B20 Console by Charon

Methodology

How B20 Console reads onchain state and produces risk scores.

Risk Score

B20 Console is a read-only inspector. It does not decide whether a token is good or bad. It reads onchain state, normalizes the result, and produces a deterministic risk score with reasons.

methodology deterministic_rules_v1

The risk score is rule-based. Each matched rule adds points. The final score is capped at 100.

0 — 24 low
25 — 59 medium
60 — 100 high

If reads fail and the score is otherwise 0, the level can be unknown.

Inspection Flow

  1. Validate the address format.
  2. Check deployed bytecode at the address.
  3. Check whether the B20 factory recognizes the token.
  4. Read token metadata and supply data.
  5. Read B20 policy IDs.
  6. Read policy registry state.
  7. Read pause state for B20 features.
  8. Read permit / EIP-712 domain data.
  9. Convert findings into risk reasons.

Invalid or unavailable contracts do not produce a normal report.

special cases
INVALID_ADDRESS address is not valid
NO_CONTRACT no contract exists at this address
NOT_B20 contract exists, but B20 factory does not recognize it

Risk Flags

b20_features_inactive high

B20 features are not active on this chain. This usually means the selected chain does not currently expose the expected B20 feature registry state.

not_b20 high

The B20 factory does not recognize this address as a B20 token.

not_initialized high

The address matches the B20 path but is not initialized. An uninitialized B20 address is not a usable live token.

policy_read_failed.<scope> medium

A policy ID could not be read from the token. This can mean the token does not expose the expected policy interface, the RPC failed, or the read reverted.

policy_always_block.<scope> high

The token uses an ALWAYS_BLOCK policy for the given scope. This can block a category of token operation.

policy_custom.<scope> medium

The token uses a custom policy for the given scope. Custom policy is not automatically bad, but it means behavior depends on policy logic outside the basic token surface.

policy_missing.<scope> high

The token points to a policy ID that does not exist in the policy registry. This can create broken or unexpected behavior for the affected scope.

policy_admin.<scope> medium

The policy has an active admin. An active admin can indicate mutable policy control.

policy_pending_admin.<scope> medium

The policy has a pending admin transfer. This indicates policy control may change.

paused.<feature> medium

A B20 feature is currently paused. Paused features can restrict token behavior.

pause_read_failed.<feature> medium

The pause state for a feature could not be read. This is treated as uncertainty.

supply_cap_unknown medium

Supply cap could not be read. The UI should avoid implying supply safety when the cap is unknown.

supply_cap_unbounded medium

Supply cap is set to the B20 max sentinel. This means the token effectively has an unbounded cap inside the inspected model.

supply_exceeds_cap high

Total supply is greater than the reported supply cap. This is a strong invariant failure.

permit_incomplete low

Permit / EIP-712 domain data could not be fully read. This affects signing and approval UX.

read_warning.<step> low

One of the onchain reads failed. The raw JSON should expose the failed step and error code.

Deployer-Controlled Risk Surface

The most important deployer-controlled or deployer-influenced flags are:

flags to watch
policy_custom.*
policy_always_block.*
policy_missing.*
policy_admin.*
policy_pending_admin.*
paused.*
supply_cap_unbounded
supply_exceeds_cap
permit_incomplete

Policy Scopes

B20 Console reads policy state for these scopes:

scopes
TRANSFER_SENDER_POLICY
TRANSFER_RECEIVER_POLICY
APPROVAL_SENDER_POLICY
APPROVAL_RECIPIENT_POLICY

Each scope has:

id policy identifier
label ALWAYS_ALLOW | ALWAYS_BLOCK | CUSTOM
exists whether the policy exists in the registry
admin active admin address (if any)
pendingAdmin pending admin transfer (if any)

Pausable Features

B20 Console reads pause state for:

features
transfer
approval
mint

Each feature can be: active, paused, or unknown.

Error Codes

INVALID_ADDRESS input

The address provided is not a valid Ethereum address.

UNSUPPORTED_CHAIN input

The selected chain is not supported by B20 Console.

PRECOMPILE_INACTIVE read

The B20 precompile returned no data, usually meaning the feature is inactive on this chain.

RPC_TIMEOUT network

The RPC request timed out.

RPC_RATE_LIMITED network

The RPC provider returned a rate limit error (429).

RPC_NETWORK_ERROR network

A network-level error occurred while reaching the RPC provider.

READ_FAILED read

A catch-all error for any failed onchain read.