token-pr-security-check

name	token-pr-security-check
description	Security review of open token-list PRs. Verifies SAC derivation, issuer home_domain, Horizon records, icon, and file placement; flags non-SAC (WASM) tokens and unlocked issuer accounts as red flags; posts a "Claude Opinion" comment on each PR. Use when asked to review, audit, or give an opinion on token-list pull requests.

Token PR Security Check

Review open PRs on soroswap/token-list and post an opinion comment on each. Never merge anything. Opinions are advisory only.

Per-PR checklist

For each open PR, fetch the added/changed JSON (via gh api repos/soroswap/token-list/pulls/<N>/files) and check:

1. Is it a SAC (Stellar Asset Contract)?

• If the JSON has no issuer (G address), or the contract resolves on-chain to contractExecutableWasm instead of a SAC, it is a custom Soroban token. Also cross-check: enumerate classic assets with the same code on Horizon (/assets?asset_code=X) and derive each one's SAC with new StellarSdk.Asset(code, issuer).contractId(Networks.PUBLIC) — if none match the PR's contract, it is not the SAC of any classic asset.
  • Opinion in that case: "Not SAC token. It requires a security audit on the Soroban token code."
• If it claims a SAC, verify Asset(code, issuer).contractId(PUBLIC) equals both the contract field and the filename.

2. SAC correctness checks

• Domain: issuer's on-chain home_domain (Horizon /accounts/<issuer>) must equal the domain field exactly (bare domain, no https://).
• Existence: Horizon /assets?asset_code=&asset_issuer= must return a record; report holders / liquidity-pool amounts as adoption signals.
• Icon: URL must return HTTP 200 with an image/* content type.
• Auth flags: report auth_required, auth_revocable, auth_clawback_enabled (revocable/clawback = issuer can freeze or seize user balances — always mention).

3. Issuer lock status — RED FLAG if unlocked

From Horizon /accounts/<issuer> check signers and thresholds:

• Locked = master key weight 0 and no other signers with weight > 0 (issuer can never mint more or change flags).
• Unlocked = master weight > 0 or active extra signers.

If the issuer is unlocked, post a red-flag comment on the PR tagging the PR author (@<author>), explaining that the issuer can still mint unlimited supply and change flags, and asking: "Are you planning to lock the issuer account (set master key weight to 0, ideally after setting auth_immutable)?" Note auth_immutable: true as a plus when present.

4. PR hygiene

• The JSON must live at assets/<CONTRACT>.json. If it was placed at the repo root (or elsewhere) and the token itself passes the checks, push a commit to the PR branch moving it into assets/ so the CI verifier picks it up (gh pr checkout <N>, git mv, run yarn verify, push to the fork).
• PRs must not modify tokenList.json — the list is regenerated after merge with yarn merge. If a PR edits it, ask for the change as an assets/ file.
• Flag duplicate PRs (same contract) and third-party submissions (author is not the asset's organization).

Comment format

Every comment must start with:

## Claude Opinion
*Opinion generated by Claude Code. Not a decision.*

Then a bold one-line verdict, a ✅/❌/⚠️ check list with the on-chain evidence, and what (if anything) the contributor must fix. Red-flag comments use the header ## 🚩 Claude Opinion — Red Flag: <reason> and tag the author.