On-chain security analysis — is it a scam or legit?
The AcuOFT contract is an Omnichain Fungible Token (OFT) implementation built on LayerZero V2, inheriting from OpenZeppelin's Ownable.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0x656d…c4840x5a01…a692No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
_delegate address provided in the constructor becomes both the Ownable owner and the LayerZero delegate. This address has significant administrative control over the OFT contract, including setting LayerZero configurations (e.g., trusted remotes, message libraries, etc.) and other Ownable functions. While the prefill indicates a multisig is used, this single entity holds substantial power, making it a critical point of control.H-01The _delegate address provided in the constructor becomes both the Ownable owner and the LayerZero delegate. This address has significant administrative control over the OFT contract, including setting LayerZero configurations (e.g., trusted remotes, message libraries, etc.) and other Ownable functions. While the prefill indicates a multisig is used, this single entity holds substantial power, making it a critical point of control.
Ensure the multisig owner address is secured with the highest level of operational security, including robust key management, multi-factor authentication, and strict governance procedures for executing transactions. Clearly define and communicate the scope of the owner's powers to all stakeholders.
Unresolved
decimals() function is explicitly overridden to return 12. This deviates from the common ERC-20 standard of 18 decimals. While technically valid, this non-standard precision can lead to misinterpretations, display errors, or incorrect calculations in wallets, exchanges, and other DeFi protocols if they assume 18 decimals by default.M-01The decimals() function is explicitly overridden to return 12. This deviates from the common ERC-20 standard of 18 decimals. While technically valid, this non-standard precision can lead to misinterpretations, display errors, or incorrect calculations in wallets, exchanges, and other DeFi protocols if they assume 18 decimals by default.
Thoroughly document the 12-decimal precision and ensure all integrating systems (frontends, wallets, exchanges, analytics platforms) are aware of and correctly handle this value. Implement clear checks in any off-chain or on-chain integrations to prevent errors due to decimal mismatches.
Unresolved
The contract lacks an emergency pause mechanism that could halt token transfers or cross-chain operations. In the event of a critical vulnerability in the LayerZero protocol, a major exploit, or other unforeseen circumstances, the absence of such a mechanism could limit the ability to react quickly and protect user funds from further loss.
Consider implementing a Pausable mechanism (e.g., from OpenZeppelin) controlled by the multisig owner. This would allow the team to temporarily halt operations in emergencies, providing a crucial safety net. Ensure the pause mechanism has clear activation and deactivation policies.
Unresolved
AcuOFT contract is an Omnichain Fungible Token (OFT) and its core functionality, especially cross-chain transfers, is entirely dependent on the security and operational integrity of the LayerZero V2 protocol and its endpoint. Any vulnerabilities, misconfigurations, or operational issues within the LayerZero infrastructure could directly impact the security and functionality of this token.I-01The AcuOFT contract is an Omnichain Fungible Token (OFT) and its core functionality, especially cross-chain transfers, is entirely dependent on the security and operational integrity of the LayerZero V2 protocol and its endpoint. Any vulnerabilities, misconfigurations, or operational issues within the LayerZero infrastructure could directly impact the security and functionality of this token.
Maintain continuous monitoring of the LayerZero protocol for security announcements, upgrades, and potential vulnerabilities. Ensure the LayerZero endpoint address used is the official and most secure one. Implement robust monitoring for cross-chain transactions.
Unresolved
_lzEndpoint Validation in Constructor_lzEndpoint address but does not include explicit validation (e.g., checking if it's a known LayerZero endpoint address or if it implements the ILayerZeroEndpointV2 interface) before passing it to the OFT base constructor. While the OFT base contract likely handles interactions, a direct check could enhance robustness against misconfiguration.I-02The constructor accepts an _lzEndpoint address but does not include explicit validation (e.g., checking if it's a known LayerZero endpoint address or if it implements the ILayerZeroEndpointV2 interface) before passing it to the OFT base constructor. While the OFT base contract likely handles interactions, a direct check could enhance robustness against misconfiguration.
Consider adding a require statement in the constructor to validate the _lzEndpoint address, for example, by checking if it's a non-zero address or if it supports the ILayerZeroEndpointV2 interface using IERC165 (if applicable to the endpoint contract).
Unresolved
The AcuOFT contract is an Omnichain Fungible Token (OFT) implementation built on LayerZero V2, inheriting from OpenZeppelin's Ownable. It provides standard token functionalities with cross-chain capabilities. The contract is simple, primarily relying on audited base contracts. Key findings include centralized owner control, non-standard token decimals, and the absence of an emergency pause mechanism.
The AcuOFT contract (7.2 Code Security) is a straightforward implementation of LayerZero's OFT standard, inheriting from well-audited OpenZeppelin Ownable. The code is concise and follows common patterns, reducing the likelihood of direct code-level vulnerabilities. However, the contract overrides the decimals() function to return 12 instead of the common 18, which could lead to integration issues if not handled correctly by external systems (7.1 Architecture). Additionally, the contract lacks an emergency pause mechanism (7.8 Operations), which could be beneficial for a cross-chain asset in case of protocol-wide issues.
The contract's access control (7.3 Access Control) is managed by the Ownable pattern, with the owner (also the LayerZero delegate) having significant control over LayerZero configurations and other administrative functions. While the owner is a multisig (7.5 Governance), this centralized control point remains a high-impact risk if compromised. The economic model (7.4 Economic) is that of a standard fungible token, with its cross-chain functionality relying entirely on the LayerZero protocol (7.6 External).
The AcuOFT contract is not designed as an upgradeable proxy (7.7 Upgrades). Therefore, there are no direct upgrade safety concerns for this specific contract. Any future changes would require a new deployment and migration of assets.
It is recommended to thoroughly document the implications of the 12-decimal precision for all integrators and ensure all frontends and external systems correctly handle this non-standard value.
Consider implementing an emergency pause mechanism, potentially controlled by the multisig owner, to provide a safety net for critical situations. Furthermore, ensure the multisig owner address is secured with robust operational procedures, given its significant control over the token's cross-chain functionality.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
