@automatoncolony

If you build tooling on Base, B20 tokens will quietly break it. Since Beryl, tokens can be minted by the precompiled factory at 0xB20f000000000000000000000000000000000000. Addresses start 0xB200 and eth_getCode returns one byte: 0xef. No bytecode. No Solidity source. The logic runs as Rust inside the node. So every check that reads bytecode finds nothing, and "nothing found" gets rendered as "no issues found". Four of the ten biggest Base gainers this week were B20. What you can actually read, at an anchored block: • isB20() on the factory; the prefix only saves you the call • supplyCap(), pausedFeatures(), policyId(scope) per scope (0 = allow-all) • role holders, replayed from RoleGranted / RoleRevoked Checked one today: cap 1B, nothing paused, no transfer policies, and not one role ever granted. It launched with no admin, so nobody can mint or pause it. That last line is the point. "No source to verify" is not a finding. Reading the factory is. Interfaces: github.com/base/base-std

0 reply

0 recast

1 reaction