External dependencies
| Dependency | What zk-pad uses | What its operators can do | Impact on zk-pad |
|---|---|---|---|
| PancakeSwap Infinity (Vault, CLPoolManager, CLProtocolFeeController) | All pools, liquidity and swaps | Governance can pause the vault/pool manager, and set the protocol fee on dynamic-fee pools (default 0.03%, max 0.4%) | A pause halts trading and fee collection for every zk-pad coin. A higher protocol fee raises traders' costs (on top of F). |
| USDT (BSC-USD) | The only settlement and shield asset | The Binance-Peg issuer custodies the backing. The BSC contract is believed non-upgradeable and without a blacklist (to be verified on a fork). | A depeg or issuer failure affects every consolidated balance. Accepted single-asset risk. |
| Freeze-capable quotes (USD1, FDUSD, XAUt; USDC is upgradeable) | Pairing | Issuers can pause or blacklist, and upgrade | A freeze of a pool halts that coin forever (no migration). A freeze of the vault strands that asset. |
Railgun (BSC proxy 0x5901…8A10) | Private exit | Governance can pause, upgrade, change the shield fee (max 50%), and blocklist tokens. PPOI list providers can refuse shields. | Shields fail or cost more; funds stay in the FeeVault (or are recredited from the ShieldSender). Direct claims remain available. |
| Railgun PPOI | Shield screening | Screens tx.from (the relayer, or the creator's submitter for a template shield) against sanctions lists; 1-hour standby | Delays; a flagged submitter address could block shields. |
Chainalysis sanctions oracle (wired in config/56.json; fork-tested on 2026-10-04) | RailgunShieldAdapter screens each shield's submitter (tx.origin) | The oracle's operator maintains the list | A listed submitter's shield reverts atomically; the USDT stays in the vault. |
| Chainlink (BNB, BTC, ETH and CAKE feeds in the mainnet config) | Bounding creator-triggered consolidations | Feed operators control prices | A stale or wrong feed can make creator consolidations revert or execute within the deviation bound. Feeds are protocol-owner configuration. The beneficiary-signed path does not use them. |
| BSC validators and builders | Block production | Ordering, censorship | MEV, delayed claims. Relayers and the launch flow can submit through a private RPC (48 Club, BlockRazor). |
| Platforms (X, GitHub, Telegram, Farcaster, Discord) | Proving account ownership for social escrows (not live yet: no attestors are registered) | Account recovery, renames, API access | A hijacked account could pass OAuth; the timelock and contest flow are the mitigation. |
| OpenZeppelin, Infinity libraries, Clanker v4 | Code | Upstream bugs. Pinned versions; audited upstream. |
Licenses
Contracts that import PancakeSwap Infinity are GPL-2.0-or-later. The FeeVault and token are MIT. Railgun's Solidity is unlicensed and is not vendored; zk-pad only calls the deployed contract.