solayer Pay) | The token (USDC) and chains are named in docs only, and the docs disagree on the chain: the Card Terms say Solana, the product pages say Solayer Chain. Freeze powers are not stated. 1. | |
| Tongo (confidential ERC-20 on Starknet) | Tokens are enumerated in the docs, and onchain through each Vault's get_vault_config, which we read but cannot cite as onchain evidence here. No document tells users that Circle can freeze native USDC held by a Vault. Nor does any document state that Starknet's single StarkWare sequencer can censor transactions. Scored 1: enumerated in docs only. | |
| Tornado Cash (Classic pools) | Tokens and pools are enumerated onchain and in the UI config. Neither the repos nor the UI tell users that USDC and USDT can blacklist a pool address, which would lock every note in that pool; the pools were not blacklisted at our block. ETH and DAI pools carry no issuer freeze. Ethereum L1 has no sequencer. Scored 2: enumerated in code, assumptions not stated. | |
| Tria | Chains are enumerated in the card terms only (with an open-ended clause); collateral tokens and their issuers' freeze powers are not listed. Enumerated in docs only, so 1. | |
| Tuyo Card | USDC on Base is enumerated in docs only. Issuer freeze and sequencer assumptions are not stated. 1. | |
| Umbra Cash | Chains are enumerated in the SDK, but supported tokens live only in a hosted API response, and we found no statement that issuer freezes can lock tokens held by the Umbra contract or a stealth address. Scored 0: not enumerated in code or docs. | |
| Wirex One | Tokens are enumerated onchain and in a versioned repo document. Users are not told about the issuers' freeze powers (Circle and Tether blacklists), Wirex's own control of the upgradeable WUSD/WEUR synthetics, or Base's centralized sequencer. Enumerated, assumptions not stated, so 2. | |
| Wise | No admissible evidence yet. | |
| WORM (BETH proof-of-burn) | The only asset is native ETH, which no issuer can freeze. Ethereum L1 has no sequencer. The payee receives BETH, an immutable ERC-20, and the hooks sell it for ETH or tokens through one named AMM router. The repos do not state the liquidity or price risk of BETH against ETH, which is the main inherited exposure. Scored 2: enumerated in code, assumptions not stated. | |
| XPlace Card | Tokens and the chain are listed in docs only, and issuer freeze powers are not stated to cardholders. 1. | |
| Zcash (shielded transfers) | The rail carries one asset, ZEC, on one proof-of-work chain, so there is no issuer freeze and no sequencer to inherit. Pool-level changes are the inherited risk: after NU6.3 the Orchard pool is spend-only (ZIP 258 L85-L100), and in June 2026 Orchard was disabled for about a day (see C1). The reference wallet does not state these assumptions to payees. Scored 2: enumerated in code, assumptions not stated. | |
| zERC20 (zBNB on BNB Chain) | Tokens and chains are enumerated onchain and in the docs. zBNB wraps native BNB, which has no issuer freeze. The freeze power that matters is zERC20's own Blocklist (C1), which the docs disclose. The docs do not state BNB Chain's validator-set assumptions or LayerZero's DVN trust for cross-chain roots. Scored 2: enumerated in code, chain and messaging assumptions not stated. |