Shipping a fixed-supply ERC-20 on Base: our pre-launch checklist

ARL is a utility token for AI and compute payments on Base. Before the Base Mainnet launch we wanted every step to be reproducible and public. Here is the checklist we ran.

1. Keep the token boring

The token is unmodified OpenZeppelin v5.6.1 ERC20 and ERC20Permit. The full 21,000,000 supply is minted once in the constructor, and there is no owner, mint, pause or upgrade. A CI check fails if the token's ABI ever gains a function.

2. Layer the checks

• Static analysis: Slither (0 results) and Aderyn (5 issues, all triaged as false positives or by design)
• 271 Foundry tests; fuzz tests at 10,000 runs in CI and 200,000 in a deep campaign; 5 invariant suites
• Halmos bounded symbolic proofs: 11 of 11 properties
• Mythril symbolic execution on the runtime bytecode of the launch contracts

All raw outputs (JSON, SARIF) are in the repository, and a workflow reproduces them on every change.

3. Verify the run you sign

Contract addresses come from the deployer and the nonce alone, so a matching address does not prove the constructor arguments. We check the creation code against our build and every argument against the published plan before signing.

4. Rehearse on a mainnet fork

The whole launch day (Safes, contracts, verification, Uniswap v3 pools) runs on a local fork of Base Mainnet with the real signers. It passed again today.

Report: https://arlcoin.io/docs/security-audit
Code: https://github.com/armanalabsai/arlcoin.io