Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is RaveDAO Safe?

RAVEEthereum
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance4/10Upgrades7/10Checks passed3 of 5Findings2 Low · 2 Info4
SummaryAI Copilot

The RaveToken contract is an ERC-20 token built upon OpenZeppelin's Ownable and LayerZero's OFT (Omnichain Fungible Token) standards.

Read the full analysis
What raised the score
  • Ownership not renounced — strong Multisig
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0%
  • LP top3 unlocked holders = 100.0%
  • 2 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — strong Multisig (4-of-5)
  • Top-10 concentration > 30% (97.2% total → 40.3% effective; 2.5% in EOAs, 94.7% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • 2 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
94.7%Contracts2.5%2.8%
94.7%Contracts
ContractsWalletsEveryone elseBubble area = share of supply
97.2%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking94.7%
  • Walletsanonymous holders, free to sell2.5%
  • Everyone elsethe rest of the supply2.8%
Effective concentrationwhat the score reads40.3%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$220.5K across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$220.5KShare of depth100.0%
Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x8117…bd7f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

2 Low2 Info
Low

Lack of Emergency Pause Mechanism

The contract lacks an emergency pause mechanism. In the event of a critical vulnerability, an exploit, or a severe issue with the LayerZero protocol, there is no function available to the owner or any authorized entity to temporarily halt token transfers or cross-chain operations. This could prevent the project from mitigating ongoing losses or preventing further damage.L-01

Issue

The contract lacks an emergency pause mechanism. In the event of a critical vulnerability, an exploit, or a severe issue with the LayerZero protocol, there is no function available to the owner or any authorized entity to temporarily halt token transfers or cross-chain operations. This could prevent the project from mitigating ongoing losses or preventing further damage.

Fix

Implement a Pausable mechanism (e.g., from OpenZeppelin) that allows the owner or a designated governance entity to pause and unpause critical functions, such as transfer, transferFrom, sendFrom, and _debit (for cross-chain transfers). This provides a crucial safety switch for incident response.

Status

Unresolved

Low

No Mechanism for Recovering Accidentally Sent Tokens

The contract does not include a function to recover accidentally sent ERC-20 tokens (other than RaveToken itself) or native currency (ETH/MATIC/BNB) that might be mistakenly sent to the contract address. Any such assets sent to the contract would become permanently locked and inaccessible.L-02

Issue

The contract does not include a function to recover accidentally sent ERC-20 tokens (other than RaveToken itself) or native currency (ETH/MATIC/BNB) that might be mistakenly sent to the contract address. Any such assets sent to the contract would become permanently locked and inaccessible.

Fix

Add an onlyOwner function to allow the recovery of arbitrary ERC-20 tokens and native currency. This function should enable the owner to transfer specified tokens or native currency from the contract to a designated address. Care should be taken to prevent the recovery of the contract's own RaveTokens if they are intended to be held by the contract for specific purposes.

Status

Unresolved

Info

Centralized Control by Owner

The contract utilizes the OpenZeppelin Ownable pattern, granting a single address (the owner) exclusive control over critical functions. Specifically, the owner can configure LayerZero parameters such as setDelegate, setTrustedRemote, and setEnforcedOptions. This centralization introduces a single point of failure, where a compromise of the owner's private key could lead to unauthorized control over the token's cross-chain functionality.I-01

Issue

The contract utilizes the OpenZeppelin Ownable pattern, granting a single address (the owner) exclusive control over critical functions. Specifically, the owner can configure LayerZero parameters such as setDelegate, setTrustedRemote, and setEnforcedOptions. This centralization introduces a single point of failure, where a compromise of the owner's private key could lead to unauthorized control over the token's cross-chain functionality.

Fix

Consider using a robust multisig wallet (e.g., Gnosis Safe) as the owner to distribute control and reduce the risk associated with a single point of failure. For highly sensitive operations, explore integrating a more decentralized governance mechanism if feasible for the project's scope.

Status

Unresolved

Info

Reliance on LayerZero Security

The RaveToken contract's core functionality for cross-chain transfers is entirely dependent on the LayerZero protocol and its endpoint. The security and operational integrity of the token across different chains are directly tied to the security of LayerZero's infrastructure, including its relayer network and oracle services. Any vulnerability or compromise within LayerZero could directly impact the RaveToken's cross-chain value transfer and integrity.I-02

Issue

The RaveToken contract's core functionality for cross-chain transfers is entirely dependent on the LayerZero protocol and its endpoint. The security and operational integrity of the token across different chains are directly tied to the security of LayerZero's infrastructure, including its relayer network and oracle services. Any vulnerability or compromise within LayerZero could directly impact the RaveToken's cross-chain value transfer and integrity.

Fix

Acknowledge and monitor the security posture of the LayerZero protocol. Stay updated on LayerZero's security announcements, audits, and any reported vulnerabilities. Implement robust monitoring for LayerZero-related events and potential anomalies in cross-chain transfers.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The RaveToken contract is an ERC-20 token built upon OpenZeppelin's Ownable and LayerZero's OFT (Omnichain Fungible Token) standards. The contract facilitates cross-chain transfers via LayerZero and includes a basic burn function. The codebase is concise and leverages well-audited external libraries, contributing to high technical security. However, the system exhibits centralized control by the owner over critical LayerZero configurations and lacks an emergency pause mechanism, which introduces medium-level governance and operational risks. The overall security is heavily reliant on the integrity of the LayerZero protocol.

Technical8/10Low risk

The technical architecture (7.1 Architecture) of RaveToken is straightforward, extending battle-tested ERC-20, Ownable, and LayerZero OFT contracts. The custom code (7.2 Code Security) is minimal, primarily consisting of a constructor for initialization and a simple burn function, which reduces the attack surface. No reentrancy, integer overflow/underflow, or other common code-level vulnerabilities were identified due to the use of Solidity ^0.8.0+ and reliance on audited libraries. Access control (7.3 Access Control) is managed via the Ownable pattern, restricting critical LayerZero configurations to the owner.

Governance4/10Medium risk

The economic model (7.4 Economic) is simple, based on an ERC-20 token with cross-chain capabilities. Governance (7.5 Governance) is centralized, with a single owner address controlling critical LayerZero configurations such as trusted remotes and delegate settings (7.8 Operations). This centralization, while common, presents a single point of failure. The system's security is heavily dependent on the external LayerZero protocol (7.6 External), meaning any compromise of LayerZero could directly impact RaveToken's cross-chain integrity. A notable absence is an emergency pause mechanism, which could be crucial for mitigating risks during unforeseen events (7.8 Operations).

Upgrades7/10Low risk

The RaveToken contract is not designed with upgradeability (7.7 Upgrades) in mind. It is a standard implementation contract, meaning there are no proxy-related risks or complexities associated with upgrades. Any future changes would require a new deployment and token migration.

Final RecommendationWhat to do about this score

It is recommended to implement an emergency pause mechanism to allow the owner or a designated multisig to halt critical operations in case of an exploit or vulnerability.

Consider deploying the contract with a robust multisig wallet as the owner to enhance security and decentralize control over critical LayerZero configurations. Additionally, establish clear operational procedures for managing LayerZero parameters and for handling potential incidents.

Contract & Record

1 audit on record
TypeRaveToken
NetworkEthereum
Token age6mo
Contract0x1720…db97
Deployer0x17f1…b9f5
Badge for your website
RaveDAO security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Jul 23, 202637Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Frequently Asked Questions

Is RaveDAO a scam?

Based on the provided data, RaveDAO exhibits several characteristics commonly associated with high-risk projects. The unrenounced contract ownership, extreme token centralization (97.3% in top 10 holders), and unlocked liquidity are significant red flags that can indicate a heightened potential for malicious actions or severe market manipulation. These factors contribute to its critical risk score of 71/100.

Is RaveDAO safe to buy?

Investing in RaveDAO carries significant risk, reflected by its critical risk score of 71/100. Key safety concerns include the unrenounced contract ownership, allowing potential future alterations by the deployer, and the highly concentrated token supply that enables substantial market control by a few large holders. Additionally, the lack of locked liquidity means the project is vulnerable to liquidity withdrawals, posing a substantial risk to investor funds.

Has RaveDAO been audited?

The RaveDAO contract has been verified on Etherscan, which means its code is publicly available and matches the deployed bytecode. However, contract verification is not the same as a professional security audit. An audit involves a thorough review by cybersecurity experts to identify vulnerabilities, and there is no information provided to suggest RaveDAO has undergone such a process.

Related Audits

6 more on the recordAll audits
LO0PEthereum37MediumOriginTokenOGN · Ethereum37MediumOctraOCT · Ethereum38MediumSPX6900SPX · Ethereum36MediumProgrammableV4 · Ethereum38MediumZigCoinZIG · Ethereum38Medium

Would You Like a More Detailed Audit of RaveDAO?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page