Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Axelar Wrapped LAVA Safe?

LAVAArbitrum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Critical RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical4/10Governance1/10Upgrades3/10Checks passed2 of 5Findings1 Critical · 1 High · 1 Medium · 1 Low · 1 Info5
SummaryAI Copilot

The audit of the BurnableMintableCappedERC20 token and DepositHandler contracts revealed a critical access control vulnerability in the DepositHandler, allowing anyone to execute arbitrary code or self-destruct the contract.

Read the full analysis
What raised the score
  • Ownership not renounced — owner is a contract
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 50%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — owner is a contract (governance/executor, not an EOA)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 50% (59.2% total → 50.6% effective; 44.9% in EOAs, 14.3% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 63% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 63% of DEX liquidity)
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 42 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
14.3%Contracts44.9%Wallets40.8%Everyone else
14.3%44.9%Wallets40.8%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
59.2%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking14.3%
  • Walletsanonymous holders, free to sell44.9%
  • Everyone elsethe rest of the supply40.8%
Effective concentrationwhat the score reads50.6%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$614.5K across 3 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$389.9KShare of depth63.5%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x8bc0…bf040x751c…a8c50x65e8…2b0f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Critical1 High1 Medium1 Low1 Info
Critical

Critical Access Control Vulnerability in DepositHandler

The DepositHandler contract's execute and destroy functions lack any access control. Any external caller can invoke execute(address callee, bytes calldata data) to perform arbitrary calls from the DepositHandler contract to any address with arbitrary data. Similarly, destroy(address etherDestination) can be called by anyone to self-destruct the contract, sending any held Ether to an arbitrary address. This poses a severe risk if DepositHandler instances are intended to hold assets or perform sensitive operations, as they can be fully compromised by any malicious actor.C-01

Issue

The DepositHandler contract's execute and destroy functions lack any access control. Any external caller can invoke execute(address callee, bytes calldata data) to perform arbitrary calls from the DepositHandler contract to any address with arbitrary data. Similarly, destroy(address etherDestination) can be called by anyone to self-destruct the contract, sending any held Ether to an arbitrary address. This poses a severe risk if DepositHandler instances are intended to hold assets or perform sensitive operations, as they can be fully compromised by any malicious actor.

Fix

Implement robust access control for the execute and destroy functions in DepositHandler. For instance, restrict these functions to be callable only by a trusted owner address (e.g., using an onlyOwner modifier) or a predefined set of authorized entities. This is crucial to prevent unauthorized arbitrary code execution and contract destruction.

Status

Unresolved

High

High Centralization Risk and Owner Privileges

The BurnableMintableCappedERC20 token contract grants significant power to the owner address, including the ability to mint new tokens (up to the defined cap), burn tokens from specific depositAddress accounts, burnFrom any account (with allowance), and transferOwnership. This high level of centralization introduces a single point of failure. Compromise of the owner's private key would lead to complete control over the token's supply and critical operations, posing a substantial economic risk.H-01

Issue

The BurnableMintableCappedERC20 token contract grants significant power to the owner address, including the ability to mint new tokens (up to the defined cap), burn tokens from specific depositAddress accounts, burnFrom any account (with allowance), and transferOwnership. This high level of centralization introduces a single point of failure. Compromise of the owner's private key would lead to complete control over the token's supply and critical operations, posing a substantial economic risk.

Fix

Consider implementing a multi-signature wallet (e.g., Gnosis Safe) for the owner role to manage critical operations. This would require multiple approvals for sensitive transactions, significantly enhancing security and reducing the risk associated with a single point of failure. Clearly document the owner's capabilities and the security measures in place for the owner's key.

Status

Unresolved

Medium

Deterministic Address Burning Mechanism

The burn function allows the token owner to burn tokens from an address derived using depositAddress(salt). This address is deterministically generated based on the token owner's address and the DepositHandler's creation code. While potentially intended for a specific cross-chain or deposit mechanism, this grants the owner the ability to unilaterally burn tokens from these specific addresses. If these addresses are used by external users or other protocols, this capability could be unexpected or misused if not clearly communicated and understood by all stakeholders.M-01

Issue

The burn function allows the token owner to burn tokens from an address derived using depositAddress(salt). This address is deterministically generated based on the token owner's address and the DepositHandler's creation code. While potentially intended for a specific cross-chain or deposit mechanism, this grants the owner the ability to unilaterally burn tokens from these specific addresses. If these addresses are used by external users or other protocols, this capability could be unexpected or misused if not clearly communicated and understood by all stakeholders.

Fix

Ensure that the purpose and implications of the deterministic address burning mechanism are thoroughly documented and clearly communicated to all users and integrated protocols. Provide clear guidelines on how these depositAddress accounts are intended to be used and managed, and any potential risks associated with the owner's ability to burn tokens from them.

Status

Unresolved

Low

Unused Import

The IAxelarGateway interface is imported in contracts/BurnableMintableCappedERC20.sol but is not utilized within the provided contract code. While not a functional vulnerability, unused imports can clutter the codebase, slightly increase compilation time, and potentially lead to confusion for future developers.L-01

Issue

The IAxelarGateway interface is imported in contracts/BurnableMintableCappedERC20.sol but is not utilized within the provided contract code. While not a functional vulnerability, unused imports can clutter the codebase, slightly increase compilation time, and potentially lead to confusion for future developers.

Fix

Remove the import { IAxelarGateway } from './interfaces/IAxelarGateway.sol'; statement from contracts/BurnableMintableCappedERC20.sol if the interface is not intended for immediate use. If it's for future integration, consider adding a comment to explain its purpose.

Status

Unresolved

Info

Lack of Multi-signature for Critical Operations

Given the high level of centralization and the critical powers of the owner role (minting, burning, ownership transfer), relying on a single External Owned Account (EOA) for the owner introduces a single point of failure. A compromise of this single private key could lead to catastrophic loss of control and assets.I-01

Issue

Given the high level of centralization and the critical powers of the owner role (minting, burning, ownership transfer), relying on a single External Owned Account (EOA) for the owner introduces a single point of failure. A compromise of this single private key could lead to catastrophic loss of control and assets.

Fix

For enhanced security and to mitigate the risk of a single point of failure, it is strongly recommended to use a multi-signature wallet (e.g., Gnosis Safe) as the owner address. This would require multiple independent approvals for any critical operation, significantly increasing the security posture of the protocol.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The audit of the BurnableMintableCappedERC20 token and DepositHandler contracts revealed a critical access control vulnerability in the DepositHandler, allowing anyone to execute arbitrary code or self-destruct the contract. The token itself exhibits high centralization, with the owner possessing significant control over minting and burning, including a unique deterministic burning mechanism. These issues pose substantial security and economic risks.

Technical4/10Medium risk

The technical architecture (7.1) is modular, utilizing standard ERC20, Ownable, and Permit patterns. Solidity 0.8.9 mitigates integer overflow/underflow risks (7.2). A reentrancy guard is implemented in DepositHandler's execute and destroy functions. However, a critical access control flaw (7.3) in DepositHandler allows unauthorized execution of arbitrary calls and self-destruction by any external caller, posing a severe security risk. The burnFrom function correctly handles allowance adjustments.

Governance1/10High risk

The token's economic model (7.4) is highly centralized, with the owner having extensive control over token supply through minting and burning functions. This introduces significant governance risk (7.5) as a single entity controls critical operations, including the ability to burn tokens from deterministically generated depositAddress accounts. The DepositHandler's critical lack of access control (7.3) could lead to severe economic consequences if exploited, allowing funds held by it to be drained or critical operations disrupted by any malicious actor.

Upgrades3/10High risk

The contracts are not designed with an explicit upgrade mechanism (7.7), meaning their logic is immutable once deployed. This eliminates upgrade-related risks such as proxy misconfigurations or logic bugs introduced during upgrades. However, it also prevents future bug fixes or feature enhancements without a full redeployment and migration process.

Final RecommendationWhat to do about this score

It is critical to immediately address the access control vulnerability in the DepositHandler contract by implementing appropriate onlyOwner or similar restrictions for its execute and destroy functions.

Without this, any DepositHandler instance is fully exposed to arbitrary external calls and self-destruction. Furthermore, evaluate the implications of the highly centralized owner role for the token and consider implementing a multi-signature wallet (e.g., Gnosis Safe) for critical operations such as mint, burn, and transferOwnership to enhance security and reduce the single point of failure risk. Ensure comprehensive documentation and communication regarding the deterministic burning mechanism and its intended operational use.

Contract & Record

1 audit on record
TypeToken
NetworkArbitrum
Token age8mo
Contract0x11e9…61af
Deployer0xb288…9bb4
Badge for your website
Axelar Wrapped LAVA security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202687Critical
  2. Aug 14, 202679High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the LAVA contract address?

The Axelar Wrapped LAVA (LAVA) contract on Arbitrum is 0x11e969e9b3f89cb16d686a03cd8508c9fc0361af. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Axelar Wrapped LAVA a scam?

Quantum Audit's risk score for Axelar Wrapped LAVA is 87/100 (Critical risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: Mintable; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is LAVA liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $614.5K.

Who holds LAVA?

As of Sep 4, 2026, the 10 largest holders own 59.2% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
Ninja Squad TokenNST · Arbitrum88CriticalGUBERTOArbitrum85CriticalGU FactoryGU · Arbitrum89CriticalVangridVAN · Arbitrum84HighMORArbitrum84HighDGrid AIDGAI · Arbitrum84High

Would You Like a More Detailed Audit of Axelar Wrapped LAVA?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page