A freeze that burning could walk around
Thirty-two findings on a single gold-backed token contract, and the high-severity one was a compliance control with three ways past it.
3 minSmart Contract Audits
OpenZeppelin audited StableGen's StableGold, an 18-decimal ERC-20 representing physically held gold. The scope was one file — `contracts/StableGold.sol` — reviewed between 29 July and 4 August, reported on 19 August. Thirty-two findings came out of it: no critical, one high, three medium, ten low and eighteen notes, with twenty resolved.
The high-severity finding
The compliance freeze could be bypassed three ways: through inherited `burn` and `burnFrom` methods, through spenders holding allowances granted before the freeze, and through cross-chain mints that did not check freeze status at all. It has been resolved by enforcing the check across every affected function.
The pattern is worth naming because it recurs. A freeze implemented as one gate on one path is not a freeze; it is a gate. Anything that moves balances by another route — an inherited method, a stale approval, a bridge — has to be enumerated, and the audit found all three had been missed.
The one they did not fix
Two mediums were resolved: non-standard ERC-20 incompatibility, where raw `IERC20` calls reverted on tokens like USDT that return no boolean, fixed with `SafeERC20`; and cross-chain compliance, where neither `crosschainMint` nor `crosschainBurn` enforced the freeze list or KYC.
The third was acknowledged rather than fixed. Pooled multi-stablecoin reserves allow profitable arbitrage whenever any accepted token trades below peg. The mitigation is operational — buys and buybacks are never run at the same time — which means the protection is a procedure, not a property of the contract.
The report lists eight trust assumptions, and the first is the one holders should read: reserve backing rests on operator attestations, not on trustless proof. Everything the contract enforces sits above that.
Retold from OpenZeppelin. This is a summary in our own words; follow the link for the original reporting.