Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Plasma Safe?

XPLBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
High RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical6/10Governance1/10Upgrades6/10Checks passed3 of 5Findings1 High · 2 Medium · 1 Low · 1 Info5
SummaryAI Copilot

The PlasmaOFT contract is an Omnichain Fungible Token (OFT) built on LayerZero, inheriting from OpenZeppelin's Ownable.

Read the full analysis
What raised the score
  • Ownership not renounced — strong Multisig
  • Top-10 concentration > 70%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 95.1%
  • LP top3 unlocked holders = 100.0%
  • 1 High finding(s) from audit
  • 2 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — strong Multisig (4-of-6)
  • Top-10 concentration > 70% (89.9% total → 88.9% effective; 88.3% in EOAs, 1.5% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 95.1% (independent LP — depth risk, pool = 92% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 92% of DEX liquidity)
  • 1 High finding(s) from audit
  • 2 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
88.3%Wallets10.1%Everyone else
88.3%Wallets10.1%
ContractsWalletsEveryone elseBubble area = share of supply
89.9%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking1.5%
  • Walletsanonymous holders, free to sell88.3%
  • Everyone elsethe rest of the supply10.1%
Effective concentrationwhat the score reads88.9%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$439.7K across 12 pairs
Show 4 more pairs

The 2 remaining pairs hold $2 between them and are not listed. The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$406.3KShare of depth92.4%
Top-1 Unlocked Holder95.1%
Top-3 Unlocked100.0%
Unlocked LP held by
0xaa4c…b9080xcbac…d9b60x966d…e41a0x757e…7cdc0x1458…8fbe0xa873…45880x3cf3…6aaf0x3f52…40d40xfaad…fcf40x122e…9a0a

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High2 Medium1 Low1 Info
High

Cross-Chain Bridge Security Risk

The contract's core functionality relies on the LayerZero protocol for cross-chain token transfers. Bridge protocols are complex and have historically been targets for significant exploits, leading to substantial asset losses. Any vulnerability in the LayerZero endpoint, message passing, or associated relayers could directly impact the security of PlasmaOFT tokens across chains.H-01

Issue

The contract's core functionality relies on the LayerZero protocol for cross-chain token transfers. Bridge protocols are complex and have historically been targets for significant exploits, leading to substantial asset losses. Any vulnerability in the LayerZero endpoint, message passing, or associated relayers could directly impact the security of PlasmaOFT tokens across chains.

Fix

Conduct continuous monitoring of LayerZero protocol security announcements and audits. Implement robust off-chain monitoring for unusual cross-chain activity. Diversify bridge reliance if possible in future iterations.

Status

Unresolved

Medium

Dependency on LayerZero Protocol

The PlasmaOFT contract is a wrapper around LayerZero's OFT implementation. Its security and functionality are entirely dependent on the correctness and security of the LayerZero libraries and the underlying LayerZero endpoint. While LayerZero is a prominent solution, any undiscovered vulnerability or operational issue within their extensive codebase could directly affect this contract.M-01

Issue

The PlasmaOFT contract is a wrapper around LayerZero's OFT implementation. Its security and functionality are entirely dependent on the correctness and security of the LayerZero libraries and the underlying LayerZero endpoint. While LayerZero is a prominent solution, any undiscovered vulnerability or operational issue within their extensive codebase could directly affect this contract.

Fix

Maintain a deep understanding of the LayerZero protocol's architecture and security model. Regularly review LayerZero's official documentation, security updates, and audit reports. Ensure the _lzEndpoint address is correctly configured and points to the official, audited LayerZero endpoint.

Status

Unresolved

Medium

Lack of Emergency Pause Mechanism

The PlasmaOFT contract, as a standard ERC-20/OFT implementation, does not include an emergency pause or circuit breaker mechanism. In the event of a critical vulnerability, exploit, or market manipulation, there is no immediate way for the owner to halt token transfers or cross-chain operations to prevent further loss of funds.M-02

Issue

The PlasmaOFT contract, as a standard ERC-20/OFT implementation, does not include an emergency pause or circuit breaker mechanism. In the event of a critical vulnerability, exploit, or market manipulation, there is no immediate way for the owner to halt token transfers or cross-chain operations to prevent further loss of funds.

Fix

Evaluate the feasibility of integrating a pause mechanism, potentially at a higher protocol level or through a governance-controlled wrapper, to provide an emergency stop functionality. This would allow the owner (multisig) to temporarily freeze operations in critical situations, subject to predefined conditions and governance approval.

Status

Unresolved

Low

Configuration Risk for LayerZero Parameters

The constructor takes _lzEndpoint and _delegate as parameters, which are critical for LayerZero operations and ownership. Incorrectly setting these parameters during deployment could lead to the contract being inoperable, funds being sent to the wrong endpoint, or control being assigned to an unintended address.L-01

Issue

The constructor takes _lzEndpoint and _delegate as parameters, which are critical for LayerZero operations and ownership. Incorrectly setting these parameters during deployment could lead to the contract being inoperable, funds being sent to the wrong endpoint, or control being assigned to an unintended address.

Fix

Implement a rigorous deployment checklist and multi-party verification process for all constructor arguments, especially _lzEndpoint and _delegate. Ensure these addresses are thoroughly vetted and correspond to the intended, audited components.

Status

Unresolved

Info

Centralized Owner Privileges (Mitigated by Multisig)

The contract inherits Ownable, granting the owner (the _delegate address) significant administrative control. While the provided prefill indicates this owner is a 4-of-6 multisig, centralizing control, even with a multisig, means that a compromise of the multisig signers could lead to unauthorized actions, such as reconfiguring LayerZero parameters or potentially impacting token functionality.I-01

Issue

The contract inherits Ownable, granting the owner (the _delegate address) significant administrative control. While the provided prefill indicates this owner is a 4-of-6 multisig, centralizing control, even with a multisig, means that a compromise of the multisig signers could lead to unauthorized actions, such as reconfiguring LayerZero parameters or potentially impacting token functionality.

Fix

Maintain strict security practices for all multisig signers, including hardware wallets, strong authentication, and secure key management. Regularly review the multisig's operational procedures and ensure a clear understanding of the owner's capabilities and responsibilities.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The PlasmaOFT contract is an Omnichain Fungible Token (OFT) built on LayerZero, inheriting from OpenZeppelin's Ownable. The contract itself is minimal, primarily serving as a wrapper for LayerZero's OFT functionality. Key strengths include the use of well-audited OpenZeppelin components and a robust multisig ownership structure. The primary risks stem from its reliance on the LayerZero protocol's security and the inherent complexities of cross-chain bridge operations.

Technical6/10Medium risk

The PlasmaOFT contract is a straightforward implementation of an Omnichain Fungible Token (OFT) using LayerZero's OFT library and OpenZeppelin's Ownable. The code is minimal and leverages battle-tested libraries, contributing to its technical robustness (7.2 Code Security). However, the contract's security is heavily dependent on the underlying LayerZero protocol, which introduces inherent complexities and potential attack vectors associated with cross-chain bridges (7.6 External). There is no explicit emergency pause mechanism, which could limit response capabilities during a critical incident (7.8 Operations).

Governance1/10High risk

The contract's ownership is managed by a robust 4-of-6 multisig, significantly mitigating risks associated with single points of failure or compromised private keys (7.3 Access Control, 7.5 Governance). This strong governance structure enhances the overall security posture. Economic risks are primarily tied to the stability and security of the underlying LayerZero bridge and the broader ecosystem rather than specific contract logic (7.4 Economic).

Upgrades6/10Medium risk

The PlasmaOFT contract is deployed as a standard, non-upgradeable implementation (7.7 Upgrades). This eliminates upgrade-specific risks such as proxy misconfigurations or logic contract vulnerabilities introduced during upgrades. Any future changes would require a new deployment and migration.

Final RecommendationWhat to do about this score

It is recommended to conduct thorough due diligence on the LayerZero protocol's security and operational practices, as the PlasmaOFT contract's safety is intrinsically linked to it.

Implement robust monitoring for cross-chain transactions and LayerZero endpoint configurations. Consider integrating an emergency pause mechanism at a higher level if the protocol design allows, to provide a circuit breaker in extreme circumstances.

Contract & Record

1 audit on record
TypeSolidity 0.8.22
NetworkBNB Chain
Token age10mo
Contract0x405f…26b0
Deployer0x277e…2483
Badge for your website
Plasma security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 13, 202671High

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

What is the XPL contract address?

The Plasma (XPL) contract on BNB Chain is 0x405fbc9004d857903bfd6b3357792d71a50726b0. Compare it with the address the project itself publishes before trading: other contracts can carry the same name and ticker.

Is Plasma a scam?

Quantum Audit's risk score for Plasma is 71/100 (High risk) as of Sep 4, 2026, computed by a deterministic function from on-chain facts — Contract verified: Verified; Ownership: Retained; Mint: No mint; Liquidity lock: Not locked; Upgradeability: Fixed code. A score is a dated snapshot of those facts, not a guarantee; each one is listed on this page.

Is XPL liquidity locked?

Liquidity lock: Not locked (as of Sep 4, 2026). Total DEX liquidity: $439.7K.

Who holds XPL?

As of Sep 4, 2026, the 10 largest holders own 89.9% of the supply. The Holders section on this page shows who they are by holder type.

Related Audits

6 more on the recordAll audits
AnomaXAN · BNB Chain71HighMirexMRX · BNB Chain71HighCoinMarketCap 20 Index DTFCMC20 · BNB Chain71HighKGSTBNB Chain71HighPancakeSwap TokenCAKE · BNB Chain72HighSubsquidSQD · BNB Chain72High

Would You Like a More Detailed Audit of Plasma?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page