Standard for "transferable to arbitrary addresses" on tokenized RWAs? (locked v4 pools quoted in tokenized stocks)

ERCs
, ,
1

Been looking at a launchpad on mainnet (sender.family) that does something I haven’t seen elsewhere and I’m not sure it’s safe.

Instead of a bonding curve + migration, it puts the whole supply into a single one-sided Uniswap v4 position and locks it forever. Fine, clanker/zora do similar on base. The new part: the quote asset can be anything on their allowlist, including Ondo tokenized stocks (NVDA, TSLA, AAPL). And the creator can route 70% of the swap fee to holders, paid in the stock token. So a coin whose holders earn tokenized nvidia from trading volume. It’s announced today, and I couldn’t find a live stock pair yet.

What bugs me:

  • tokenized equities usually have a KYC transfer registry. In v4 all pool balances sit in the singleton PoolManager, and swap output / fee payouts go to arbitrary addresses. So the issuer has to allow the PoolManager AND everyone. If they ever tighten rules, the pool is bricked with the money inside, and the lock means nobody can pull it, not even the protocol.
  • their fix is empirical: they move a real balance between two random addresses and if it works the asset gets allowlisted. That’s a point-in-time check on an asset that has an admin.
  • their own docs say most Ondo tokens have no pool at all, so they check reachability before you sign. Honest, but it shows how thin this is.

Questions:

  1. Is there any existing way to check “transferable to arbitrary addresses” onchain before creating a pool? ERC-3643 canTransfer is per address and stateful, doesn’t really help.
  2. Should permanent lockers just refuse quote assets behind upgradeable proxies / with pause? Or is an escape hatch that only triggers on transfer failure acceptable? Feels like a rug vector.
  3. Smaller one: their buyback is owner-gated because v4 has no builtin oracle and a permissionless buyback would get sandwiched. Anyone built a cheap oracle hook or TWAMM-style thing for exactly this?

docs: sender.family/docs

Feels like this matters beyond memecoins as more RWAs land on mainnet. Curious if anyone here has thought about it.

2

On the first question, the closest standard is ERC-7943, which is Final. It has canReceive(address) as an account-level view, but nothing for “any address”, and it is a view over state the issuer can change next block. So it is the same point-in-time check as moving a balance between two random addresses, just cheaper.

The part I’d worry about more is what the singleton means under ERC-7943. If the token follows it, the issuer’s setFrozenTokens or forcedTransfer against the PoolManager doesn’t hit one pool, it hits every pool quoting that stock, and a permanently locked position has no way to unwind. So on your second question I’d lean toward refusing quote assets with an admin. A permanent lock and an asset someone can freeze don’t compose, and an escape hatch that fires on transfer failure is only as trustworthy as whoever it pays out to.