Quantum Audit Logo

Is MOR Safe?

On-chain security analysis — is it a scam or legit?

MOR MOR
0x092b…fc86
Arbitrum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Critical Risk
Executive SummaryAI Copilot

The MOROFT contract implements an omnichain ERC-20 token utilizing LayerZero's OFT standard. The audit identified high risks related to centralized minting authority and the contract's immutability, which prevents post-deployment upgrades. Medium risks include critical LayerZero configuration management, while low risks pertain to external dependencies. The project benefits from using audited libraries and a multisig for ownership, but the inherent inflationary mechanism and lack of upgradeability warrant careful consideration.

2 High1 Medium1 Low
Volume 24h
$3.3K
Liquidity
$1.23M
Price
$1.9400
Token Age
2y
Top 10 Holders
72.1%

Security Findings

2 High1 Med1 Low
High

Centralized Minting Authority and Inflationary Risk

H-01The `MOROFT` contract includes a `mint` function accessible only by addresses designated as `minter`. The `updateMinter` function, which controls these roles, is restricted to the contract owner. This centralized control over token supply allows the designated minter(s) to mint an arbitrary amount of tokens, introducing significant inflationary risk to the token's economic model (7.4 Economic). A compromise of the minter's private key or a malicious action by the owner could lead to uncontrolled token issuance and severe devaluation.
IssueThe `MOROFT` contract includes a `mint` function accessible only by addresses designated as `minter`. The `updateMinter` function, which controls these roles, is restricted to the contract owner. This centralized control over token supply allows the designated minter(s) to mint an arbitrary amount of tokens, introducing significant inflationary risk to the token's economic model (7.4 Economic). A compromise of the minter's private key or a malicious action by the owner could lead to uncontrolled token issuance and severe devaluation.
FixImplement a time-locked or multi-signature mechanism for minting operations, or introduce a maximum minting limit per period. Consider integrating a governance mechanism (e.g., DAO) to approve minting requests, decentralizing control. Ensure strict operational security for the owner multisig and any designated minter addresses.
StatusUnresolved
High

Immutability and Lack of Upgradeability

H-02The `MOROFT` contract is deployed as a standard, non-proxy contract, meaning it is immutable once deployed. There is no mechanism to upgrade the contract's logic (7.7 Upgrades). This poses a significant risk because any critical bugs, vulnerabilities, or necessary feature enhancements discovered post-deployment cannot be patched. Remediation would require deploying a new contract and migrating all token holders, which is a complex, costly, and disruptive process for the protocol and its users.
IssueThe `MOROFT` contract is deployed as a standard, non-proxy contract, meaning it is immutable once deployed. There is no mechanism to upgrade the contract's logic (7.7 Upgrades). This poses a significant risk because any critical bugs, vulnerabilities, or necessary feature enhancements discovered post-deployment cannot be patched. Remediation would require deploying a new contract and migrating all token holders, which is a complex, costly, and disruptive process for the protocol and its users.
FixFor future deployments, consider implementing an upgradeable proxy pattern (e.g., UUPS or Transparent Proxy) to allow for bug fixes and feature enhancements without requiring a token migration. For the current deployment, ensure extremely thorough testing, formal verification, and a robust incident response plan are in place.
StatusUnresolved
Medium

Critical LayerZero Configuration Management

M-01The `MOROFT` contract inherits from LayerZero's `OFT` contract, which includes several `onlyOwner` functions for critical cross-chain configuration (e.g., `setPeer`, `setTrustedRemote`, `setMinDstGas`, `setFeeManager`). Incorrect configuration of these parameters, or a compromise of the owner's address, could lead to funds being stuck during cross-chain transfers, excessive gas fees, or potential exploits related to message relaying (7.6 External, 7.8 Operations). While the owner is a multisig, the complexity of LayerZero configuration requires careful management.
IssueThe `MOROFT` contract inherits from LayerZero's `OFT` contract, which includes several `onlyOwner` functions for critical cross-chain configuration (e.g., `setPeer`, `setTrustedRemote`, `setMinDstGas`, `setFeeManager`). Incorrect configuration of these parameters, or a compromise of the owner's address, could lead to funds being stuck during cross-chain transfers, excessive gas fees, or potential exploits related to message relaying (7.6 External, 7.8 Operations). While the owner is a multisig, the complexity of LayerZero configuration requires careful management.
FixEstablish clear, documented procedures for all LayerZero configuration changes. Implement a robust testing environment to validate configuration changes before applying them to production. Consider adding a timelock to critical LayerZero configuration changes to provide a window for review and potential intervention.
StatusUnresolved
Low

Dependency on External LayerZero Security

L-01The `MOROFT` token's omnichain functionality is entirely dependent on the security and operational integrity of the LayerZero protocol. Any vulnerabilities, exploits, or operational failures within the LayerZero network itself could directly impact the `MOROFT` token, potentially leading to loss of funds during cross-chain transfers or disruption of its core functionality (7.6 External).
IssueThe `MOROFT` token's omnichain functionality is entirely dependent on the security and operational integrity of the LayerZero protocol. Any vulnerabilities, exploits, or operational failures within the LayerZero network itself could directly impact the `MOROFT` token, potentially leading to loss of funds during cross-chain transfers or disruption of its core functionality (7.6 External).
FixWhile direct control over LayerZero's core security is not possible, the project should continuously monitor LayerZero's security announcements, audits, and operational status. Maintain a contingency plan for potential LayerZero disruptions, such as communication strategies for users and potential mitigation steps.
StatusUnresolved

Category Ratings

TechnicalMedium6/10

The contract leverages well-audited LayerZero OFT and OpenZeppelin libraries, ensuring robust core ERC-20 functionality and cross-chain messaging (7.2 Code Security). The `supportsInterface` implementation is correct, adhering to ERC-165 (7.1 Architecture). A primary technical risk is the contract's immutability, meaning no upgrades are possible for bug fixes or feature enhancements (7.7 Upgrades). Additionally, the correct and secure configuration of LayerZero parameters by the owner is crucial for preventing stuck funds or exploits during cross-chain transfers (7.6 External).

GovernanceHigh1/10

Critical administrative functions, such as `updateMinter` and LayerZero configurations, are protected by `onlyOwner` and controlled by a 5/9 multisig, enhancing operational security (7.3 Access Control, 7.8 Operations). However, the `minter` role possesses the ability to mint an arbitrary amount of tokens, introducing significant inflationary risk to the token's economic model (7.4 Economic). The security of the token's supply is therefore highly dependent on the operational security and integrity of the designated minter(s) (7.5 Governance).

UpgradesHigh3/10

The contract's immutability provides certainty regarding its deployed logic, as it cannot be altered post-deployment. However, the `MOROFT` contract is not designed with any upgradeability mechanism (7.7 Upgrades). This poses a high risk as any discovered critical vulnerabilities or necessary feature enhancements would require a complete redeployment of the contract and a potentially complex and disruptive token migration process for users.

Security Checklist

2/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyPass

Holder Composition

72.1% in top 10
14.7% in wallets57.5% in contracts
Effective Concentration37.7%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$1.23M

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

6 addresses
Deployer
0x040e…0626
Unlocked LP Held By
0x151c…09560x30dc…a3f30x826f…1e650xeb2e…acbe0x6a64…4bc2

A privileged address — the deployer, the owner, or the token contract itself — is among these holders, so that party can withdraw liquidity.

What Raised This Score

9 factors
  • Ownership NOT renounced — strong Multisig (5-of-9)
  • Mintable supply — no cap found, dilution unbounded
  • Top-10 concentration > 30% (72.1% total → 37.7% effective; 14.7% in EOAs, 57.5% in contracts — moderate)
  • Liquidity NOT locked (owner can withdraw — rug-pull risk)
  • LP top1 unlocked holder = 100.0% (exit-liquidity risk)
  • LP top3 unlocked holders = 100.0% (exit-liquidity risk)
  • 2 High finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Vangrid (VAN)Critical RiskDGrid AI (DGAI)Critical RiskAxelar Wrapped LAVA (LAVA)Critical RiskUnicity Labs (UNYLA)Critical RiskCatena Labs (CATE)Critical RiskVision (VSN)Critical Risk

Would You Like a More Detailed Audit of MOR?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit