LlamaRisk supports onboarding SCR as a non-collateral asset on the Scroll instance. While we see marginal upside for Aave, the potential airdrop distribution will benefit its users. The asset remains new, with few farming opportunities and integrations. The foreseen use case at this point for the asset will potentially be airdrop farming and the option to short the token.
SCR’s low-float/high-FDV nature, combined with high concentration of circulating supply in few wallets during the airdrop and Binance Launchpool event, indicates significant downside volatility risk. This materialized in a 44% decrease in chain TVL and 50% decrease in SCR token price since launch, reflecting negative community response to these distribution events.
The governance structure presents significant concerns with ~80% of SCR supply held by multisigs controlled by 5 protocol-related signers. The claimed 4-year vesting schedule with 1-year cliff could not be verified onchain, and no restrictions exist on token transferability. While governance contracts are deployed and verified on ScrollScan, they remain inactive and their codebase is not publicly available. A bug bounty program is in place.
Expand to see our Collateral Risk Assessment
Collateral Risk Assessment
1. Asset Fundamental Characteristics
1.1 Asset
SCR Key statistics (as of November 8th, 2024):
- 1,000,000,000 total supply
- 190,000,000 circulating supply
- 125,291,814 $USD market cap
The SCR token is the governance token of the Scroll L2, a zero-knowledge proofs (zkEVM) scaling solution for Ethereum. First announced on October 8, 2024, it was in part distributed through an airdrop made available on October 22, 2024, and whose snapshot took place October 19, 2024.
Although the SCR token is currently being advertised as a governance token, it is currently not being used in that way, as the governance process is not live yet. In the future, it is also expected to become a utility token once Scroll reaches a sufficient level of maturity. SCR will be needed to operate a sequencer or a prover on Scroll L2 — two key components of the Scroll L2 Architecture.
1.2 Architecture
The architecture for SCR is simple and is solely deployed on the Scroll L2 chain. The key contracts include:
The token ERC20 contract for SCR has the added ability to take snapshots of the voting power at various times, as well as a delegation mechanism that allows for partial delegations as well. The most central contract is the Governor contract through which proposals are created and voted upon by the community. It is an upgraded version of the OpenZeppelin’s Governor through which all proposals are made and voted upon. Various multisigs can interact with this contract with different levels of privilege to facilitate the voting process and maintain security. Finally, proposals with a passing vote which necessitate onchain actions must go through a Timelock of 3 days. Although the contracts are deployed, it is important to note that the governance system is not used yet.
Source: Scroll Governance documentation, October 25th, 2024
1.3 Tokenomics
Source: Scroll blog - SCR token announcement, October 24th, 2024
The SCR token distribution has attracted significant negative feedback from the Scroll community for its low-float/high-FDV nature as well as an initial distribution that was deemed to unfairly favor insiders and whales.
5.5% of the circulating supply was first made available through a Binance launchpool that started October 9th, 2024 and that lasted for 2 days. Large BNB stakers were able to farm most of the SCR reward in a short timeframe and obtain almost as much as early users of the Scroll L2 since its launch 1 year before. 7% of the circulating supply was distributed on October 22, 2024, through an airdrop whose snapshot took place on October 19, 2024. For the airdrop, the Scroll team decided to go for a linear distribution scheme with no limit per wallet. This resulted in the top 100 wallets receiving close to 34% of the total airdrop.
The documentation mentions that investors (17%) and core contributors (23%) will be subjected to a 4 year vesting period with a 1 year cliff. The Scroll DAO Treasury (10%) will be partially subjected to this 4-year vesting with a 1-year cliff, with 2% of the total supply within being liquid at launch. Within the Ecosystem & Growth (25%), 5.5% will be dedicated to the Binance Launchpool distribution, 2.5% will be made liquid at launch to support ecosystem partners, with the rest being locked into a 4-year vesting period with a 1-year cliff. It is important to note that the documentation does not reflect the situation onchain, as we found that most of the non-circulating supply (>80%) is currently being allocated to various multisigs, each with the same 5 signers, and nothing preventing transferability.
2. Market Risk
2.1 Liquidity
Source: Kyberswap, November 8th, 2024
Onchain aggregators indicate that up to 105k SCR ($69.5k) can be liquidated for ETH within a 7.5% price impact. This is a relatively low level of liquidity for a network token.
2.2 Volatility
Source: GeckoTerminal, November 8th, 2024
Calculating the volatility would not be informative for such a young asset. However, it is important to note that the SCR/USD market rate started at approximately $1.3 and has since consistently decreased, with a low of $0.53 and a current price of $0.67.
2.3 Exchanges
Although SCR was launched less than one month ago, it was made available on many CEXs and DEXs quickly. Here are some of the largest DEX liquidity venues as of November 8th, 2024:
The relatively identical TVL of the three largest pools hints at a liquidity incentive program from the Scroll ecosystem aimed at bootstrapping liquidity for this new asset.
2.4 Growth
Source: Scrollscan, November 8th, 2024
The top 5 wallets correspond to multiple 3/5 multisigs that control the different SCR token allocations outlined in the token distribution schedule — more on that in section 4.2 on access control risks. The sixth top holder is an EOA that holds 8.12% of the total supply (42% of the circulating supply), and seems to be a Binance wallet. The seventh top holder is another 3/5 multisig controlled by the same 5 signers as the top 5 wallets. The 8th top holder is a TokenDistributor contract that is responsible for the airdrop allocation. The 9th top holder is another 3/5 multisig that previously held 7.4% of the total supply but has been distributing its balance to numerous addresses in the last few days. The top 10th, 11th, and 12th wallets are whale EOAs, each with more than 1% of the circulating supply.
Source: DefiLlama, November 8th, 2024
TVL has decreased from a high of $1b to a low of $400m following the airdrop distribution.
3. Technological Risk
3.1 Smart Contract Risk
The Git repository got the whole Scroll L2 chain is available on Github. This repository contains contracts for the bridge, but not the governance contracts, which could not be found. However, the governance contracts on deployed and verified on Scroll L2:
To the best of our knowledge, no audit has been conducted on the governance contract. There is an Immunefi bug bounty available since October 17th, 2023, with a maximum reward of $1m, but it only covers the Scroll L2 chain, not the governance contracts.
3.2 Price Feed Risk
There is currently no Chainlink price feed for SCR.
3.3 Dependency Risk
An obvious dependency is that of the Scroll L2 chain, which SCR token holders will be expected to administrate in the future. However, since the security of the Scroll L2 chain technology is out-of-scope, that will be ommitted here.
Another dependency is that of the L1/L2 bridge, which is controlled by an AccessControlEnumerable contract from OpenZeppelin on both L1 and L2. This contract has several roles which are assigned to various timelocks (1-day timelock, 7 days timelock, and 14 days timelock) and multisigs (4/5 multisig and 2/5 multisig), ensuring security. Here are the main L1/L2 bridge contracts:
4. Counterparty Risk
4.1 Governance and Regulatory Risk
Although the governance process is documented in depth, it is currently not active. The governance forum is live, but displays a low level of activity since its inception, with 0 proposals discussed yet.
Source: Scroll forum, October 25th, 2024
Proposals will be first discussed on the Scroll forum. Every 4 weeks, the Governance Manager will look for proposals whose proposer has at least 5% of the total supply, and which were endorsed by at least 3 serious participants, and add them to the next voting batch. There are different proposal types, each with a different quorum and approval threshold. For instance, changing the governance parameters requires a supermajority, whereas a simple transfer requires a regular majority.
Once the Governance Manager adds proposals to the governance platform, proposals go through two phases — a voting delay of 3 days at the end of which a voting power snapshot is taken, and a voting period of 7 days. At the end of the voting period, proposals with a passing vote either go through onchain execution with the 3-day timelock or trigger offchain actions from the Security Council or the Scroll Foundation.
The following governance multisigs are documented:
- The Governor Admin is a high-privilege multisig who has as a signer the Security Council, which is itself a multisig. The Governor Admin has extended powers over the voting process and can, for example, update the voting delays, cancel a proposal, or update a proposal threshold.
- The Governor Manager can create proposals without needing to have 5% of the voting power.
- The Security Council is a 9/12 multisig that oversees protocol upgrades and emergency responses.
All proposals with a passing vote and which require onchain actions will go through a 3-day. It remains to be seen if onchain changes will be executed trustlessly onchain or not.
Token allocation
Here are the top 5 holders, holding 78% of the total supply:
- 3/5 multisig holding 22.94% of the total supply
- 3/5 multisig holding 19.12% of the total supply
- 3/5 multisig holding 17.05% of the total supply
- 3/5 multisig holding 10% of the total supply
- 3/5 multisig holding 9.16% of the total supply
Given the amounts held by those multisigs, we can deduce that they correspond to each of the different categories outlined in the token distribution schedule. However, we could not find any onchain mechanism limiting the transferability of those tokens, nor anything enforcing the advertised 4-year vesting schedule with a 1-year cliff. Furthermore, each of the previously mentioned 3/5 multisigs is controlled by the same set of 5 signers, and each of those are EOAs:
4.2 Access Control Risk
The GovernanceManager contract currently has an EOA as admin and manager. The contracts also point to a 3-day Timelock. While the token contract is under a proxy, current tooling (block explorer) does not allow us to verify who the current admin is. Admin was set a deployment to a 3/4 multisig. The permissionned roles (BURNER_ROLE,DEFAULT_ADMIN_ROLE & MINTER_ROLE) are unassigned.
Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and available here.
Awaiting further details on price feed availabiltiy.
This review was independently prepared by LlamaRisk, a community-led non-profit decentralized organization funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
