Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is LIGHT Safe?

BNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 2 audits on record
Chart
Critical RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical4/10Governance1/10Upgrades3/10Checks passed2 of 5Findings1 Medium · 2 Low · 2 Info5
SummaryAI Copilot

This audit was conducted on a truncated Solidity code snippet, primarily consisting of standard libraries and LayerZero interfaces.

Read the full analysis
What raised the score
  • Ownership not renounced — Multisig
  • Mintable supply, nominal cap 138%/year — effectively unbounded
  • Top-10 concentration > 30%
  • Liquidity not locked
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 1 Medium finding(s) from audit
  • 2 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — Multisig (2-of-3)
  • Mintable supply, nominal cap 138%/year — effectively unbounded
  • Top-10 concentration > 30% (93.3% total → 45.3% effective; 13.2% in EOAs, 80.1% in contracts — moderate)
  • Liquidity NOT locked (owner can withdraw — rug-pull risk)
  • LP top1 unlocked holder = 100.0% (exit-liquidity risk, pool = 99% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (exit-liquidity risk, pool = 99% of DEX liquidity)
  • 1 Medium finding(s) from audit
  • 2 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 42 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
80.1%Contracts13.2%Wallets6.7%Everyone else
80.1%Contracts13.2%Wallets6.7%
ContractsWalletsEveryone elseBubble area = share of supply
93.3%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking80.1%
  • Walletsanonymous holders, free to sell13.2%
  • Everyone elsethe rest of the supply6.7%
Effective concentrationwhat the score reads45.3%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$1.10M across 6 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$1.09MShare of depth98.7%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0xdc81…51170xa873…4588

A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.

Security Findings

1 Medium2 Low2 Info
Medium

Incomplete Contract Source for Comprehensive Audit

The provided source code is truncated, preventing a complete and thorough security audit of the LightOFT contract. Critical logic related to token minting, burning, cross-chain transfers, and specific administrative functions is not visible, making it impossible to assess potential vulnerabilities such as reentrancy, access control bypasses, or economic exploits within the core contract functionality.M-01

Issue

The provided source code is truncated, preventing a complete and thorough security audit of the LightOFT contract. Critical logic related to token minting, burning, cross-chain transfers, and specific administrative functions is not visible, making it impossible to assess potential vulnerabilities such as reentrancy, access control bypasses, or economic exploits within the core contract functionality.

Fix

Provide the complete and verified source code for the LightOFT contract to enable a full security assessment. This should include all inherited contracts and libraries that define the core business logic and interactions.

Status

Unresolved

Low

Broad Solidity Pragma Directive

The pragma solidity statement ^0.8.20 ^0.8.22; is overly broad, allowing compilation with a wide range of compiler versions. While the prefill specifies 0.8.29, a broad pragma can lead to unexpected behavior or introduce vulnerabilities if the contract is compiled with a different, potentially incompatible, compiler version in the future.L-01

Issue

The pragma solidity statement ^0.8.20 ^0.8.22; is overly broad, allowing compilation with a wide range of compiler versions. While the prefill specifies 0.8.29, a broad pragma can lead to unexpected behavior or introduce vulnerabilities if the contract is compiled with a different, potentially incompatible, compiler version in the future.

Fix

Pin the Solidity pragma to a specific, tested compiler version (e.g., pragma solidity 0.8.29;) to ensure consistent compilation behavior and prevent potential issues arising from compiler version differences.

Status

Unresolved

Low

Immutability Limits Bug Remediation

The contract is not upgradeable, as indicated by is_proxy: false. While this removes risks associated with upgrade mechanisms, it means that any critical bugs or vulnerabilities discovered post-deployment cannot be patched. Remediation would require deploying a new contract and migrating all users and assets, which is a complex, costly, and potentially disruptive process.L-02

Issue

The contract is not upgradeable, as indicated by is_proxy: false. While this removes risks associated with upgrade mechanisms, it means that any critical bugs or vulnerabilities discovered post-deployment cannot be patched. Remediation would require deploying a new contract and migrating all users and assets, which is a complex, costly, and potentially disruptive process.

Fix

Acknowledge the implications of immutability. Ensure extremely rigorous testing and auditing before deployment. For future projects, consider an upgradeable architecture if the ability to fix bugs or add features is deemed critical.

Status

Unresolved

Info

Dependency on LayerZero v2 Protocol Security

The LightOFT contract, as a LayerZero Omnichain Fungible Token, inherently relies on the security and correct functioning of the underlying LayerZero v2 protocol and its configured message libraries. Any vulnerabilities, exploits, or misconfigurations within the LayerZero infrastructure could directly impact the security, integrity, and economic stability of the OFT.I-01

Issue

The LightOFT contract, as a LayerZero Omnichain Fungible Token, inherently relies on the security and correct functioning of the underlying LayerZero v2 protocol and its configured message libraries. Any vulnerabilities, exploits, or misconfigurations within the LayerZero infrastructure could directly impact the security, integrity, and economic stability of the OFT.

Fix

Maintain continuous awareness of LayerZero protocol updates, security advisories, and best practices. Implement robust monitoring for LayerZero-related events and cross-chain message flows. Consider diversifying cross-chain solutions or implementing circuit breakers if the protocol allows for such mechanisms.

Status

Unresolved

Info

AddressCast Library unchecked Block Usage Review

The AddressCast library utilizes unchecked blocks for bit shifting operations. While these blocks are preceded by explicit if conditions to validate input sizes (e.g., _addressBytes.length > 32, _size == 0 || _size > 32), it is crucial that these checks are exhaustive and correctly prevent all potential overflow/underflow scenarios that unchecked blocks are designed to bypass.I-02

Issue

The AddressCast library utilizes unchecked blocks for bit shifting operations. While these blocks are preceded by explicit if conditions to validate input sizes (e.g., _addressBytes.length > 32, _size == 0 || _size > 32), it is crucial that these checks are exhaustive and correctly prevent all potential overflow/underflow scenarios that unchecked blocks are designed to bypass.

Fix

Ensure that the input validation logic preceding unchecked blocks is thoroughly reviewed and tested to guarantee that all edge cases and invalid inputs are handled, preventing any unexpected behavior or vulnerabilities from arising within the unchecked context.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

This audit was conducted on a truncated Solidity code snippet, primarily consisting of standard libraries and LayerZero interfaces. A comprehensive security assessment of the core LightOFT contract logic, including token minting, burning, and cross-chain transfer mechanisms, could not be performed due to the unavailability of the full source code. The visible components utilize well-audited OpenZeppelin contracts and LayerZero's AddressCast library. The contract is owned by a 2/3 multisig, enhancing access control. However, the inherent reliance on the LayerZero protocol introduces external dependencies.

Technical4/10Medium risk

The provided code snippet includes standard OpenZeppelin interfaces (ERC-20, ERC-165) and the LayerZero AddressCast library, which appears to handle address conversions correctly with appropriate input validation and unchecked blocks. The IMessageLibManager interface outlines critical functions for LayerZero's cross-chain messaging. However, the core logic of the LightOFT token (7.1 Architecture, 7.2 Code Security) is not available, preventing a full assessment of its implementation details, such as tokenomics, minting/burning mechanisms, and specific cross-chain transfer logic. Access control (7.3 Access Control) for administrative functions within the LightOFT contract could not be fully reviewed.

Governance1/10High risk

The contract ownership is managed by a 2/3 multisig (7.5 Governance), which is a robust access control mechanism, reducing single points of failure for administrative actions. Economically (7.4 Economic), as a LayerZero OFT, the contract's value and functionality are inherently tied to the security and operational integrity of the LayerZero v2 protocol (7.6 External). Any vulnerabilities or misconfigurations within LayerZero's core or its configured message libraries could have significant economic impacts on the OFT, such as unauthorized minting or loss of funds during cross-chain transfers.

Upgrades3/10High risk

The contract is not deployed as an upgradeable proxy (is_proxy: false), which eliminates risks associated with upgrade mechanisms (7.7 Upgrades), such as proxy initialization errors or storage collisions. This design choice ensures immutability, providing predictability and reducing the attack surface related to upgradeability. However, it also means that any discovered vulnerabilities or required feature enhancements cannot be patched directly, necessitating a new deployment and token migration process, which can be costly and disruptive (7.8 Operations).

Final RecommendationWhat to do about this score

It is strongly recommended to conduct a full security audit once the complete source code for the LightOFT contract is available, focusing on its core token logic, cross-chain transfer mechanisms, and administrative functions.

Ensure comprehensive unit and integration tests cover all critical paths, especially those involving LayerZero interactions. Implement robust monitoring for all cross-chain transactions and administrative actions to detect anomalies promptly.

Contract & Record

2 audits on record
TypeToken
NetworkBNB Chain
Token age10mo
Contract0x477c…3c0e
Deployer0xdc81…5117
Badge for your website
LIGHT security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202685Critical
  2. Jul 27, 202640Medium
  3. Jul 26, 202665High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

Is LIGHT a scam?

Based on automated analysis, LIGHT scores 65/100 (High Risk) on our risk scale. No honeypot was detected, but always verify independently before investing.

Is LIGHT safe to buy?

Our scanner flagged a risk score of 65/100. Ownership has not been renounced, which is a risk factor. DYOR before purchasing any token.

Has LIGHT been audited?

The contract has not been verified on-chain. Verification is not the same as a full security audit. Use Quantum Audit's free tool to run a deeper analysis of the contract code.

Related Audits

6 more on the recordAll audits
Block StreetBSB · BNB Chain85CriticalCea IndustriesBNC4 · BNB Chain85CriticalDexeBNB Chain84HighArciumARX · BNB Chain84HighSolsticeSLX · BNB Chain84HighFLOKIBNB Chain84High

Would You Like a More Detailed Audit of LIGHT?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page