In the 89th minute of a Manchester derby, a single frame of video — reviewed, annotated, and broadcast to hundreds of millions of viewers — decided the match. Manchester United dropped points. Manchester City took the derby. And within hours, the loudest argument in football was not about the goal itself. It was about the machine that disallowed it.
Video Assistant Referee, or VAR, was sold as a corrective technology. It would remove the human error that had poisoned football for a century. Instead, it created a new species of error: unattributable error. The referee is now a man watching a screen, and that screen is managed by a committee nobody in the stadium can name. When a system removes one failure mode, it almost always introduces a new one — usually in the exact place the designers refused to look.
I have spent the last nine years auditing systems that make this precise promise. Blockchain protocols, stablecoins, fan tokens, "decentralized" governance modules. The sales pitch never changes: trust the math, not the institution. The outcome never changes either: a new institution, wearing a cryptographic badge, answering to nobody. The VAR scandal is not a football story. It is a preview of every "trust technology" the crypto industry has shipped into sports — and refused to audit.
The footballing world has quietly become one of the largest consumers of blockchain products on the planet. Socios, built on the Chiliz chain, sells fan tokens that grant holders the right to vote on club "polls" — the design of the captain's armband, the walkout song, the name of a training facility. Sorare issues club-licensed digital collectibles with real-money markets attached. A dozen Premier League clubs, plus FC Barcelona and Paris Saint-Germain, have signed commercial deals that place their institutional brands on-chain.
The narrative sells itself. Sports is a half-trillion-dollar industry with a global, emotionally invested fanbase. If you can tokenize fandom, you have a liquidity event that runs every matchday. This is the same logic that sold the industry on DeFi in 2020 and NFTs in 2021 — and it is the same logic that was quietly abandoned when both cycles ended. Two years into a bear market, the fan token market cap has compressed by more than 90% from its peak. Yet the deals keep getting signed, because the deals were never really about the token. They were about the institution acquiring a crypto narrative without changing anything structural.
The pattern has a short history and a long tail. Jetcoin tried fan tokenization in 2018 and faded. Socios arrived in 2019 and spent four years buying club partnerships one signature at a time. The 2021 NFT boom pushed Sorare to a $4.3 billion valuation, then pulled it back to earth. Each wave promised the same thing — that putting fandom on a ledger would finally give fans a stake in the institutions they fund. Each wave delivered a polling widget and a collectible market, and left the governance untouched.
Let me be precise about that. The VAR controversy and the fan token economy share a single architectural property: both insert a technology layer into a governance process, and both leave the actual decision rights exactly where they were. VAR did not decentralize refereeing. It centralized it — into a small room, under a rulebook most viewers have never opened. The fan token did not decentralize the club. It created a polling feature, gated behind an admin key, that the club can switch off at will.
I want to walk through the actual architecture, because this is where the marketing collapses under inspection.
Start with the Chiliz chain. Chiliz is the backbone of Socios and the vast majority of club-issued fan tokens. It is a proof-of-authority chain. PoA means a fixed, permissioned set of validators, selected by the chain's operator, produces and finalizes blocks. I have written before that decentralization is a spectrum, not a binary, and I will say it again: PoA is a legitimate engineering choice for a high-throughput, low-value, consumer application. It is also, by construction, a chain where a small, private group of signers can halt or reorder activity. That is not a bug. It is the design. And nobody on the marketing side will say it out loud.
Now layer the token on top. A fan token is an ERC-20 — or a Chiliz-native equivalent — with a governance adapter bolted on. The adapter reads a snapshot of token balances and lets holders vote. The token contract, and this is the part that matters, is usually deployed with an owner role. That owner role, in the contracts I have reviewed and in the public deployments I have traced, typically retains the ability to pause transfers, mint additional supply, and upgrade the implementation through a proxy. A proxy pattern means the logic behind the token can be swapped without changing the token's address or its apparent history. The club does not need to decentralize. It needs a token that looks decentralized on a block explorer.
I once audited a sports-adjacent token that advertised "community-governed treasury allocation." The contract was clean. The voting module was correctly snapshot-based and resistant to the usual flash-loan manipulation. The problem was six lines below the surface: a single onlyOwner function on the treasury that let the deployer move funds without a vote. There was no bug. There was no exploit. There was a door, painted to match the wall. Code does not lie, but the auditors often do — usually by choosing what not to read.
Here is the Centralization Risk Score, the framework I introduced after the Compound governance review in 2020. I score on four axes, each 0 to 5, where 5 is maximally centralized:
- Admin capability (5/5 for most fan tokens). The owner can pause, mint, or upgrade. This is unilateral control over the asset's supply and transferability.
- Validator concentration (5/5). A permissioned PoA set, operator-selected, with no public slashing conditions.
- Governance bindingness (4/5). Polls are advisory. The club is not contractually obligated to execute the outcome. The token holder's vote is a suggestion wrapped in a smart contract.
- Data and metadata custody (3/5). Token metadata, event schedules, and reward fulfillment frequently resolve to off-chain endpoints the club controls.
That gives an aggregate centralization score of roughly 17 out of 20 — 85%. For comparison, I scored Compound at 65% in 2020, and that triggered a governance overhaul and a mandatory timelock. I scored Terra's governance at 78% in early 2022, two weeks before the peg broke. Anything above 70% is a system that markets itself as trustless while reserving the right to intervene. Anything above 80% is theatre.
The same pattern repeats across the sports Web3 stack. Sorare, the largest NFT fantasy platform in football, settles trades and ownership on Ethereum, but the game logic, the scarcity model, and the scoring engine are serviced off-chain. This is not a criticism of Sorare specifically. It is the only way to build a usable product today. But it means the "ownership" a collector holds is a claim against a centralized service, hedged by an on-chain receipt. The receipt is real. The claim is the risk.
Now run the Risk Exposure Matrix. This is the forward-looking framework I use to stress-test any tokenized system:
| Shock | Probability (12 mo) | Impact on holder | Recoverable? | |-------|--------------------|-----------------------------|--------------| | Club exercises admin pause during transfer window | Medium | Transfers frozen; market confidence collapses | Yes, if team acts | | Governance poll overturned by club board | High | Utility narrative invalidated | No | | Validator set upgrades to an incompatible contract | Low | Migration friction; unclaimed rewards at risk | Partial | | Regulatory action treating fan token as a security | Medium | Delisting risk; liquidity withdrawal | No |
The matrix tells you the thing the marketing cannot: the failure modes are not cryptographic. They are institutional. No amount of clever contract design removes them, because the parties that control the failure modes are the parties that commissioned the contract in the first place.
This is where the VAR parallel becomes exact rather than rhetorical. The VAR controversy is not about whether the technology works. The cameras worked. The frame rate worked. The offside line worked. The controversy is about who owns the final call, and whether that ownership is transparent. Football fans are being asked, for the first time, to trust a decision-making layer they cannot inspect, cannot appeal through, and cannot replace. They are, in other words, being treated exactly like token holders: told to trust the math, while the math answers to a committee.
Now let me commit the intellectual honesty that the crypto commentariat refuses. What did the bulls get right?
First: sports IP is a real distribution channel, and the fan token is not a solution looking for a problem. There is a genuine product-market fit in the engagement layer — the polling, the perks, the access. I have watched fan token communities react to a captain's-armband poll with more genuine participation than most DeFi governance forums produce in a full quarter. The emotional investment is real. The demand for participation is real. What is not real — what was never real — is the claim that this engagement constitutes ownership or control.
Second: the institutions involved have mostly behaved better than the 2017 ICO cohort. The clubs that signed these deals did not exit-scam their communities. The token models have generally honored their stated, limited utility. In a sector where outright fraud was the norm five years ago, a centralized product that delivers a narrow, honest feature set is progress. I will not pretend otherwise.
Third: the bear market has separated the survivors from the narrative tourists. Protocols that relied on token appreciation to fund operations are mostly gone. The ones still signing deals — Chiliz, Sorare, a handful of others — have real revenue or real balance sheets. Survival in this market is not proof of decentralization. But it is evidence of operational discipline, which is a prerequisite for any trust claim to eventually become true.
That is the most you can honestly say. And notice what I did not say. I did not say the fan token economy is trustless. I did not say it is decentralized. I did not say it "revolutionized" fandom. Because none of that is true, and the people saying it are selling, not auditing.
Here is the uncomfortable synthesis. VAR and the fan token economy are the same product, shipped to the same customer, by two different vendors. One sells video review technology to a football league. The other sells a tokenized voting widget to a football club. Both promise that inserting a system into a governance process will make the process trustworthy. Both deliver a system that centralizes the decision rights they claimed to distribute, then present the resulting opacity as impartiality. We built a house of cards on a ledger of trust, and then hung the deed on the wall.
The lesson is not that the technology failed. The lesson is that technology does not referee institutions. Institutions referee themselves, and technology only changes where they hide the whistle. This is true of VAR, of fan tokens, of the DeFi governance modules I audited in 2020, and of the ZK circuits I now review for AI-agent verification. The structure is identical every time: a trust claim, an admin key, and a marketing deck that never mentions the admin key.
Security is a process, not a badge you wear. So watch the next VAR controversy, and watch the next fan token governance poll. On the surface, they have nothing to do with each other. Underneath, they are the same audit finding, filed under two different ticket numbers. The question for the next cycle is not whether sports will adopt more blockchain. It already has. The question is whether anyone will finally insist on reading the contracts — the football ones and the smart ones — before we let them decide the outcome of the match.