Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is ORBOFI Safe?

OBIBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Oct 14, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades1/10Checks passed3 of 7Findings1 High · 5 Medium · 3 Info9
SummaryAI Copilot

The BridgeMintableTokenV2 contract is an upgradeable ERC-20 token with significant centralized control.

Read the full analysis
What raised the score
  • Owner can change any holder's balance
  • Owner can pause all transfers; held by chainportbridge: Other-Contract, chainportcongress: Other-Contract
  • Owner can blacklist or freeze individual holders; held by chainportbridge: Other-Contract, chainportcongress: Other-Contract
  • Mintable supply — no cap found, dilution unbounded; held by chainportbridge: Other-Contract, chainportcongress: Other-Contract
  • Upgradeable proxy — the admin can replace the logic; admin: ProxyAdmin -> Other-Contract
  • Ownership status UNKNOWN
  • Liquidity not locked
  • Top-10 concentration > 30%
Exact factors
  • Owner can change any holder's balance (seize or credit tokens); held by chainportcongress: Other-Contract
  • Owner can pause all transfers; held by chainportbridge: Other-Contract, chainportcongress: Other-Contract
  • Owner can blacklist or freeze individual holders; held by chainportbridge: Other-Contract, chainportcongress: Other-Contract
  • Mintable supply — no cap found, dilution unbounded; held by chainportbridge: Other-Contract, chainportcongress: Other-Contract
  • Upgradeable proxy — the admin can replace the logic; admin: ProxyAdmin -> Other-Contract
  • Ownership status UNKNOWN (owner could not be resolved)
  • Liquidity NOT locked (100% of the pool; this pool is 95% of DEX liquidity) — who holds it cannot be verified
  • Top-10 concentration > 30% (61.4% total → 49.7% effective; 44.0% in EOAs, 14.1% in contracts; 3.3% burned, locked or in pools excluded)

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Oct 143 of 7 checks passed
Contract verifiedVerified
OwnershipUnknown
MintMintable
Liquidity lockNot locked
UpgradeabilityUpgradeable
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Oct 14, 20268,049 holders
14.1%Contracts44.0%Wallets3.3%38.6%Everyone else
14.1%44.0%Wallets38.6%Everyone else
ContractsWalletsDEX poolsEveryone elseBubble area = share of supply
61.4%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking14.1%
  • Walletsanonymous holders, free to sell44.0%
  • DEX poolsthe pools' own liquidity3.3%
  • Everyone else8,039 holders38.6%
Effective concentrationwhat the score reads49.7%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Oct 14, 2026

Liquidity

as of audit · Oct 14$66.7K across 4 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$63.4KShare of depth95.1%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x6d6f…1c1b

Security Findings

1 High5 Medium3 Info
High

Controller Can Burn Tokens from Any Holder's Wallet

The destroyBlackFunds function grants the chainportcongress controller the power to remove (burn) tokens from any address. This means the chainportcongress can unilaterally reduce the balance of any token holder, effectively seizing their tokens.CP-02

Issue

The destroyBlackFunds function grants the chainportcongress controller the power to remove (burn) tokens from any address. This means the chainportcongress can unilaterally reduce the balance of any token holder, effectively seizing their tokens.

Fix

This function represents a significant centralization risk. Token holders must understand that their token balances are subject to direct modification by the chainportcongress controller. Transparency and strong governance around the use of this function are critical.

Status

Unresolved

Medium

Centralized Minting Authority Can Dilute Token Supply

The mint function allows specific controllers, namely chainportbridge, chainportcongress, and classifiedauthority, to create new tokens at any time. This means these controllers can increase the total supply of tokens, which could reduce the value of existing tokens held by others.CP-01

Issue

The mint function allows specific controllers, namely chainportbridge, chainportcongress, and classifiedauthority, to create new tokens at any time. This means these controllers can increase the total supply of tokens, which could reduce the value of existing tokens held by others.

Fix

Token holders should be aware that the token supply is not fixed and can be increased by the designated controllers. It is important to trust these entities to manage the supply responsibly and transparently.

Status

Unresolved

Medium

Controllers Can Halt All Token Transfers

The pause function allows chainportbridge, chainportcongress, and classifiedauthority controllers to stop all token transfers on the network. If the token is paused, no one, including regular token holders, can send or receive tokens until one of the controllers uses the unpause function (specifically chainportcongress) to resume transfers.CP-04

Issue

The pause function allows chainportbridge, chainportcongress, and classifiedauthority controllers to stop all token transfers on the network. If the token is paused, no one, including regular token holders, can send or receive tokens until one of the controllers uses the unpause function (specifically chainportcongress) to resume transfers.

Fix

Token holders should be aware that their ability to transfer tokens can be temporarily suspended by the designated controllers. This feature is often used in emergencies but represents a centralized point of control over liquidity.

Status

Unresolved

Medium

Controllers Can Block Specific Token Holders

The blockAddress function allows chainportbridge, chainportcongress, and classifiedauthority controllers to prevent specific addresses from transferring or receiving tokens. This means these controllers can selectively freeze individual token holders' ability to move their assets, while others can still transact. The chainportcongress can unblockAddress.CP-06

Issue

The blockAddress function allows chainportbridge, chainportcongress, and classifiedauthority controllers to prevent specific addresses from transferring or receiving tokens. This means these controllers can selectively freeze individual token holders' ability to move their assets, while others can still transact. The chainportcongress can unblockAddress.

Fix

Token holders should understand that their address can be individually blocked from participating in token transfers by the designated controllers. This power could be used for regulatory compliance or to mitigate malicious activity, but it also introduces a risk of censorship.

Status

Unresolved

Medium

Liquidity not locked

0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a contract, 0x6d6f…1c1b — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.QA-LIQUIDITY

Issue

0.0% of the pool's LP is burned or time-locked. 100.0% is held, unlocked, by 1 address(es) other than the owner/deployer. One of them — a contract, 0x6d6f…1c1b — holds 100.0% and can remove that share at once; who controls it is not visible on-chain, so it is not treated as an independent provider. Some pools are concentrated-liquidity (V3/V4) positions; shares above are by position as GoPlus reports them.

Fix

Check the lock's end date and beneficiary on the locker's own page before relying on it.

Status

Acknowledged

Medium

The market for this token

Liquidity $67K (DexScreener, all pools). 24h trading volume $1.5M (CoinGecko, all markets, daily snapshot). 24h trading volume $1.8M (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.0848 on 2023-05-29; the price is now 99.0863% below it.QA-MARKET

Issue

Liquidity $67K (DexScreener, all pools). 24h trading volume $1.5M (CoinGecko, all markets, daily snapshot). 24h trading volume $1.8M (DexScreener, all pools). CoinGecko's record for this coin: all-time high $0.0848 on 2023-05-29; the price is now 99.0863% below it.

Fix

Size any position to the liquidity and daily volume shown — they set how much you can sell and at what price.

Status

Acknowledged

Info

Who holds the supply

The ten largest holders own 61.4% of supply. Of that, 3.3% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 44.0% in wallets, 14.1% in other contracts. 8,049 holders in total.QA-HOLDERS

Issue

The ten largest holders own 61.4% of supply. Of that, 3.3% in DEX pools — not holders that can sell, so excluded from the concentration score. What remains: 44.0% in wallets, 14.1% in other contracts. 8,049 holders in total.

Fix

Watch the largest wallets that are not exchanges, pools or locks — those are the ones that can move the price.

Status

Acknowledged

Info

Listed, but not independently verified

Listed on CoinGecko as Orbofi AI (OBI), market cap $1M, rank #2846. 8,049 holders.QA-IDENTITY

Issue

Listed on CoinGecko as Orbofi AI (OBI), market cap $1M, rank #2846. 8,049 holders.

Fix

Match the contract address against the project's official channels before trading.

Status

Acknowledged

Info

Asset class: Project token

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $67K of DEX liquidity across 4 pools. Launch: 1233 days of market history.QA-PROFILE

Issue

A token issued by a project for use, governance or fundraising. Scored on its contract and market facts. The class itself adds no points; the contract and market facts decide the score. Basis: no class-specific evidence. Tokenomics — Supply: mintable with no on-chain cap found. Control: an owner that could not be resolved. Code: upgradeable proxy. Fees: no buy or sell tax. Market: $67K of DEX liquidity across 4 pools. Launch: 1233 days of market history.

Fix

Check the project's own documentation for what the token is used for; this report covers what the contract allows.

Status

Acknowledged

Analysis

AI Copilotas of audit · Oct 14
Executive SummaryWhat the contract is and what the review found

The BridgeMintableTokenV2 contract is an upgradeable ERC-20 token with significant centralized control. Key functionalities such as token minting, burning, pausing transfers, and blocking individual addresses are controlled by a set of privileged addresses. This concentration of power introduces substantial technical and economic risks, as these controllers can unilaterally affect the token supply, individual balances, and overall transferability.

Technical6/10Medium risk

The BridgeMintableTokenV2 is an upgradeable ERC-20 token (7.1 Architecture). It includes standard ERC-20 functionalities alongside several privileged operations. The contract implements pausing mechanisms (pause, unpause) and address blocking (blockAddress, unblockAddress) which can restrict token transfers (7.2 Code Security). Control over these critical functions, as well as minting (mint) and burning (destroyBlackFunds), is concentrated in specific chainportbridge, chainportcongress, and classifiedauthority addresses (7.3 Access Control). This centralized control allows a few entities to significantly impact the token's operation.

Governance1/10High risk

The economic stability and governance of the token are heavily dependent on the integrity of the privileged addresses. The ability to mint new tokens (CP-01) allows for arbitrary supply inflation, directly diluting all token holders (7.4 Economic). Furthermore, the destroyBlackFunds function (CP-02) grants the chainportcongress the power to unilaterally burn tokens from any address, effectively seizing funds. The pause (CP-04) and blockAddress (CP-06) functions enable controllers to halt all transfers or selectively freeze individual accounts, posing significant risks to liquidity and user autonomy (7.5 Governance).

Upgrades1/10High risk

The token utilizes a Transparent Upgradeable Proxy pattern, allowing the underlying implementation logic to be changed (7.1 Architecture). The BridgeMintableTokenV2 contract is the current implementation. The proxy's admin is managed by an OZ_ProxyAdmin contract, whose owner is an Other-Contract (). While upgradeability offers flexibility, the control over upgrades is indirect, requiring further investigation into the Other-Contract's governance to fully assess the upgrade safety (7.7 Upgrades).

Final RecommendationWhat to do about this score

Token holders should be aware of the high degree of centralized control over the token's core functionalities, including supply management and transfer restrictions.

It is crucial to understand the governance mechanisms and security practices surrounding the privileged addresses (chainportbridge, chainportcongress, classifiedauthority) that control these critical operations. Consider implementing multi-signature wallets or time-locks for sensitive administrative actions to enhance security and decentralization. Additionally, a clear process for upgrading the contract should be documented and transparently communicated to the community.

Contract & Record

1 audit on record
TypeTransparentUpgradeableProxy
NetworkBNB Chain
Token age3y
Contract0x69a8…d93f
Deployer0x5c80…9afe
Proxy Upgrade Controls
Proxy TypeEip1967 Transparent
AdminOZ ProxyAdmin → Other-Contract
ImplementationVerified source
Audit History
  1. Oct 14, 202665High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
GoPlus SecurityGPS · BNB Chain65HighAsteroid ShibaASTEROID · BNB Chain65HighPro TokenPRO · BNB Chain64MediumXPULSBNB Chain66HighHana TokenHANA · BNB Chain66HighElonCoinBNB Chain64Medium

Would You Like a More Detailed Audit of ORBOFI?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page