Blacklist Tracker Changelog: v4 archive

Impact notes

• After splitting LP/basket rows by constituent value, remove self legs from both the qualifying numerator and the denominator. Measure issuer/custodian exposure against the remaining external backing, rather than allowing own-token legs to dilute that exposure.
• This replaces v4.4's denominator-only treatment of self legs. Reserve-card valuation already looks through crvUSD YieldBasis LPs to their external BTC backing; FreezeWatch now uses the same external-backing scope.
• The threshold remains strictly greater than 50%. CDP/lending books remain debt-weighted; other reserve-backed tokens use published composition. Qualifying collateral counts categorically when its exposure terminates in issuer/custodian control; DAO-only controls remain excluded, custodied commodities count, different same-issuer tokens retain their own status, and unmeasurable reserves never establish Upstream.
• Five active coins change from No to Upstream: crvUSD (crvusd-curve), DOLA (dola-inverse-finance), sDOLA (sdola-inverse-finance), reUSD (reusd-resupply) and sreUSD (sreusd-resupply). The changes include the newly qualifying external backing and its downstream parent/collateral claims.
• Across 396 active coins, the buckets move from 212 Yes / 56 Upstream / 109 Possible / 19 No to 212 Yes / 61 Upstream / 109 Possible / 14 No. No direct Yes or Possible classification changes.

Impact notes

• Materiality is measured per deployment before failing closed; individually sub-threshold controlled deployments are disclosed but never aggregated to set a verdict.
• Yes requires a current authority able to target arbitrary holders, including enforced allowlists, sanctions oracles, active exit gates and arbitrary-holder burns. Directly assigning a victim's denylist-state role is an active blacklist power; merely appointing an operator is not.
• Global transfer pauses, all admin/DAO-upgradeable token implementations, grantable empty or incapable operator roles, dormant exit gates, material canonical-bridge burner surfaces and issuer-shipped consensus halts resolve to Possible unless an independent active holder-targeted control establishes Yes.
• Upstream requires a qualifying parent claim, full CEX custody or strictly more than 50% measured issuer/custodian reserve exposure. Categorical collateral counting excludes DAO-only controls and includes custodial fiat, bank/fund/T-bill claims and allocated physical commodities.
• CDP/lending reserve tests use debt-weighted exposure; reserve-backed tokens use published composition. LPs split by constituent value, with the coin and its own wrappers/savings-share legs only in the denominator; different tokens from the same issuer count at their own status. Unmeasurable reserves never establish Upstream.
• The full-dataset re-review of all 397 active coins refreshes deployment, role, control and reserve evidence under the same procedure: 117 statuses change and the active buckets move from 288 Yes / 77 Upstream / 18 Possible / 14 No to 213 Yes / 56 Upstream / 109 Possible / 19 No. Most moves are Yes or Upstream to Possible for pause-only, upgrade-only or grantable-role tokens; 8 Yes move to Upstream, 6 Upstream move to No, and 4 coins move up to Yes on newly verified active controls.
• Tracker configuration restores current PAXG freeze/unfreeze topics while preserving legacy history, corrects Avalanche USDT to its deployment-era indexed block/destroy family, and retires non-emitting Binance-Peg BSC and legacy Optimism USDT scans; the separate Optimism USDT0 scan remains.
• Active parent/status consistency validation rejects No children of exposed declared parents and inherited children supported only by No parents without a separate qualifying reserve/custody candidate; this guard does not substitute for measuring the reserve threshold.

Impact notes

• Equivalent EVM log spellings and Tron account representations no longer duplicate public events, active counts, or snapshots. Newly persisted Tron addresses use validated lowercase 0x byte identities; Base58 remains a provider-call and display representation.
• Numeric transaction-local lifecycle ordering replaces lexical ordering. Cross-transaction lifecycle and amount ordering must be proven by chain evidence; missing or contradictory evidence remains ambiguous rather than manufacturing an active state or amount.
• An EVM or Tron scan that makes bounded progress but has not reached its observed safe frontier is incomplete. It cannot advance success clocks or publish a fresh producer summary as if coverage were caught up.
• Tron historical balance replay validates the decimal-scaled token amount rather than rejecting ordinary 18-decimal raw balances solely because they exceed JavaScript's safe integer range; genuinely excessive scaled amounts remain inadmissible.
• Budget-skipped and order-withheld snapshot work is retained as durable debt for maintenance retries. Operator snapshot admission obeys execution and ambiguity evidence instead of transaction-hash order.
• Unknown event-time and current USD values remain unavailable. Mixed aggregates publish known subtotals with partial valuation coverage; all canonical tracked gold cohorts, including XAUM, contribute when observed.
• Historical non-USD repair recovers native amounts but keeps USD unavailable without an event-time quote. A gold zero substitution carries explicit provenance and is not treated as a failed observation or silently substituted for one.
• RPC block timestamps are admitted only when the returned block hash matches the event's block evidence, preventing a different block generation from supplying event time.
• Blacklistability classifications and scan cadence are unchanged. Fixed-clock identity, ordering, valuation, and coverage comparison remains a release prerequisite; no production replay or runtime-health result is claimed.
• Activation is provisionally 2026-10-11 00:00 UTC (1791676800); re-date effectiveAt at release

Impact notes

• Confirmed Tron block-array positions are persisted separately from transaction-local event indices; neither transaction hashes nor provider event order imply execution order.
• A bounded, serial maintenance pass repairs both retained and newly ingested conflicting events without rewinding scan cursors.
• Missing positions keep tron-cross-transaction-order and remain excluded from confirmed active counts. Proved freeze-then-destroy records remain blacklisted but contribute no active frozen amount.
• Historical event-time amounts and retained freeze-ledger balances keep their existing independent evidence requirements.

Impact notes

• Timestamp, block number, numeric log index, and array suffix replace lexical transaction-hash ordering across state folds, SQL history selection, and ledger rebuilds.
• Same-block Tron events across transactions do not imply a known order; affected records are excluded from confirmed active counts and reported as tron-cross-transaction-order.
• Missing or invalid direction bools, address arrays, addresses, and log identities hold the frontier for up to three distinct scans, then retain source evidence and a named decode-retry-exhausted disposition in durable storage.
• A valid empty address array remains a complete observation; unknown event-time amounts remain separate from required state evidence.

Impact notes

• `blacklistabilityReview.reviewedStatus` is now the only authored Yes, Upstream, Possible, or No verdict
• The generated client-registry `blacklistStatus` is a direct projection of that verdict for FreezeWatch, Report Cards, coverage views, and Selector data
• Safety Score V9 continues to consume the same review for evidence and scoring, but its access projection is no longer a fallback product-status source
• All 404 tracked stablecoin classifications are unchanged by the migration