Quantum Audit Logo

Is CTR Safe?

On-chain security analysis — is it a scam or legit?

CTR CTR
0x1103…57f7
Base Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The Citrea Token OFT contract is a minimal implementation of a LayerZero Omnichain Fungible Token (OFT), inheriting from LayerZero's OFT base contract and OpenZeppelin's Ownable. The contract facilitates cross-chain token transfers via the LayerZero v2 protocol. The audit focused on the contract's specific implementation, its interaction with LayerZero, and its access control mechanisms. Key findings include centralized control over cross-chain configurations and inherent reliance on the security of the LayerZero protocol.

1 High1 Medium1 Low1 Informational
Volume 24h
$561.6K
Liquidity
$514.5K
Price
$0.01004
Token Age
1y
Top 10 Holders
84.1%

Security Findings

1 High1 Med1 Low1 Info
High

Centralized Control over Cross-Chain Functionality

H-01The `owner` (a 3/5 multisig) has extensive control over the LayerZero OFT configuration, including setting trusted remotes, minimum destination gas, and potentially pausing cross-chain transfers via the inherited OFT functions. A compromise of the multisig could lead to redirection of cross-chain funds, denial of service for cross-chain operations, or manipulation of fees (7.3 Access Control, 7.4 Economic, 7.5 Governance).
IssueThe `owner` (a 3/5 multisig) has extensive control over the LayerZero OFT configuration, including setting trusted remotes, minimum destination gas, and potentially pausing cross-chain transfers via the inherited OFT functions. A compromise of the multisig could lead to redirection of cross-chain funds, denial of service for cross-chain operations, or manipulation of fees (7.3 Access Control, 7.4 Economic, 7.5 Governance).
FixEnsure the multisig controlling the owner address adheres to the highest security standards, including robust key management, secure signing procedures, and regular audits of its members. Implement strict internal controls and monitoring for all owner-privileged functions. Consider a time-lock for critical configuration changes if feasible for the protocol's operational needs.
StatusUnresolved
Medium

Reliance on External LayerZero Protocol Security

M-01The `CitreaTokenOFT` contract is a wrapper around the LayerZero OFT implementation. Its security is fundamentally tied to the security and integrity of the LayerZero v2 protocol and its smart contracts (e.g., `OFT.sol`, `ILayerZeroEndpointV2.sol`). Any vulnerabilities or exploits within the LayerZero endpoint, message libraries, or OFT base contract could directly affect the safety of funds managed by this token (7.6 External).
IssueThe `CitreaTokenOFT` contract is a wrapper around the LayerZero OFT implementation. Its security is fundamentally tied to the security and integrity of the LayerZero v2 protocol and its smart contracts (e.g., `OFT.sol`, `ILayerZeroEndpointV2.sol`). Any vulnerabilities or exploits within the LayerZero endpoint, message libraries, or OFT base contract could directly affect the safety of funds managed by this token (7.6 External).
FixStay informed about LayerZero protocol updates, security audits, and any reported vulnerabilities. Implement robust monitoring for LayerZero endpoint activity and cross-chain transactions involving the token. While direct mitigation within this contract is limited, awareness and rapid response capabilities are crucial.
StatusUnresolved
Low

Lack of Explicit Event Emission for Critical Owner Actions

L-01While the inherited `OFT` base contract likely emits events for its critical functions (e.g., `setPeer`, `setMinDstGas`), the `CitreaTokenOFT` itself does not add any custom events for its constructor or any potential future owner-controlled functions. Explicit events for all critical state changes improve transparency and monitoring for off-chain systems (7.2 Code Security, 7.8 Operations).
IssueWhile the inherited `OFT` base contract likely emits events for its critical functions (e.g., `setPeer`, `setMinDstGas`), the `CitreaTokenOFT` itself does not add any custom events for its constructor or any potential future owner-controlled functions. Explicit events for all critical state changes improve transparency and monitoring for off-chain systems (7.2 Code Security, 7.8 Operations).
FixFor any future custom owner-controlled functions added to `CitreaTokenOFT`, ensure that appropriate events are emitted to log critical state changes. Review the `OFT` base contract's events to confirm comprehensive coverage for cross-chain configuration changes.
StatusUnresolved
Info

Immutability of LayerZero Endpoint Address

I-01The LayerZero endpoint address (`_lzEndpoint`) is set in the constructor and cannot be changed after deployment. While this ensures stability and prevents malicious modification, it means that if the LayerZero endpoint itself needs to be upgraded or replaced (e.g., due to a critical vulnerability or protocol evolution), the `CitreaTokenOFT` contract would need to be redeployed, requiring users to migrate their tokens (7.1 Architecture, 7.7 Upgrades).
IssueThe LayerZero endpoint address (`_lzEndpoint`) is set in the constructor and cannot be changed after deployment. While this ensures stability and prevents malicious modification, it means that if the LayerZero endpoint itself needs to be upgraded or replaced (e.g., due to a critical vulnerability or protocol evolution), the `CitreaTokenOFT` contract would need to be redeployed, requiring users to migrate their tokens (7.1 Architecture, 7.7 Upgrades).
FixThis is an architectural design choice. Acknowledge the implications of an immutable endpoint. If future flexibility is desired, consider an upgradeable proxy pattern for the token or a mechanism to update the endpoint address, though this adds complexity and potential attack surface.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The CitreaTokenOFT contract is minimal, primarily inheriting from LayerZero's OFT and OpenZeppelin's Ownable. The code is straightforward and uses a recent Solidity version (0.8.33), benefiting from checked arithmetic. The primary technical risk stems from its reliance on the LayerZero v2 protocol, as any vulnerabilities in the external OFT library or LayerZero endpoint could directly impact the token's security (7.6 External). For instance, a bug in the OFT's `_debit` or `_credit` functions could lead to incorrect token accounting.

GovernanceHigh2/10

The contract employs an `Ownable` pattern, with the owner being a 3/5 multisig, which enhances security compared to a single EOA. This owner has significant control over critical cross-chain functionalities, such as setting trusted remotes and minimum destination gas for LayerZero operations (7.3 Access Control). While necessary for configuration, this centralization introduces a point of control that, if compromised, could lead to economic risks like fund redirection or service disruption (7.4 Economic). For example, a malicious owner could set a trusted remote to an attacker-controlled address.

UpgradesLow7/10

The CitreaTokenOFT contract is not designed as an upgradeable proxy, meaning its logic is immutable once deployed. This simplifies the architecture by avoiding upgrade-related complexities and risks (7.7 Upgrades). However, any future changes to the token's core logic or a need to update the LayerZero endpoint would necessitate a complete redeployment and user migration, which can be a complex and disruptive process. This design choice prioritizes immutability over flexibility.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

84.1% in top 10
31.9% in wallets52.2% in contracts
Effective Concentration52.8%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$525.8K across 5 pairs
AerodromeUSDCanalysed$514.5K97.8%Uniswap v4ETH$9.5K1.8%PancakeswapUSDC$1.7K0.3%Uniswap v4USDC$870.0%Uniswap v3USDC$350.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

3 addresses
Deployer
0xb6ef…5e96
Unlocked LP Held By
0x08cd…a4a60x7234…dece

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

8 factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Top-10 concentration > 50% (84.1% total → 52.8% effective; 31.9% in EOAs, 52.2% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk, pool = 98% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 98% of DEX liquidity)
  • 1 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
HOMEHigh RiskDegenHigh RiskVenice Token (VVV)High RiskAUTONOMOPOLY (AUTONO)High RiskSolana (SOL)High RiskTAOTHigh Risk

Would You Like a More Detailed Audit of CTR?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit