Title [Asset Technical Assessment] GOOGLc on Base
Author: Aave Labs
Date: 2026-10-23
Summary
Technical assessment of GOOGLc on Base, following the Technical Asset Listing Framework.
GOOGLc is a Base native tokenised representation of Alphabet Inc. shares, with a dedicated Chainlink feed, observable supply activity, and no bridge route. The B20 token implementation has published audit coverage. Material considerations are the feed’s current 24/5 availability and high pricing risk classification, a unique pricing methodology that uses a token multiplier to account for certain events, issuer controls without an onchain timelock, and offchain custody and corporate action processes with permissioned redemption.
Technical conclusion
From a technical standpoint, GOOGLc is eligible for listing on Base.
Asset under review
| Field |
Value |
| Asset |
Alphabet Inc. (GOOGLc) |
| Target chain |
Base (chain ID 8453) |
| Token contract |
0xb2000000000000000000002D0BA3164cc74f58B7 |
| Native to target chain? |
Yes, supply is minted directly on Base by an issuer controlled minting system. |
| AAcA classification |
Financial instrument, tokenised equity representing Alphabet Inc. shares |
The B20 standard implements token behavior in Base node software rather than in deployed smart contract code. One token unit represents one underlying share multiplied by the token’s onchain multiplier value, with the underlying shares held in offchain custody by the issuer.
0. Pre-screening
The token is active on Base and identified by the B20 factory as an initialized asset token. Its one byte account marker is interpreted by Base’s execution client, which provides the token functionality. The asset source is not verified on the block explorer because the token is implemented as a native precompile rather than a conventional Solidity smart contract; given that the explorer does not support precompiles as verified source code, the token’s overall transparency and visibility are reduced. The B20 implementation in use is identifiable from the Base client release and was confirmed against the live token interface.
Rating: ★★☆ Acceptable → the token deployment and implementing version are identifiable, but the token source cannot be verified on the block explorer because it is a native precompile.
1. ERC20 Compliance
GOOGLc has eight decimals and supports standard ERC20 transfer, approval, allowance, and permit behavior. Transfers have no fee, do not rebase balances, and have no ERC777, ERC1363, or flash mint functionality. Sender, receiver, executor, and mint recipient checks all apply a blocklist of 479 addresses.
Rating: ★★☆ Acceptable → standard token semantics are present, but transfers remain subject to an issuer administered blocklist.
2. Oracle
A dedicated Chainlink Coinbase GOOGL feed is live on Base and reports the price per GOOGLc token unit, including the multiplier. The feed updates on a 0.5% price deviation or a 24 hour heartbeat, although these conditions do not apply during closed market hours, when the feed holds its last value. The current feed operates 24/5, and its publication history records gaps of 53.26 hours over a weekend and 81.60 hours over a market holiday weekend, while the token continues to trade on Base. Work is in progress toward 24/7 feed availability, Chainlink currently classifies the feed’s pricing risk as high, and the issuer’s OracleRegistry can also pause feed publication immediately.
Rating: ★☆☆ Concern → the current feed is available 24/5 and has extended gaps across market closures, while work is in progress toward 24/7 availability; Chainlink classifies its pricing risk as high, and the issuer can pause publication immediately.
3. Access Control
Issuer authorities are held by externally owned account (EOA) addresses managed through a private hardware security module (HSM) system, reported to provide auditability, approval flows, alerting, monitoring, pull request review, and at least three of three approvals for administrative actions, though the private system was not available for direct review in this technical assessment. The same arrangement applies to the token administrator, which controls token administration, the mint and burn controller administration, the factory, the redemption allowlist, and the issuer controlled price feed pause. No role is protected by an onchain timelock: the token’s supply cap is effectively uncapped, and the token administrator can alter or bypass the 15,700 token daily mint limit by granting MINT_ROLE; a separate policy administrator controls the transfer blocklist and can permanently freeze its membership. Following the Cobalt network upgrade, the token also supports direct seizure of holder balances, although the token administrator does not hold SEIZE_ROLE; the token is immutable outside Base network upgrades, but the mint and burn controller is upgradeable through an HSM protected authority without an onchain delay.
Rating: ★★☆ Acceptable → the private HSM control model was not directly reviewed, while critical actions remain immediate and authority is concentrated across the token, mint, seizure, redemption, and oracle control surfaces.
4. Exchange Rate and Yield
GOOGLc is not yield bearing, but its onchain multiplier defines the number of underlying shares represented by each token unit; it is currently 1.000377, following a single change on 2026-09-14 for a cash dividend, which was announced and executed in the same transaction. The operator can change the multiplier immediately in either direction, with no ceiling, monotonicity requirement, or enforced advance notice, including while transfers are paused; a scheduled update path is also available alongside the immediate one, and no scheduled change is pending. The Chainlink feed incorporates the multiplier, leaving an interval in which the reported collateral value may not reflect a changed share entitlement. Redemption is restricted to five authorized addresses, so a liquidator would need to exit through onchain liquidity.
Rating: ★★☆ Acceptable → the shares per token multiplier can change immediately, without an enforced notice period or bound.
5. Token Architecture
The token is implemented as a Base B20 asset, with a one byte account marker and functionality executed by Base nodes rather than EVM contract code. Supply minting and burning, role changes, policy changes, and multiplier changes are observable onchain. The token’s name and symbol are mutable, and systems that identify a token by conventional bytecode or verified contract source may not recognize this architecture correctly.
Rating: ★★☆ Acceptable → the architecture has one canonical, observable token entry point, but its nonstandard account form and mutable identity are integration considerations.
6. Bridge and Cross-Chain Risk
Not applicable. GOOGLc is issued natively on Base, and no bridge, cross chain mint route, or wrapped representation holds a token permission.
Rating: N/A
7. Audit and Security History
Four Cantina Managed reports cover the B20 standard, including the token path in the Base client version described in this technical assessment. The reports found no Critical issue, and no High or Critical finding affecting the B20 asset token surface. The issuer operated TokenSupplyManager, B20AssetFactory, and OracleRegistry have verified source code. A $5 million Cantina programme and a $1 million HackerOne programme provide bug bounty coverage.
Rating: ★★★ Strong
8. Dependencies
GOOGLc depends on Base’s execution client for its complete token implementation, the issuer’s TokenSupplyManager and OracleRegistry, the Chainlink feed, and offchain custody and corporate action processes. The administrative control posture of the issuer operated contracts is assessed in Section 3. The backing process has no onchain proof of reserves or reserve attestation. The redemption model and resulting liquidation dependency are assessed in Section 4.
Rating: ★☆☆ Concern → the underlying custody and corporate action processes cannot be verified onchain, and liquidation depends on decentralized exchange liquidity because redemption is permissioned.
9. Summary
Findings table
Ratings in this table use the star scale from the section Rating lines: ★★★ Strong, ★★☆ Acceptable, ★☆☆ Concern, and N/A where not applicable.
| Area |
Key finding |
Rating |
| 0. Pre-screening |
Active Base B20 token with an identifiable client implementation, but no conventional per asset source verification. |
★★☆ |
| 1. ERC20 |
Eight decimal ERC20 behavior without fees, rebase, hooks, or flash mint, subject to a transfer blocklist. |
★★☆ |
| 2. Oracle |
Dedicated Chainlink feed currently available 24/5, with 24/7 availability in progress and a high pricing risk classification. |
★☆☆ |
| 3. Access control |
HSM protected administrative wallets control immediate, concentrated token, mint, seizure, redemption, and oracle authorities. |
★★☆ |
| 4. Exchange rate / yield |
The multiplier can change the shares represented per token immediately and without a bound. |
★★☆ |
| 5. Token architecture |
Chain native B20 implementation with observable actions, nonstandard account form, and mutable identity. |
★★☆ |
| 6. Bridge and cross-chain |
Native Base issuance with no bridge or cross chain mint route. |
N/A |
| 7. Audit and security |
Published B20 audit coverage and verified source for issuer operated contracts in the critical path. |
★★★ |
| 8. Dependencies |
Offchain custody and corporate action processes remain unverified onchain, and redemption is permissioned. |
★☆☆ |
Disclaimer
Aave Labs has no formal or informal affiliation with Coinbase or the GOOGLc issuer beyond this technical assessment. Aave Labs has not been compensated by Coinbase or any related party in connection with this work.