Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Bubblemaps Safe?

BMTBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance3/10Upgrades7/10Checks passed3 of 5Findings3 Medium · 1 Low4
SummaryAI Copilot

The MyOFT contract is an Omnichain Fungible Token (OFT) implementation built on LayerZero v2 and OpenZeppelin's Ownable standard.

Read the full analysis
What raised the score
  • Ownership not renounced — strong Multisig
  • Top-10 concentration > 50%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 99.9%
  • LP top3 unlocked holders = 100.0%
  • 3 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Top-10 concentration > 50% (91.8% total → 62.6% effective; 43.1% in EOAs, 48.7% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 99.9% (independent LP — depth risk, pool = 79% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 79% of DEX liquidity)
  • 3 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
48.7%Contracts43.1%Wallets8.2%
48.7%Contracts43.1%Wallets8.2%
ContractsWalletsEveryone elseBubble area = share of supply
91.8%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking48.7%
  • Walletsanonymous holders, free to sell43.1%
  • Everyone elsethe rest of the supply8.2%
Effective concentrationwhat the score reads62.6%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$457.7K across 8 pairs
Show 1 more pair

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$360.3KShare of depth78.7%
Top-1 Unlocked Holder99.9%
Top-3 Unlocked100.0%
Unlocked LP held by
0x5d36…7bf00x12e3…eb970x9ceb…ec5e0x5e91…fac10x4125…df6c0x5dba…a82a0x3a8c…f9ca0x8f3b…8cad0x5138…d7300x5036…6a20

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

3 Medium1 Low
Medium

Centralized Control by Owner/Delegate

The MyOFT contract inherits from OpenZeppelin's Ownable, granting the designated _delegate address (which is the owner) significant administrative control. This owner can configure various LayerZero parameters, including setting send/receive libraries, minimum destination gas, and LayerZero token addresses. While the provided information indicates the owner is a multisig, this still represents a centralized point of control over critical cross-chain functionality.M-01

Issue

The MyOFT contract inherits from OpenZeppelin's Ownable, granting the designated _delegate address (which is the owner) significant administrative control. This owner can configure various LayerZero parameters, including setting send/receive libraries, minimum destination gas, and LayerZero token addresses. While the provided information indicates the owner is a multisig, this still represents a centralized point of control over critical cross-chain functionality.

Fix

Ensure the owner address is a robustly secured and actively managed multisig wallet. Implement strict internal governance procedures for any administrative actions, especially those involving LayerZero configuration changes. Consider implementing time-locks for critical parameter changes to allow for community review or emergency intervention.

Status

Unresolved

Medium

Critical Dependency on LayerZero Protocol Security

The MyOFT contract's core functionality, specifically cross-chain token transfers, is entirely dependent on the security and correct operation of the external LayerZero v2 protocol and its endpoint. Any vulnerabilities, exploits, or operational failures within the LayerZero protocol itself could directly impact the OFT, potentially leading to frozen assets, loss of funds, or disruption of cross-chain services.M-02

Issue

The MyOFT contract's core functionality, specifically cross-chain token transfers, is entirely dependent on the security and correct operation of the external LayerZero v2 protocol and its endpoint. Any vulnerabilities, exploits, or operational failures within the LayerZero protocol itself could directly impact the OFT, potentially leading to frozen assets, loss of funds, or disruption of cross-chain services.

Fix

Acknowledge and monitor the inherent risks associated with relying on an external cross-chain messaging protocol. Stay informed about LayerZero security updates, audits, and any reported vulnerabilities. Implement robust monitoring for LayerZero endpoint health and cross-chain transaction finality.

Status

Unresolved

Medium

Potential for Misconfiguration of LayerZero Parameters

The owner/delegate has the ability to set various LayerZero-specific parameters, such as minDstGas, lzToken, sendLibrary, and receiveLibrary. Incorrect or malicious configuration of these parameters could lead to several issues, including failed cross-chain transactions, unexpected or excessive transaction fees for users, or even the inability to transfer tokens across certain chains, effectively halting the OFT's primary function.M-03

Issue

The owner/delegate has the ability to set various LayerZero-specific parameters, such as minDstGas, lzToken, sendLibrary, and receiveLibrary. Incorrect or malicious configuration of these parameters could lead to several issues, including failed cross-chain transactions, unexpected or excessive transaction fees for users, or even the inability to transfer tokens across certain chains, effectively halting the OFT's primary function.

Fix

Establish a rigorous process for reviewing and testing all LayerZero parameter changes. Implement a 'dry run' or staging environment to validate configurations before applying them to the mainnet contract. Provide clear documentation and guidelines for the multisig signers regarding the implications of each configurable parameter.

Status

Unresolved

Low

Lack of Direct Emergency Pause Mechanism

The MyOFT contract does not implement a direct, contract-specific emergency pause mechanism. While the underlying LayerZero protocol may have its own emergency controls, a dedicated pause function within the OFT contract could provide an additional layer of defense, allowing the owner to temporarily halt cross-chain transfers in response to a critical vulnerability or exploit specific to the OFT or its immediate environment.L-01

Issue

The MyOFT contract does not implement a direct, contract-specific emergency pause mechanism. While the underlying LayerZero protocol may have its own emergency controls, a dedicated pause function within the OFT contract could provide an additional layer of defense, allowing the owner to temporarily halt cross-chain transfers in response to a critical vulnerability or exploit specific to the OFT or its immediate environment.

Fix

Consider adding a Pausable mechanism (e.g., from OpenZeppelin) to the MyOFT contract. This would allow the owner to pause and unpause cross-chain operations in emergency situations, providing a circuit breaker for unforeseen events. Ensure that any pause mechanism is carefully designed to avoid creating new attack vectors or centralizing too much power.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The MyOFT contract is an Omnichain Fungible Token (OFT) implementation built on LayerZero v2 and OpenZeppelin's Ownable standard. The contract itself is minimal, primarily inheriting functionality from well-audited external libraries. Key risks identified relate to the inherent centralization of administrative control, the critical dependency on the LayerZero protocol's security, and the potential for misconfiguration of cross-chain parameters by the owner. The owner is a multisig, which significantly mitigates single-point-of-failure risks.

Technical8/10Low risk

The contract (7.1 Architecture) is a straightforward implementation of LayerZero's OFT standard, inheriting from battle-tested OpenZeppelin and LayerZero libraries. This minimizes direct code security risks (7.2 Code Security) within MyOFT itself. However, the contract's functionality is entirely dependent on the security and correct operation of the external LayerZero v2 protocol (7.6 External). Any vulnerabilities in the LayerZero endpoint or messaging libraries could directly impact the OFT's cross-chain capabilities and asset safety.

Governance3/10High risk

The contract utilizes OpenZeppelin's Ownable pattern, granting significant administrative control to a single owner address (7.3 Access Control). This owner, designated as the _delegate in the constructor, is responsible for configuring critical LayerZero parameters (7.8 Operations) that affect cross-chain transfers and fees. While the prefill indicates the owner is a multisig (7.5 Governance), which enhances security, incorrect configuration could still lead to economic issues (7.4 Economic) such as failed transactions or unexpected costs.

Upgrades7/10Low risk

The MyOFT contract is not designed as an upgradeable proxy (7.7 Upgrades). It is a standard implementation contract, meaning its logic is immutable once deployed. This simplifies the upgrade safety analysis, as there are no proxy-specific vulnerabilities to consider. Any future changes would require a new deployment and migration.

Final RecommendationWhat to do about this score

Ensure the _delegate address, which serves as the contract owner, is a highly secure and well-managed multisig wallet with robust operational procedures.

Implement comprehensive monitoring for LayerZero protocol health and transaction statuses to quickly identify and respond to any cross-chain issues. Thoroughly review and test all LayerZero configuration changes before deployment to production to prevent misconfigurations that could impact user funds or transaction costs.

Contract & Record

1 audit on record
TypeSolidity 0.8.22
NetworkBNB Chain
Token age1y
Contract0x7d81…1b62
Deployer0x40b0…cc85
Badge for your website
Bubblemaps security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 12, 202651Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the BMT contract address?

The Bubblemaps (BMT) contract on BNB Chain is 0x7d814b9ed370ec0a502edc3267393bf62d891b62. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Bubblemaps a scam?

Quantum Audit's risk score for Bubblemaps is 51/100 (Medium risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is BMT liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $457.7K.

Who holds BMT?

As of Sep 4, 2026, the 10 largest holders own 91.8% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
Baby AnsemBABYANSEM · BNB Chain51MediumEVAABNB Chain51MediumPIZZABNB Chain51MediumDGrid AIDGAI · BNB Chain51MediumStupid Kid傻孩子 · BNB Chain51MediumCycle Network TokenCYC · BNB Chain51Medium

Would You Like a More Detailed Audit of Bubblemaps?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page