On-chain security analysis — is it a scam or legit?
EthereumThe BridgedFP contract is an Omnichain Fungible Token (OFT) implementation utilizing LayerZero and OpenZeppelin's Ownable.
Read the full analysisEach factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed
Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.
Holder balances as recorded by the audit of Sep 4, 2026
The risk score reads depth across every pair.
The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.
0xc657…08080x0a72…65de0xe171…daa50xf768…8dad0x536f…5eee0x51f1…2189No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.
BridgedFP contract allows the onlyOwner to update the token's _updatableName and _updatableSymbol via the updateName, updateSymbol, and updateNameAndSymbol functions. While this provides flexibility for branding or corrections, it introduces a single point of control. A compromised owner key or a malicious owner could change the token's name and symbol to something misleading, potentially causing confusion among users, facilitating phishing attempts, or damaging the project's reputation.M-01The BridgedFP contract allows the onlyOwner to update the token's _updatableName and _updatableSymbol via the updateName, updateSymbol, and updateNameAndSymbol functions. While this provides flexibility for branding or corrections, it introduces a single point of control. A compromised owner key or a malicious owner could change the token's name and symbol to something misleading, potentially causing confusion among users, facilitating phishing attempts, or damaging the project's reputation.
Implement robust security practices for the owner's private key, such as using a multi-signature wallet (e.g., Gnosis Safe) for the _delegate address. Consider whether the ability to change the name and symbol is strictly necessary post-deployment. If not, these functions could be removed or made immutable after an initial setup period. If dynamic updates are required, ensure clear communication channels are established to inform users of any changes.
Unresolved
BridgedFP contract inherits significant functionality from external, widely-used libraries: @openzeppelin/contracts/access/Ownable.sol and @layerzerolabs/oft-evm/contracts/OFT.sol. While these libraries are generally considered secure and well-audited, any vulnerability discovered within them could directly impact the security and functionality of the BridgedFP contract. This represents a standard dependency risk.I-01The BridgedFP contract inherits significant functionality from external, widely-used libraries: @openzeppelin/contracts/access/Ownable.sol and @layerzerolabs/oft-evm/contracts/OFT.sol. While these libraries are generally considered secure and well-audited, any vulnerability discovered within them could directly impact the security and functionality of the BridgedFP contract. This represents a standard dependency risk.
Ensure that all external dependencies are kept up-to-date with their latest secure versions. Regularly monitor security advisories and audits related to OpenZeppelin Contracts and LayerZero's OFT library. While direct control over these external contracts is limited, awareness of their security posture is crucial.
Unresolved
The BridgedFP contract is an Omnichain Fungible Token (OFT) implementation utilizing LayerZero and OpenZeppelin's Ownable. It allows the owner to update the token's name and symbol. The contract's custom logic is minimal and appears robust, but the centralized control over metadata introduces a medium-level risk. No critical or high-severity vulnerabilities were identified.
The contract demonstrates good technical architecture (7.1) by extending well-audited libraries like LayerZero's OFT and OpenZeppelin's Ownable. Code security (7.2) is generally strong, with appropriate string length checks in updateName and updateSymbol. However, the centralized control over token metadata via onlyOwner functions (7.3) presents a technical risk, as a compromised owner key could lead to misleading token information. The reliance on external contracts (7.6) is a standard practice but introduces dependency risks.
The economic model (7.4) is primarily inherited from the LayerZero OFT standard, which handles cross-chain token transfers. The governance model (7.5) is highly centralized, with a single owner address controlling the ability to update the token's name and symbol. While this allows for flexibility in branding or corrections, it introduces a single point of failure. A compromised owner key could lead to malicious or misleading changes to the token's identity, potentially impacting user trust and creating confusion.
The BridgedFP contract is not designed as an upgradeable proxy (7.7). This means its logic is immutable once deployed, eliminating risks associated with upgrade mechanisms like proxy misconfigurations or faulty upgrade implementations. However, it also implies that any discovered critical vulnerabilities would necessitate a new contract deployment and token migration.
It is recommended to implement robust security measures for the owner's private key, such as multi-signature wallets or hardware security modules, to mitigate the risk associated with centralized control over token metadata.
Additionally, consider transparent communication with the community regarding any planned changes to the token's name or symbol to maintain trust and prevent confusion. Regular security reviews of all integrated external libraries are also advised.
Free for any token on the record. It links to this page and always shows the current score and the date it was checked.
Score changes are recorded as dated snapshots — history is append-only and cannot be edited.
Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.
Get Detailed Audit Is this your token? Publish your own audit on this page
