Quantum Audit Logo

Is Cookie Safe?

On-chain security analysis — is it a scam or legit?

Cookie COOKIE
0xc004…265f
Base Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

The Cookie token is an ERC-20 compliant token leveraging LayerZero's Omnichain Fungible Token (OFT) standard for cross-chain functionality. It utilizes battle-tested OpenZeppelin libraries for core ERC-20 and access control features. The contract's custom logic is minimal and straightforward. The primary administrative control resides with a multisig owner, which is a good security practice. The overall risk is assessed as Low, with a Medium risk identified regarding the centralized control over OFT administrative functions.

1 Medium3 Informational
Volume 24h
$4.8K
Liquidity
$76.3K
Price
$0.01159
Token Age
1y
Top 10 Holders
68.1%

Security Findings

1 Med3 Info
Medium

Centralized Control of OFT Administrative Functions

M-01The `Cookie` contract inherits `Ownable`, granting the deployer-designated owner (a multisig) significant control over LayerZero OFT administrative functions. This includes the ability to set trusted remotes, manage fees, and potentially pause cross-chain transfers, depending on the full OFT implementation. A compromise of the multisig could lead to manipulation of cross-chain operations, potentially causing loss of funds or denial of service for token bridging (7.3 Access Control, 7.5 Governance).
IssueThe `Cookie` contract inherits `Ownable`, granting the deployer-designated owner (a multisig) significant control over LayerZero OFT administrative functions. This includes the ability to set trusted remotes, manage fees, and potentially pause cross-chain transfers, depending on the full OFT implementation. A compromise of the multisig could lead to manipulation of cross-chain operations, potentially causing loss of funds or denial of service for token bridging (7.3 Access Control, 7.5 Governance).
FixWhile a multisig is used, ensure the operational security of this multisig is paramount. Implement strict internal controls, require a high threshold for critical operations, and consider adding a timelock for sensitive administrative functions to provide a delay for review and potential intervention.
StatusUnresolved
Info

Reliance on LayerZero Protocol

I-01The `Cookie` token's core functionality for cross-chain transfers relies entirely on the LayerZero protocol and its `OFT` implementation. The security and reliability of the token's bridging capabilities are therefore dependent on the integrity and continued operation of the LayerZero network and its smart contracts (7.6 External).
IssueThe `Cookie` token's core functionality for cross-chain transfers relies entirely on the LayerZero protocol and its `OFT` implementation. The security and reliability of the token's bridging capabilities are therefore dependent on the integrity and continued operation of the LayerZero network and its smart contracts (7.6 External).
FixMonitor LayerZero protocol announcements, security audits, and any reported vulnerabilities. Stay updated on best practices for integrating with LayerZero to ensure the token's cross-chain functionality remains secure.
StatusUnresolved
Info

Use of Battle-Tested OpenZeppelin Libraries

I-02The contract leverages standard, widely audited, and battle-tested OpenZeppelin contracts for `Ownable` and `ERC20` functionalities. This significantly reduces the likelihood of common vulnerabilities related to access control and token standards (7.2 Code Security).
IssueThe contract leverages standard, widely audited, and battle-tested OpenZeppelin contracts for `Ownable` and `ERC20` functionalities. This significantly reduces the likelihood of common vulnerabilities related to access control and token standards (7.2 Code Security).
FixContinue to use well-maintained and audited libraries. Ensure that any future updates to these libraries are carefully reviewed and tested before deployment.
StatusUnresolved
Info

Initial Token Distribution to Owner

I-03The entire initial supply of `Cookie` tokens is minted to the `_delegate` address (which is also the initial owner) during contract deployment. This is a common pattern for initial token distribution but means the owner initially holds all tokens (7.4 Economic).
IssueThe entire initial supply of `Cookie` tokens is minted to the `_delegate` address (which is also the initial owner) during contract deployment. This is a common pattern for initial token distribution but means the owner initially holds all tokens (7.4 Economic).
FixEnsure transparency regarding the initial token distribution and any subsequent token transfers from the owner's address. Clearly communicate the intended use and distribution plan for these tokens to the community.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The `Cookie` contract demonstrates high code quality, primarily due to its minimal custom logic and extensive reliance on battle-tested OpenZeppelin libraries for ERC-20 and Ownable functionalities (7.2 Code Security). The architecture (7.1 Architecture) is straightforward, combining standard token behavior with LayerZero's OFT for cross-chain capabilities. Access control (7.3 Access Control) is robustly implemented via OpenZeppelin's `Ownable` pattern, with the owner being a multisig, which enhances security. No reentrancy, integer overflow/underflow, or other common technical vulnerabilities were identified in the custom code.

GovernanceMedium4/10

The economic model (7.4 Economic) is a simple fixed-supply ERC-20 token, with the initial supply minted entirely to the designated owner. Governance (7.5 Governance) is centralized around the `Ownable` address, which is a multisig, mitigating single-point-of-failure risks. However, this owner retains significant administrative control over the LayerZero OFT functionalities, such as setting trusted remotes and managing cross-chain parameters. A compromise of this multisig could lead to severe consequences for the token's cross-chain operations.

UpgradesLow7/10

The `Cookie` contract is deployed as a standard implementation contract and is not designed to be upgradeable (7.7 Upgrades). This eliminates risks associated with proxy patterns, such as storage collisions or incorrect upgrade logic. Any future modifications to the token's logic would necessitate deploying a new contract and migrating users, which is a significant operational undertaking.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

68.1% in top 10
60.9% in wallets7.2% in contracts
Effective Concentration63.8%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$222.2K across 8 pairs
AerodromeWETHanalysed$76.3K34.4%AerodromeWETH$70.5K31.7%AerodromeWETH$66.5K30.0%Uniswap v3WETH$6.1K2.8%Uniswap v3VIRTUAL$2.7K1.2%PancakeswapWETH$10.0%
Show 2 more pairsShow less
AerodromeAERO$10.0%AerodromehyUSD$00.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder33.8%
Top-3 Unlocked84.8%

Key Addresses

11 addresses
Deployer
0x0c35…d3bc
Unlocked LP Held By
0x3fed…92c50xdf46…5a180x1f4d…d7510x0751…22ac0xa3fb…50d90xea47…95bb0x384f…2bd70x9c78…4fab0xb352…19370x7dad…ae5f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

5 factors
  • Ownership NOT renounced — Multisig (2-of-3)
  • Top-10 concentration > 50% (68.1% total → 63.8% effective; 60.9% in EOAs, 7.2% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top3 unlocked holders = 84.8% (independent LP — depth risk, pool = 34% of DEX liquidity)
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Virtual Protocol (VIRTUAL)Medium RiskStockify (STFY)Medium RiskBasepepeMedium RiskMoltbook (MOLT)Medium RiskKellyClaudeMedium RiskPlayMedium Risk

Would You Like a More Detailed Audit of Cookie?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit