Quantum Audit Logo

Is RaveDAO Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

RaveDAO RAVE
0x1720…db97
Ethereum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → Medium Risk
Executive SummaryAI Copilot

The RaveToken contract is an ERC-20 token built upon OpenZeppelin's Ownable and LayerZero's OFT (Omnichain Fungible Token) standards. The contract facilitates cross-chain transfers via LayerZero and includes a basic burn function. The codebase is concise and leverages well-audited external libraries, contributing to high technical security. However, the system exhibits centralized control by the owner over critical LayerZero configurations and lacks an emergency pause mechanism, which introduces medium-level governance and operational risks. The overall security is heavily reliant on the integrity of the LayerZero protocol.

2 Low2 Informational
Volume 24h
$11.9K
Liquidity
$220.5K
Price
$0.2522
Token Age
6mo
Top 10 Holders
97.2%

Security Findings

2 Low2 Info
Low

Lack of Emergency Pause Mechanism

L-01The contract lacks an emergency pause mechanism. In the event of a critical vulnerability, an exploit, or a severe issue with the LayerZero protocol, there is no function available to the owner or any authorized entity to temporarily halt token transfers or cross-chain operations. This could prevent the project from mitigating ongoing losses or preventing further damage.
IssueThe contract lacks an emergency pause mechanism. In the event of a critical vulnerability, an exploit, or a severe issue with the LayerZero protocol, there is no function available to the owner or any authorized entity to temporarily halt token transfers or cross-chain operations. This could prevent the project from mitigating ongoing losses or preventing further damage.
FixImplement a `Pausable` mechanism (e.g., from OpenZeppelin) that allows the owner or a designated governance entity to pause and unpause critical functions, such as `transfer`, `transferFrom`, `sendFrom`, and `_debit` (for cross-chain transfers). This provides a crucial safety switch for incident response.
StatusUnresolved
Low

No Mechanism for Recovering Accidentally Sent Tokens

L-02The contract does not include a function to recover accidentally sent ERC-20 tokens (other than RaveToken itself) or native currency (ETH/MATIC/BNB) that might be mistakenly sent to the contract address. Any such assets sent to the contract would become permanently locked and inaccessible.
IssueThe contract does not include a function to recover accidentally sent ERC-20 tokens (other than RaveToken itself) or native currency (ETH/MATIC/BNB) that might be mistakenly sent to the contract address. Any such assets sent to the contract would become permanently locked and inaccessible.
FixAdd an `onlyOwner` function to allow the recovery of arbitrary ERC-20 tokens and native currency. This function should enable the owner to transfer specified tokens or native currency from the contract to a designated address. Care should be taken to prevent the recovery of the contract's own RaveTokens if they are intended to be held by the contract for specific purposes.
StatusUnresolved
Info

Centralized Control by Owner

I-01The contract utilizes the OpenZeppelin `Ownable` pattern, granting a single address (the owner) exclusive control over critical functions. Specifically, the owner can configure LayerZero parameters such as `setDelegate`, `setTrustedRemote`, and `setEnforcedOptions`. This centralization introduces a single point of failure, where a compromise of the owner's private key could lead to unauthorized control over the token's cross-chain functionality.
IssueThe contract utilizes the OpenZeppelin `Ownable` pattern, granting a single address (the owner) exclusive control over critical functions. Specifically, the owner can configure LayerZero parameters such as `setDelegate`, `setTrustedRemote`, and `setEnforcedOptions`. This centralization introduces a single point of failure, where a compromise of the owner's private key could lead to unauthorized control over the token's cross-chain functionality.
FixConsider using a robust multisig wallet (e.g., Gnosis Safe) as the owner to distribute control and reduce the risk associated with a single point of failure. For highly sensitive operations, explore integrating a more decentralized governance mechanism if feasible for the project's scope.
StatusUnresolved
Info

Reliance on LayerZero Security

I-02The RaveToken contract's core functionality for cross-chain transfers is entirely dependent on the LayerZero protocol and its endpoint. The security and operational integrity of the token across different chains are directly tied to the security of LayerZero's infrastructure, including its relayer network and oracle services. Any vulnerability or compromise within LayerZero could directly impact the RaveToken's cross-chain value transfer and integrity.
IssueThe RaveToken contract's core functionality for cross-chain transfers is entirely dependent on the LayerZero protocol and its endpoint. The security and operational integrity of the token across different chains are directly tied to the security of LayerZero's infrastructure, including its relayer network and oracle services. Any vulnerability or compromise within LayerZero could directly impact the RaveToken's cross-chain value transfer and integrity.
FixAcknowledge and monitor the security posture of the LayerZero protocol. Stay updated on LayerZero's security announcements, audits, and any reported vulnerabilities. Implement robust monitoring for LayerZero-related events and potential anomalies in cross-chain transfers.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The technical architecture (7.1 Architecture) of RaveToken is straightforward, extending battle-tested ERC-20, Ownable, and LayerZero OFT contracts. The custom code (7.2 Code Security) is minimal, primarily consisting of a constructor for initialization and a simple `burn` function, which reduces the attack surface. No reentrancy, integer overflow/underflow, or other common code-level vulnerabilities were identified due to the use of Solidity ^0.8.0+ and reliance on audited libraries. Access control (7.3 Access Control) is managed via the Ownable pattern, restricting critical LayerZero configurations to the owner.

GovernanceMedium4/10

The economic model (7.4 Economic) is simple, based on an ERC-20 token with cross-chain capabilities. Governance (7.5 Governance) is centralized, with a single owner address controlling critical LayerZero configurations such as trusted remotes and delegate settings (7.8 Operations). This centralization, while common, presents a single point of failure. The system's security is heavily dependent on the external LayerZero protocol (7.6 External), meaning any compromise of LayerZero could directly impact RaveToken's cross-chain integrity. A notable absence is an emergency pause mechanism, which could be crucial for mitigating risks during unforeseen events (7.8 Operations).

UpgradesLow7/10

The RaveToken contract is not designed with upgradeability (7.7 Upgrades) in mind. It is a standard implementation contract, meaning there are no proxy-related risks or complexities associated with upgrades. Any future changes would require a new deployment and token migration.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

97.2% in top 10
2.5% in wallets94.7% in contracts
Effective Concentration40.3%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$220.5K across 2 pairs
Uniswap v4USDTanalysed$220.5K100.0%Uniswap v3WETH$30.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

2 addresses
Deployer
0x17f1…b9f5
Unlocked LP Held By
0x8117…bd7f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

6 factors
  • Ownership NOT renounced — strong Multisig (4-of-5)
  • Top-10 concentration > 30% (97.2% total → 40.3% effective; 2.5% in EOAs, 94.7% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • 2 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is RaveDAO a scam?

Based on the provided data, RaveDAO exhibits several characteristics commonly associated with high-risk projects. The unrenounced contract ownership, extreme token centralization (97.3% in top 10 holders), and unlocked liquidity are significant red flags that can indicate a heightened potential for malicious actions or severe market manipulation. These factors contribute to its critical risk score of 71/100.

Is RaveDAO safe to buy?

Investing in RaveDAO carries significant risk, reflected by its critical risk score of 71/100. Key safety concerns include the unrenounced contract ownership, allowing potential future alterations by the deployer, and the highly concentrated token supply that enables substantial market control by a few large holders. Additionally, the lack of locked liquidity means the project is vulnerable to liquidity withdrawals, posing a substantial risk to investor funds.

Has RaveDAO been audited?

The RaveDAO contract has been verified on Etherscan, which means its code is publicly available and matches the deployed bytecode. However, contract verification is not the same as a professional security audit. An audit involves a thorough review by cybersecurity experts to identify vulnerabilities, and there is no information provided to suggest RaveDAO has undergone such a process.

Related Audits

6 more on the record
LO0PMedium RiskOctra (OCT)Medium RiskSPX6900 (SPX)Medium RiskProgrammable (V4)Medium RiskZigCoin (ZIG)Medium RiskTRIAMedium Risk

Would You Like a More Detailed Audit of RaveDAO?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit