Is Based Token (BASED) Safe? Smart Contract Security Analysis

Security Checklist

2/5 checks passed

Contract VerifiedPass

Ownership RenouncedFail

No Mint FunctionFail

Liquidity LockedFail

Not a ProxyPass

Audit History

2 audits on record

Jul 2267Jul 2377

Every audit run adds a dated snapshot — history is append-only and cannot be edited.

Audit Summary

This audit focused on the provided Solidity interfaces for LayerZero V2 components, including `ILayerZeroEndpointV2`, `ILayerZeroReceiver`, and related manager interfaces. It's important to note that only interface definitions were provided, not the actual implementation logic. Therefore, the audit assesses potential risks and architectural considerations for any contract implementing these interfaces, rather than specific vulnerabilities in a deployed contract. The prefill indicated a contract named 'BasedOFT' at the given address, but the provided source code consists solely of LayerZero V2 interfaces, suggesting a mismatch in the audit scope definition. The findings highlight critical access control considerations, reentrancy risks for implementers, and the inherent complexity of cross-chain messaging.

Final Recommendation: Implementers of LayerZero V2 interfaces must prioritize robust access control for all sensitive management functions, ensuring only authorized entities can make critical configuration changes. Thorough reentrancy checks and secure coding practices are paramount for `lzReceive` implementations, especially when handling value transfers or external calls. Additionally, careful consideration should be given to the economic implications of fee calculations and potential oracle dependencies. Comprehensive testing, including cross-chain scenarios and edge cases, is essential before deployment. Finally, integrating emergency pause mechanisms can provide a crucial safety net for operational risks.

Category Ratings

TechnicalMedium

6/10

The LayerZero V2 interfaces define a complex cross-chain messaging architecture (7.1 Architecture) with distinct roles for endpoints, message libraries, and receivers. The design emphasizes modularity and configurability, allowing for flexible integration. However, this complexity introduces potenti

GovernanceHigh

3/10

The interfaces expose several critical functions that, in an implementation, would require strong access control and governance (7.3 Access Control, 7.5 Governance). Functions like `setLzToken`, `setDelegate`, and various library management functions (`setDefaultSendLibrary`, `setReceiveLibrary`, `s

UpgradesMedium

4/10

As only interfaces were provided, direct upgradeability concerns (7.7 Upgrades) for these specific contracts are not applicable. However, the LayerZero V2 protocol itself is designed to be extensible through message libraries and configurable parameters, which implies a form of upgradeability or ada

LP Distribution

Top-1 Unlocked Holder61.4%

Top-3 Unlocked80.1%

What Raised This Score

9 factors

Ownership NOT renounced — owner is a contract (governance/executor, not an EOA)
Mintable supply — no cap found, dilution unbounded
Top-10 concentration > 30% (75.3% total → 34.4% effective; 7.1% in EOAs, 68.2% in contracts — moderate)
Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
LP top1 unlocked holder = 61.4% (independent LP — depth risk, pool = 96% of DEX liquidity)
LP top3 unlocked holders = 80.1% (independent LP — depth risk, pool = 96% of DEX liquidity)
1 High finding(s) from audit
2 Medium finding(s) from audit
1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Findings

6 total

1 High 2 Medium 1 Low 2 Info

H-01HighUnresolved

Critical Access Control for Core Management Functions

The `ILayerZeroEndpointV2` and `IMessageLibManager` interfaces expose highly sensitive functions such as `setLzToken`, `setDelegate`, `registerLibrary`, `setDefaultSendLibrary`, `setReceiveLibrary`, and `setConfig`. In an implementation, these functions control fundamental aspects of the LayerZero protocol, including token configurations, delegate permissions, and the registration/selection of message libraries. Inadequate access control (7.3 Access Control) for these functions could allow unauthorized entities to compromise the protocol, manipulate fees, or disrupt cross-chain messaging.

Recommendation: Implement robust, multi-layered access control mechanisms (e.g., Ownable2Step, multi-signature wallets, or governance contracts) for all critical management functions. Ensure that only trusted and authorized addresses can invoke these functions. Regularly review and audit the access control logic.

M-01MediumUnresolved

Reentrancy Risk in `lzReceive` Implementations

The `lzReceive` function, present in both `ILayerZeroEndpointV2` and `ILayerZeroReceiver`, is designed to handle incoming cross-chain messages. If an implementing contract performs external calls (e.g., token transfers, interactions with other contracts) based on the received message before updating its internal state, it could be vulnerable to reentrancy attacks (7.2 Code Security). An attacker could craft a malicious message to re-enter the `lzReceive` function or other sensitive functions, leading to unintended state changes or fund drains.

Recommendation: Implement the Checks-Effects-Interactions pattern within `lzReceive` and any functions it calls. Ensure all state changes are completed before any external calls are made. Consider using reentrancy guards (e.g., OpenZeppelin's `ReentrancyGuard`) if complex interactions are unavoidable.

M-02MediumUnresolved

Economic Attack Vectors via Fee Calculation

The `quote` function in `ILayerZeroEndpointV2` returns `MessagingFee` which includes `nativeFee` and `lzTokenFee`. If the underlying implementation's fee calculation relies on external price feeds, manipulable on-chain data, or parameters that can be influenced by malicious actors, it could lead to economic exploits (7.4 Economic). Attackers might be able to artificially inflate or deflate fees, making cross-chain operations uneconomical or allowing for fund draining if fees are paid in a manipulable asset.

Recommendation: Ensure that the fee calculation mechanism in the implementation is robust, transparent, and resistant to manipulation. If external oracles are used, integrate reputable, decentralized oracle solutions (e.g., Chainlink) with proper validation and fallback mechanisms. Regularly monitor fee parameters and their impact on the protocol's economics.

L-01LowUnresolved

Lack of Emergency Mechanisms in Interfaces

The provided interfaces do not include functions for emergency pausing or circuit breakers. While interfaces define functionality, a robust implementation of a critical cross-chain protocol component (7.8 Operations) should incorporate mechanisms to halt or restrict operations in the event of a severe vulnerability, exploit, or unforeseen issue. Without such mechanisms, a critical bug could lead to irreversible damage before a fix can be deployed.

Recommendation: Implement emergency pause functionality (e.g., using OpenZeppelin's `Pausable` contract) in any concrete contract that implements these LayerZero V2 interfaces. This mechanism should be controlled by a trusted multi-signature wallet or a robust governance system.

I-01InformationalUnresolved

Incomplete Audit Scope: Interfaces Only

The audit was conducted solely on Solidity interface definitions for LayerZero V2 components. No concrete implementation logic was provided or analyzed. This significantly limits the scope of the audit, as actual vulnerabilities often reside in the implementation details rather than the interface definitions themselves. The prefill also indicated a different contract name ('BasedOFT') than the provided source code (LayerZero V2 interfaces), leading to a discrepancy in the audit target.

Recommendation: For a comprehensive security assessment, provide the full source code of the deployed or intended implementation contracts, including all dependencies. Ensure the provided source code matches the intended audit target and deployed addresses.

I-02InformationalUnresolved

Inherent Complexity of Cross-Chain Messaging

The LayerZero V2 protocol, as evidenced by its extensive interfaces (`ILayerZeroEndpointV2`, `IMessageLibManager`, `IMessagingChannel`, etc.), represents a highly complex system for secure cross-chain communication (7.1 Architecture). This inherent complexity increases the surface area for potential misconfigurations, integration errors, or subtle logical flaws in implementations. Securely building on or integrating with such a system requires deep technical understanding and meticulous attention to detail.

Recommendation: Teams implementing or integrating with LayerZero V2 should invest in comprehensive documentation, internal code reviews, and external audits. Adopt a phased deployment strategy with extensive testing on testnets. Maintain a strong understanding of the LayerZero V2 protocol's specifications and best practices.

Is Based Token Safe? BASED