credkellar/tokenization-re-lab repository overview

⁠Tokenization-RE-Lab

An educational pentester reverse-engineering lab for tokenization on Monad (EVM-compatible L1, native token MON). It statically reverse-engineers how tokens are issued: what rules actually govern a transfer in code, who holds admin power over holders, and where the classic flaws hide. Synthetic, static, educational, defensive only.

⁠What it analyzes

Nine synthetic token mechanisms, generated locally — nothing is ever fetched from a chain:

1. Plain ERC-20
2. ERC-3643 allowlist (compliance-gated)
3. Freeze / blacklist token
4. Pausable clawback token
5. Uncapped-mint token
6. Upgradeable proxy
7. DTS-style registered-only token
8. Locked non-transferable token
9. Vulnerable-by-design reentrancy vault

For each sample the lab produces a full RE report: pattern fingerprints (mint, freeze, pause, clawback, delegatecall, compliance checks), the mechanism, the trust model, plain-language transfer rules, an admin power map, the supply model (fixed, capped, or uncapped mint), a risk score + severity (0–100), and an issuer-side hardening fix for every finding.

⁠Safety model

The lab never connects to Monad or any chain, never signs, never sends a transaction, and never interacts with a live contract. Live actions sit behind HOLD gates (verdict HOLD, exit code 2). The optional Muse seat is names-only and advisor-only — it can never override a HOLD.

⁠Run it

docker pull credkellar/tokenization-re-lab
docker run --rm credkellar/tokenization-re-lab

ONE interface (main.py), zero runtime dependencies.

⁠Links

• GitHub: https://github.com/credkellar/Tokenization-RE-Lab⁠