It does have some issues with the idea through. As the contract uses utxo chain, there might need some coordinator to ensure there's no double spend when 2 users send tokens at the same time. Also your balance's merkle path will be changed every time there's a state change on chain and that means you'll need to use the latest merkle path when you transfer token. I know the scrypt team has another approach of using utxo as token output but I suspect the contract can't verify the tokens on chain in that case.