Quantum Audit Logo

Is 0G Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

0G 0G
0x4b94…b3ee
BNB Chain Not verifiedLast checked 2d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The ZeroGravityOFT contract is a minimal implementation of an Omnichain Fungible Token (OFT) using LayerZero v2. It inherits directly from LayerZero's OFT contract and OpenZeppelin's Ownable. The contract introduces no custom logic beyond its constructor, which initializes the OFT and sets the owner. The primary risks stem from the inherent centralization of control by the owner over LayerZero configurations and the fundamental reliance on the LayerZero protocol's security.

1 Low2 Informational
Volume 24h
$21.8K
Liquidity
$88.0K
Price
$0.1985
Token Age
11mo
Top 10 Holders
91.5%

Security Findings

1 Low2 Info
Low

Centralized Control by Owner EOA

L-01The contract's ownership is held by a single External Owned Account (EOA), as initialized in the constructor via the `_delegate` parameter. This owner has significant control over critical LayerZero configurations, such as setting trusted remote addresses, minimum destination gas, and other operational parameters (7.3 Access Control, 7.8 Operations). While this is standard for OFT contracts, reliance on a single EOA introduces a centralized point of failure. If the EOA's private key is compromised, an attacker could manipulate cross-chain functionality, potentially leading to denial of service or unauthorized fee adjustments.
IssueThe contract's ownership is held by a single External Owned Account (EOA), as initialized in the constructor via the `_delegate` parameter. This owner has significant control over critical LayerZero configurations, such as setting trusted remote addresses, minimum destination gas, and other operational parameters (7.3 Access Control, 7.8 Operations). While this is standard for OFT contracts, reliance on a single EOA introduces a centralized point of failure. If the EOA's private key is compromised, an attacker could manipulate cross-chain functionality, potentially leading to denial of service or unauthorized fee adjustments.
FixIt is highly recommended to transfer ownership of the contract to a robust multi-signature wallet (e.g., Gnosis Safe). This would require multiple approvals for any critical administrative actions, significantly reducing the risk associated with a single point of compromise.
StatusUnresolved
Info

Fundamental Reliance on LayerZero Protocol Security

I-01The ZeroGravityOFT contract is built upon LayerZero's Omnichain Fungible Token (OFT) standard, inheriting its core cross-chain messaging and token transfer logic. Consequently, the security and operational integrity of this contract are fundamentally dependent on the underlying LayerZero protocol and its smart contract implementations (7.6 External). Any vulnerabilities or exploits discovered within the LayerZero protocol itself could directly impact the functionality and security of ZeroGravityOFT.
IssueThe ZeroGravityOFT contract is built upon LayerZero's Omnichain Fungible Token (OFT) standard, inheriting its core cross-chain messaging and token transfer logic. Consequently, the security and operational integrity of this contract are fundamentally dependent on the underlying LayerZero protocol and its smart contract implementations (7.6 External). Any vulnerabilities or exploits discovered within the LayerZero protocol itself could directly impact the functionality and security of ZeroGravityOFT.
FixWhile this is an inherent architectural dependency, it is crucial for the ZeroGravity team to stay informed about LayerZero security updates, audits, and any potential advisories. Implement robust monitoring for LayerZero network activity and contract interactions.
StatusUnresolved
Info

Minimal Custom Logic Reduces Attack Surface

I-02The ZeroGravityOFT contract introduces no custom business logic beyond its constructor, which correctly initializes the inherited OFT and Ownable components. All core functionality for token transfers and cross-chain operations is derived directly from the audited LayerZero OFT library and OpenZeppelin's Ownable contract (7.2 Code Security). This minimalist approach significantly reduces the potential attack surface for novel vulnerabilities specific to this contract's codebase.
IssueThe ZeroGravityOFT contract introduces no custom business logic beyond its constructor, which correctly initializes the inherited OFT and Ownable components. All core functionality for token transfers and cross-chain operations is derived directly from the audited LayerZero OFT library and OpenZeppelin's Ownable contract (7.2 Code Security). This minimalist approach significantly reduces the potential attack surface for novel vulnerabilities specific to this contract's codebase.
FixMaintain this design principle of minimal custom logic if future extensions are considered. Any new functionality should be thoroughly reviewed and audited to ensure it does not introduce new vulnerabilities.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The contract exhibits strong technical security due to its minimal custom code (7.2 Code Security) and reliance on well-audited libraries from OpenZeppelin and LayerZero. The architecture (7.1 Architecture) is straightforward, acting as a direct wrapper for the OFT standard. The constructor correctly initializes both the OFT and Ownable components, ensuring proper setup. No reentrancy or integer overflow/underflow vulnerabilities were identified within the contract's specific logic.

GovernanceHigh1/10

The contract utilizes the Ownable pattern, granting the deployer (or specified delegate) significant control over LayerZero configurations (7.3 Access Control). This includes the ability to set trusted remote addresses, minimum destination gas, and other critical parameters that directly impact cross-chain operations and associated fees (7.4 Economic). While standard for OFT implementations, the current ownership by an EOA introduces a centralized point of failure. If the owner's private key is compromised, the token's cross-chain functionality could be manipulated or halted (7.5 Governance).

UpgradesMedium6/10

The ZeroGravityOFT contract is not designed as an upgradeable proxy (7.7 Upgrades). It is a standard implementation contract. Any future changes or upgrades to its logic would require deploying a new contract and migrating users or liquidity, which avoids the complexities and specific risks associated with proxy upgrade patterns.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

91.5% in top 10
91.5% in wallets0.0% in contracts
Effective Concentration91.5%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$94.5K across 4 pairs
Pancakeswap v3USDTanalysed$88.0K93.1%Pancakeswap v3USDT$4.0K4.3%Pancakeswap v3WBNB$2.5K2.7%Pancakeswap v2USDT$30.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder99.9%
Top-3 Unlocked100.0%

Key Addresses

3 addresses
Deployer
0xce0f…c78a
Unlocked LP Held By
0x14c9…272d0x9b56…5f53

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors
  • Ownership NOT renounced — owner is an EOA (single private key)
  • Top-10 concentration > 70% (91.5% total → 91.5% effective; 91.5% in EOAs, 0.0% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 99.9% (independent LP — depth risk, pool = 93% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 93% of DEX liquidity)
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Caldera (ERA)High RiskPro Token (PRO)High RiskStarpower Network (STAR)High RiskElonCoinHigh RiskSUMMERHigh RiskXRP Token (XRP)High Risk

Would You Like a More Detailed Audit of 0G?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit