Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is MOR Safe?

Arbitrum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades3/10Checks passed2 of 5Findings2 High · 1 Medium · 1 Low4
SummaryAI Copilot

The MOROFT contract implements an omnichain ERC-20 token utilizing LayerZero's OFT standard.

Read the full analysis
What raised the score
  • Ownership not renounced — strong Multisig
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30%
  • Liquidity not locked
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — strong Multisig (5-of-9)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30% (72.1% total → 37.7% effective; 14.7% in EOAs, 57.5% in contracts — moderate)
  • Liquidity NOT locked (owner can withdraw — rug-pull risk)
  • LP top1 unlocked holder = 100.0% (exit-liquidity risk)
  • LP top3 unlocked holders = 100.0% (exit-liquidity risk)
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 42 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintMintable
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
57.5%Contracts14.7%Wallets27.9%Everyone else
57.5%Contracts14.7%Wallets27.9%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
72.1%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking57.5%
  • Walletsanonymous holders, free to sell14.7%
  • Everyone elsethe rest of the supply27.9%
Effective concentrationwhat the score reads37.7%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$1.23M

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$1.23MShare of depth100.0%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x151c…09560x30dc…a3f30x826f…1e650xeb2e…acbe0x6a64…4bc2

A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.

Security Findings

2 High1 Medium1 Low
High

Centralized Minting Authority and Inflationary Risk

The MOROFT contract includes a mint function accessible only by addresses designated as minter. The updateMinter function, which controls these roles, is restricted to the contract owner. This centralized control over token supply allows the designated minter(s) to mint an arbitrary amount of tokens, introducing significant inflationary risk to the token's economic model (7.4 Economic). A compromise of the minter's private key or a malicious action by the owner could lead to uncontrolled token issuance and severe devaluation.H-01

Issue

The MOROFT contract includes a mint function accessible only by addresses designated as minter. The updateMinter function, which controls these roles, is restricted to the contract owner. This centralized control over token supply allows the designated minter(s) to mint an arbitrary amount of tokens, introducing significant inflationary risk to the token's economic model (7.4 Economic). A compromise of the minter's private key or a malicious action by the owner could lead to uncontrolled token issuance and severe devaluation.

Fix

Implement a time-locked or multi-signature mechanism for minting operations, or introduce a maximum minting limit per period. Consider integrating a governance mechanism (e.g., DAO) to approve minting requests, decentralizing control. Ensure strict operational security for the owner multisig and any designated minter addresses.

Status

Unresolved

High

Immutability and Lack of Upgradeability

The MOROFT contract is deployed as a standard, non-proxy contract, meaning it is immutable once deployed. There is no mechanism to upgrade the contract's logic (7.7 Upgrades). This poses a significant risk because any critical bugs, vulnerabilities, or necessary feature enhancements discovered post-deployment cannot be patched. Remediation would require deploying a new contract and migrating all token holders, which is a complex, costly, and disruptive process for the protocol and its users.H-02

Issue

The MOROFT contract is deployed as a standard, non-proxy contract, meaning it is immutable once deployed. There is no mechanism to upgrade the contract's logic (7.7 Upgrades). This poses a significant risk because any critical bugs, vulnerabilities, or necessary feature enhancements discovered post-deployment cannot be patched. Remediation would require deploying a new contract and migrating all token holders, which is a complex, costly, and disruptive process for the protocol and its users.

Fix

For future deployments, consider implementing an upgradeable proxy pattern (e.g., UUPS or Transparent Proxy) to allow for bug fixes and feature enhancements without requiring a token migration. For the current deployment, ensure extremely thorough testing, formal verification, and a robust incident response plan are in place.

Status

Unresolved

Medium

Critical LayerZero Configuration Management

The MOROFT contract inherits from LayerZero's OFT contract, which includes several onlyOwner functions for critical cross-chain configuration (e.g., setPeer, setTrustedRemote, setMinDstGas, setFeeManager). Incorrect configuration of these parameters, or a compromise of the owner's address, could lead to funds being stuck during cross-chain transfers, excessive gas fees, or potential exploits related to message relaying (7.6 External, 7.8 Operations). While the owner is a multisig, the complexity of LayerZero configuration requires careful management.M-01

Issue

The MOROFT contract inherits from LayerZero's OFT contract, which includes several onlyOwner functions for critical cross-chain configuration (e.g., setPeer, setTrustedRemote, setMinDstGas, setFeeManager). Incorrect configuration of these parameters, or a compromise of the owner's address, could lead to funds being stuck during cross-chain transfers, excessive gas fees, or potential exploits related to message relaying (7.6 External, 7.8 Operations). While the owner is a multisig, the complexity of LayerZero configuration requires careful management.

Fix

Establish clear, documented procedures for all LayerZero configuration changes. Implement a robust testing environment to validate configuration changes before applying them to production. Consider adding a timelock to critical LayerZero configuration changes to provide a window for review and potential intervention.

Status

Unresolved

Low

Dependency on External LayerZero Security

The MOROFT token's omnichain functionality is entirely dependent on the security and operational integrity of the LayerZero protocol. Any vulnerabilities, exploits, or operational failures within the LayerZero network itself could directly impact the MOROFT token, potentially leading to loss of funds during cross-chain transfers or disruption of its core functionality (7.6 External).L-01

Issue

The MOROFT token's omnichain functionality is entirely dependent on the security and operational integrity of the LayerZero protocol. Any vulnerabilities, exploits, or operational failures within the LayerZero network itself could directly impact the MOROFT token, potentially leading to loss of funds during cross-chain transfers or disruption of its core functionality (7.6 External).

Fix

While direct control over LayerZero's core security is not possible, the project should continuously monitor LayerZero's security announcements, audits, and operational status. Maintain a contingency plan for potential LayerZero disruptions, such as communication strategies for users and potential mitigation steps.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The MOROFT contract implements an omnichain ERC-20 token utilizing LayerZero's OFT standard. The audit identified high risks related to centralized minting authority and the contract's immutability, which prevents post-deployment upgrades. Medium risks include critical LayerZero configuration management, while low risks pertain to external dependencies. The project benefits from using audited libraries and a multisig for ownership, but the inherent inflationary mechanism and lack of upgradeability warrant careful consideration.

Technical6/10Medium risk

The contract leverages well-audited LayerZero OFT and OpenZeppelin libraries, ensuring robust core ERC-20 functionality and cross-chain messaging (7.2 Code Security). The supportsInterface implementation is correct, adhering to ERC-165 (7.1 Architecture). A primary technical risk is the contract's immutability, meaning no upgrades are possible for bug fixes or feature enhancements (7.7 Upgrades). Additionally, the correct and secure configuration of LayerZero parameters by the owner is crucial for preventing stuck funds or exploits during cross-chain transfers (7.6 External).

Governance1/10High risk

Critical administrative functions, such as updateMinter and LayerZero configurations, are protected by onlyOwner and controlled by a 5/9 multisig, enhancing operational security (7.3 Access Control, 7.8 Operations). However, the minter role possesses the ability to mint an arbitrary amount of tokens, introducing significant inflationary risk to the token's economic model (7.4 Economic). The security of the token's supply is therefore highly dependent on the operational security and integrity of the designated minter(s) (7.5 Governance).

Upgrades3/10High risk

The contract's immutability provides certainty regarding its deployed logic, as it cannot be altered post-deployment. However, the MOROFT contract is not designed with any upgradeability mechanism (7.7 Upgrades). This poses a high risk as any discovered critical vulnerabilities or necessary feature enhancements would require a complete redeployment of the contract and a potentially complex and disruptive token migration process for users.

Final RecommendationWhat to do about this score

It is recommended to implement robust operational security measures for the multisig owner and any designated minter addresses, including strict key management and multi-factor authentication.

Given the contract's immutability, thorough pre-deployment testing and formal verification are crucial to minimize the risk of unpatchable vulnerabilities. Additionally, consider establishing clear policies and transparency around the minting process to manage inflationary expectations and maintain token holder trust.

Contract & Record

1 audit on record
TypeToken
NetworkArbitrum
Token age2y
Contract0x092b…fc86
Deployer0x040e…0626
Badge for your website
MOR security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 4, 202684High
  2. Aug 15, 202676High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
VangridVAN · Arbitrum84HighDGrid AIDGAI · Arbitrum84HighGUBERTOArbitrum85CriticalAxelar Wrapped LAVALAVA · Arbitrum87CriticalUnicity LabsUNYLA · Arbitrum81HighCatena LabsCATE · Arbitrum80High

Would You Like a More Detailed Audit of MOR?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page