Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Cookie Safe?

COOKIEBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance4/10Upgrades7/10Checks passed3 of 5Findings1 Medium · 3 Info4
SummaryAI Copilot

The Cookie token is an ERC-20 compliant token leveraging LayerZero's Omnichain Fungible Token (OFT) standard for cross-chain functionality.

Read the full analysis
What raised the score
  • Ownership not renounced — Multisig
  • Top-10 concentration > 50%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top3 unlocked holders = 84.8%
  • 1 Medium finding(s) from audit
Exact factors
  • Ownership NOT renounced — Multisig (2-of-3)
  • Top-10 concentration > 50% (68.1% total → 63.8% effective; 60.9% in EOAs, 7.2% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top3 unlocked holders = 84.8% (independent LP — depth risk, pool = 34% of DEX liquidity)
  • 1 Medium finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
7.2%Contracts60.9%Wallets31.9%Everyone else
7.2%60.9%Wallets31.9%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
68.1%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking7.2%
  • Walletsanonymous holders, free to sell60.9%
  • Everyone elsethe rest of the supply31.9%
Effective concentrationwhat the score reads63.8%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$222.2K across 8 pairs
Show 2 more pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$76.3KShare of depth34.4%
Top-1 Unlocked Holder33.8%
Top-3 Unlocked84.8%
Unlocked LP held by
0x3fed…92c50xdf46…5a180x1f4d…d7510x0751…22ac0xa3fb…50d90xea47…95bb0x384f…2bd70x9c78…4fab0xb352…19370x7dad…ae5f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 Medium3 Info
Medium

Centralized Control of OFT Administrative Functions

The Cookie contract inherits Ownable, granting the deployer-designated owner (a multisig) significant control over LayerZero OFT administrative functions. This includes the ability to set trusted remotes, manage fees, and potentially pause cross-chain transfers, depending on the full OFT implementation. A compromise of the multisig could lead to manipulation of cross-chain operations, potentially causing loss of funds or denial of service for token bridging (7.3 Access Control, 7.5 Governance).M-01

Issue

The Cookie contract inherits Ownable, granting the deployer-designated owner (a multisig) significant control over LayerZero OFT administrative functions. This includes the ability to set trusted remotes, manage fees, and potentially pause cross-chain transfers, depending on the full OFT implementation. A compromise of the multisig could lead to manipulation of cross-chain operations, potentially causing loss of funds or denial of service for token bridging (7.3 Access Control, 7.5 Governance).

Fix

While a multisig is used, ensure the operational security of this multisig is paramount. Implement strict internal controls, require a high threshold for critical operations, and consider adding a timelock for sensitive administrative functions to provide a delay for review and potential intervention.

Status

Unresolved

Info

Reliance on LayerZero Protocol

The Cookie token's core functionality for cross-chain transfers relies entirely on the LayerZero protocol and its OFT implementation. The security and reliability of the token's bridging capabilities are therefore dependent on the integrity and continued operation of the LayerZero network and its smart contracts (7.6 External).I-01

Issue

The Cookie token's core functionality for cross-chain transfers relies entirely on the LayerZero protocol and its OFT implementation. The security and reliability of the token's bridging capabilities are therefore dependent on the integrity and continued operation of the LayerZero network and its smart contracts (7.6 External).

Fix

Monitor LayerZero protocol announcements, security audits, and any reported vulnerabilities. Stay updated on best practices for integrating with LayerZero to ensure the token's cross-chain functionality remains secure.

Status

Unresolved

Info

Use of Battle-Tested OpenZeppelin Libraries

The contract leverages standard, widely audited, and battle-tested OpenZeppelin contracts for Ownable and ERC20 functionalities. This significantly reduces the likelihood of common vulnerabilities related to access control and token standards (7.2 Code Security).I-02

Issue

The contract leverages standard, widely audited, and battle-tested OpenZeppelin contracts for Ownable and ERC20 functionalities. This significantly reduces the likelihood of common vulnerabilities related to access control and token standards (7.2 Code Security).

Fix

Continue to use well-maintained and audited libraries. Ensure that any future updates to these libraries are carefully reviewed and tested before deployment.

Status

Unresolved

Info

Initial Token Distribution to Owner

The entire initial supply of Cookie tokens is minted to the _delegate address (which is also the initial owner) during contract deployment. This is a common pattern for initial token distribution but means the owner initially holds all tokens (7.4 Economic).I-03

Issue

The entire initial supply of Cookie tokens is minted to the _delegate address (which is also the initial owner) during contract deployment. This is a common pattern for initial token distribution but means the owner initially holds all tokens (7.4 Economic).

Fix

Ensure transparency regarding the initial token distribution and any subsequent token transfers from the owner's address. Clearly communicate the intended use and distribution plan for these tokens to the community.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The Cookie token is an ERC-20 compliant token leveraging LayerZero's Omnichain Fungible Token (OFT) standard for cross-chain functionality. It utilizes battle-tested OpenZeppelin libraries for core ERC-20 and access control features. The contract's custom logic is minimal and straightforward. The primary administrative control resides with a multisig owner, which is a good security practice. The overall risk is assessed as Low, with a Medium risk identified regarding the centralized control over OFT administrative functions.

Technical8/10Low risk

The Cookie contract demonstrates high code quality, primarily due to its minimal custom logic and extensive reliance on battle-tested OpenZeppelin libraries for ERC-20 and Ownable functionalities (7.2 Code Security). The architecture (7.1 Architecture) is straightforward, combining standard token behavior with LayerZero's OFT for cross-chain capabilities. Access control (7.3 Access Control) is robustly implemented via OpenZeppelin's Ownable pattern, with the owner being a multisig, which enhances security. No reentrancy, integer overflow/underflow, or other common technical vulnerabilities were identified in the custom code.

Governance4/10Medium risk

The economic model (7.4 Economic) is a simple fixed-supply ERC-20 token, with the initial supply minted entirely to the designated owner. Governance (7.5 Governance) is centralized around the Ownable address, which is a multisig, mitigating single-point-of-failure risks. However, this owner retains significant administrative control over the LayerZero OFT functionalities, such as setting trusted remotes and managing cross-chain parameters. A compromise of this multisig could lead to severe consequences for the token's cross-chain operations.

Upgrades7/10Low risk

The Cookie contract is deployed as a standard implementation contract and is not designed to be upgradeable (7.7 Upgrades). This eliminates risks associated with proxy patterns, such as storage collisions or incorrect upgrade logic. Any future modifications to the token's logic would necessitate deploying a new contract and migrating users, which is a significant operational undertaking.

Final RecommendationWhat to do about this score

Ensure the multisig controlling the Cookie token's administrative functions is secured with robust operational procedures, including strong key management and multi-party approval processes.

Regularly review the LayerZero protocol's security updates and best practices, as the token's cross-chain functionality is directly dependent on its integrity. Consider implementing a timelock for critical administrative actions to provide a window for community review and emergency response.

Contract & Record

1 audit on record
TypeToken
NetworkBase
Token age1y
Contract0xc004…265f
Deployer0x0c35…d3bc
Badge for your website
Cookie security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 11, 202635Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
Virtual ProtocolVIRTUAL · Base35MediumStockifySTFY · Base35MediumBasepepeBase35MediumSpace Exploration Technologies Corp.SPCXC · Base35MediumMoltbookMOLT · Base34LowKellyClaudeBase34Low

Would You Like a More Detailed Audit of Cookie?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page