Quantum Audit Logo

Is Axelar Wrapped LAVA Safe?

On-chain security analysis — is it a scam or legit?

Axelar Wrapped LAVA LAVA
0x11e9…61af
Arbitrum Not verifiedLast checked 2d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Critical Risk
Executive SummaryAI Copilot

The audit of the `BurnableMintableCappedERC20` token and `DepositHandler` contracts revealed a critical access control vulnerability in the `DepositHandler`, allowing anyone to execute arbitrary code or self-destruct the contract. The token itself exhibits high centralization, with the owner possessing significant control over minting and burning, including a unique deterministic burning mechanism. These issues pose substantial security and economic risks.

1 Critical1 High1 Medium1 Low1 Informational
Volume 24h
$23.3K
Liquidity
$389.9K
Price
$0.01894
Token Age
8mo
Top 10 Holders
59.2%

Security Findings

1 Crit1 High1 Med1 Low1 Info
Critical

Critical Access Control Vulnerability in DepositHandler

C-01The `DepositHandler` contract's `execute` and `destroy` functions lack any access control. Any external caller can invoke `execute(address callee, bytes calldata data)` to perform arbitrary calls from the `DepositHandler` contract to any address with arbitrary data. Similarly, `destroy(address etherDestination)` can be called by anyone to self-destruct the contract, sending any held Ether to an arbitrary address. This poses a severe risk if `DepositHandler` instances are intended to hold assets or perform sensitive operations, as they can be fully compromised by any malicious actor.
IssueThe `DepositHandler` contract's `execute` and `destroy` functions lack any access control. Any external caller can invoke `execute(address callee, bytes calldata data)` to perform arbitrary calls from the `DepositHandler` contract to any address with arbitrary data. Similarly, `destroy(address etherDestination)` can be called by anyone to self-destruct the contract, sending any held Ether to an arbitrary address. This poses a severe risk if `DepositHandler` instances are intended to hold assets or perform sensitive operations, as they can be fully compromised by any malicious actor.
FixImplement robust access control for the `execute` and `destroy` functions in `DepositHandler`. For instance, restrict these functions to be callable only by a trusted `owner` address (e.g., using an `onlyOwner` modifier) or a predefined set of authorized entities. This is crucial to prevent unauthorized arbitrary code execution and contract destruction.
StatusUnresolved
High

High Centralization Risk and Owner Privileges

H-01The `BurnableMintableCappedERC20` token contract grants significant power to the `owner` address, including the ability to `mint` new tokens (up to the defined cap), `burn` tokens from specific `depositAddress` accounts, `burnFrom` any account (with allowance), and `transferOwnership`. This high level of centralization introduces a single point of failure. Compromise of the owner's private key would lead to complete control over the token's supply and critical operations, posing a substantial economic risk.
IssueThe `BurnableMintableCappedERC20` token contract grants significant power to the `owner` address, including the ability to `mint` new tokens (up to the defined cap), `burn` tokens from specific `depositAddress` accounts, `burnFrom` any account (with allowance), and `transferOwnership`. This high level of centralization introduces a single point of failure. Compromise of the owner's private key would lead to complete control over the token's supply and critical operations, posing a substantial economic risk.
FixConsider implementing a multi-signature wallet (e.g., Gnosis Safe) for the `owner` role to manage critical operations. This would require multiple approvals for sensitive transactions, significantly enhancing security and reducing the risk associated with a single point of failure. Clearly document the owner's capabilities and the security measures in place for the owner's key.
StatusUnresolved
Medium

Deterministic Address Burning Mechanism

M-01The `burn` function allows the token owner to burn tokens from an address derived using `depositAddress(salt)`. This address is deterministically generated based on the token owner's address and the `DepositHandler`'s creation code. While potentially intended for a specific cross-chain or deposit mechanism, this grants the owner the ability to unilaterally burn tokens from these specific addresses. If these addresses are used by external users or other protocols, this capability could be unexpected or misused if not clearly communicated and understood by all stakeholders.
IssueThe `burn` function allows the token owner to burn tokens from an address derived using `depositAddress(salt)`. This address is deterministically generated based on the token owner's address and the `DepositHandler`'s creation code. While potentially intended for a specific cross-chain or deposit mechanism, this grants the owner the ability to unilaterally burn tokens from these specific addresses. If these addresses are used by external users or other protocols, this capability could be unexpected or misused if not clearly communicated and understood by all stakeholders.
FixEnsure that the purpose and implications of the deterministic address burning mechanism are thoroughly documented and clearly communicated to all users and integrated protocols. Provide clear guidelines on how these `depositAddress` accounts are intended to be used and managed, and any potential risks associated with the owner's ability to burn tokens from them.
StatusUnresolved
Low

Unused Import

L-01The `IAxelarGateway` interface is imported in `contracts/BurnableMintableCappedERC20.sol` but is not utilized within the provided contract code. While not a functional vulnerability, unused imports can clutter the codebase, slightly increase compilation time, and potentially lead to confusion for future developers.
IssueThe `IAxelarGateway` interface is imported in `contracts/BurnableMintableCappedERC20.sol` but is not utilized within the provided contract code. While not a functional vulnerability, unused imports can clutter the codebase, slightly increase compilation time, and potentially lead to confusion for future developers.
FixRemove the `import { IAxelarGateway } from './interfaces/IAxelarGateway.sol';` statement from `contracts/BurnableMintableCappedERC20.sol` if the interface is not intended for immediate use. If it's for future integration, consider adding a comment to explain its purpose.
StatusUnresolved
Info

Lack of Multi-signature for Critical Operations

I-01Given the high level of centralization and the critical powers of the `owner` role (minting, burning, ownership transfer), relying on a single External Owned Account (EOA) for the `owner` introduces a single point of failure. A compromise of this single private key could lead to catastrophic loss of control and assets.
IssueGiven the high level of centralization and the critical powers of the `owner` role (minting, burning, ownership transfer), relying on a single External Owned Account (EOA) for the `owner` introduces a single point of failure. A compromise of this single private key could lead to catastrophic loss of control and assets.
FixFor enhanced security and to mitigate the risk of a single point of failure, it is strongly recommended to use a multi-signature wallet (e.g., Gnosis Safe) as the `owner` address. This would require multiple independent approvals for any critical operation, significantly increasing the security posture of the protocol.
StatusUnresolved

Category Ratings

TechnicalMedium4/10

The technical architecture (7.1) is modular, utilizing standard ERC20, Ownable, and Permit patterns. Solidity 0.8.9 mitigates integer overflow/underflow risks (7.2). A reentrancy guard is implemented in `DepositHandler`'s `execute` and `destroy` functions. However, a critical access control flaw (7.3) in `DepositHandler` allows unauthorized execution of arbitrary calls and self-destruction by any external caller, posing a severe security risk. The `burnFrom` function correctly handles allowance adjustments.

GovernanceHigh1/10

The token's economic model (7.4) is highly centralized, with the owner having extensive control over token supply through minting and burning functions. This introduces significant governance risk (7.5) as a single entity controls critical operations, including the ability to burn tokens from deterministically generated `depositAddress` accounts. The `DepositHandler`'s critical lack of access control (7.3) could lead to severe economic consequences if exploited, allowing funds held by it to be drained or critical operations disrupted by any malicious actor.

UpgradesHigh3/10

The contracts are not designed with an explicit upgrade mechanism (7.7), meaning their logic is immutable once deployed. This eliminates upgrade-related risks such as proxy misconfigurations or logic bugs introduced during upgrades. However, it also prevents future bug fixes or feature enhancements without a full redeployment and migration process.

Security Checklist

2/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyPass

Holder Composition

59.2% in top 10
44.9% in wallets14.3% in contracts
Effective Concentration50.6%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$614.5K across 3 pairs
PancakeswapUSD₮0analysed$389.9K63.5%UniswapWETH$130.3K21.2%UniswapWETH$94.3K15.3%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

4 addresses
Deployer
0xb288…9bb4
Unlocked LP Held By
0x8bc0…bf040x751c…a8c50x65e8…2b0f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

10 factors
  • Ownership NOT renounced — owner is a contract (governance/executor, not an EOA)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 50% (59.2% total → 50.6% effective; 44.9% in EOAs, 14.3% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 63% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 63% of DEX liquidity)
  • 1 Critical finding(s) from audit
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Vangrid (VAN)Critical RiskMORCritical RiskDGrid AI (DGAI)Critical RiskUnicity Labs (UNYLA)Critical RiskCatena Labs (CATE)Critical RiskVision (VSN)Critical Risk

Would You Like a More Detailed Audit of Axelar Wrapped LAVA?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit