Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is Robo Token Safe?

ROBOBase
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance4/10Upgrades7/10Checks passed3 of 5Findings2 Medium · 1 Low · 1 Info4
SummaryAI Copilot

The RoboToken contract is a minimal implementation of an Omnichain Fungible Token (OFT) using LayerZero Labs' OFT standard and OpenZeppelin's Ownable.

Read the full analysis
What raised the score
  • Ownership not renounced — strong Multisig
  • Top-10 concentration > 30%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 79.0%
  • LP top3 unlocked holders = 100.0%
  • 2 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Top-10 concentration > 30% (91.7% total → 47.5% effective; 18.0% in EOAs, 73.7% in contracts — moderate)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 79.0% (independent LP — depth risk, pool = 100% of DEX liquidity)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk, pool = 100% of DEX liquidity)
  • 2 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 43 of 5 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code

Holders

as of audit · Sep 4, 2026
73.7%Contracts18.0%Wallets8.3%Everyone else
73.7%Contracts18.0%8.3%
ContractsWalletsEveryone elseBubble area = share of supply
91.7%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking73.7%
  • Walletsanonymous holders, free to sell18.0%
  • Everyone elsethe rest of the supply8.3%
Effective concentrationwhat the score reads47.5%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$396.3K across 2 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$395.4KShare of depth99.8%
Top-1 Unlocked Holder79.0%
Top-3 Unlocked100.0%
Unlocked LP held by
0x6b7d…da880x4a4c…9cc7

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

2 Medium1 Low1 Info
Medium

Centralized Control by Owner/Delegate

The _delegate address, which is set as the contract owner via Ownable(_delegate), possesses significant control over the RoboToken's LayerZero configurations. This includes the ability to set the LayerZero token, change the delegate, and configure send/receive libraries and their parameters. While the prefill data indicates the owner is a 3/5 multisig, this remains a critical point of control where a compromise could lead to manipulation of cross-chain transfers or token functionality.M-01

Issue

The _delegate address, which is set as the contract owner via Ownable(_delegate), possesses significant control over the RoboToken's LayerZero configurations. This includes the ability to set the LayerZero token, change the delegate, and configure send/receive libraries and their parameters. While the prefill data indicates the owner is a 3/5 multisig, this remains a critical point of control where a compromise could lead to manipulation of cross-chain transfers or token functionality.

Fix

Ensure the multisig controlling the owner address is robustly secured with strong key management practices, geographically distributed signers, and strict operational procedures for executing transactions. Implement time-locks or additional governance layers for highly sensitive operations if feasible.

Status

Unresolved

Medium

Reliance on LayerZero Protocol Security

The RoboToken is an Omnichain Fungible Token (OFT) built upon the LayerZero protocol. Its core functionality, including cross-chain transfers and supply management, is entirely dependent on the security, correctness, and operational integrity of the LayerZero endpoint and its underlying messaging infrastructure. Any vulnerabilities, exploits, or operational failures within the LayerZero protocol could directly impact the RoboToken, potentially leading to loss of funds, incorrect token balances, or service disruption.M-02

Issue

The RoboToken is an Omnichain Fungible Token (OFT) built upon the LayerZero protocol. Its core functionality, including cross-chain transfers and supply management, is entirely dependent on the security, correctness, and operational integrity of the LayerZero endpoint and its underlying messaging infrastructure. Any vulnerabilities, exploits, or operational failures within the LayerZero protocol could directly impact the RoboToken, potentially leading to loss of funds, incorrect token balances, or service disruption.

Fix

Acknowledge and monitor the inherent risks associated with external dependencies, particularly cross-chain protocols. Stay informed about LayerZero's security audits, updates, and any reported vulnerabilities. Consider implementing monitoring tools to detect unusual activity related to LayerZero interactions.

Status

Unresolved

Low

Immutability and Lack of Upgradeability

The RoboToken contract is implemented as a standard, non-upgradeable contract. This means that once deployed, its code cannot be modified. While this eliminates risks associated with upgrade mechanisms (e.g., proxy implementation bugs), it also means that any discovered bugs, security vulnerabilities, or desired feature enhancements cannot be patched or implemented without deploying an entirely new contract and requiring users to migrate their tokens.L-01

Issue

The RoboToken contract is implemented as a standard, non-upgradeable contract. This means that once deployed, its code cannot be modified. While this eliminates risks associated with upgrade mechanisms (e.g., proxy implementation bugs), it also means that any discovered bugs, security vulnerabilities, or desired feature enhancements cannot be patched or implemented without deploying an entirely new contract and requiring users to migrate their tokens.

Fix

Ensure that the current contract design is thoroughly reviewed and considered final for its intended lifecycle. If future flexibility or bug-fixing capabilities are deemed necessary, consider a proxy-based upgradeable architecture for future token contracts. For this immutable contract, comprehensive pre-deployment testing is paramount.

Status

Unresolved

Info

Critical Constructor Parameters

The RoboToken constructor initializes two critical immutable parameters: _lzEndpoint and _delegate. The _lzEndpoint specifies the LayerZero endpoint contract, essential for all cross-chain operations. The _delegate address is used to initialize both the OFT delegate and the Ownable owner. Incorrectly configured addresses for either of these parameters during deployment would lead to a non-functional token (wrong endpoint) or a severely compromised token (compromised delegate/owner address).I-01

Issue

The RoboToken constructor initializes two critical immutable parameters: _lzEndpoint and _delegate. The _lzEndpoint specifies the LayerZero endpoint contract, essential for all cross-chain operations. The _delegate address is used to initialize both the OFT delegate and the Ownable owner. Incorrectly configured addresses for either of these parameters during deployment would lead to a non-functional token (wrong endpoint) or a severely compromised token (compromised delegate/owner address).

Fix

Implement a rigorous deployment checklist and verification process to ensure that the correct and audited LayerZero endpoint address is used, and that the _delegate address corresponds to the intended, securely managed multisig wallet. Double-check all addresses against official documentation and known good values before deployment.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The RoboToken contract is a minimal implementation of an Omnichain Fungible Token (OFT) using LayerZero Labs' OFT standard and OpenZeppelin's Ownable. The contract itself contains no custom logic beyond its constructor, inheriting all core functionality from well-audited libraries. Key risks stem from the inherent centralization of owner control (mitigated by a multisig) and the reliance on the LayerZero protocol's security and operational integrity. The contract is not upgradeable, meaning any future changes or bug fixes would require a new deployment.

Technical8/10Low risk

The technical architecture (7.1) is straightforward, utilizing a simple inheritance model from established libraries. Code security (7.2) is robust as the contract contains no custom logic, relying entirely on the audited OFT and Ownable implementations. No reentrancy, integer overflows, or other common Solidity vulnerabilities were found in the RoboToken's specific code. The primary technical risk lies in the correct initialization of critical constructor parameters (I-01).

Governance4/10Medium risk

The contract exhibits centralized control (7.3) through its Ownable pattern, where the owner (the _delegate address) has significant power over LayerZero configurations and token parameters (M-01). This risk is substantially mitigated by the owner being a 3/5 multisig, as indicated by the prefill data. Economically (7.4), the token's value and cross-chain integrity are heavily dependent on the LayerZero protocol's security and operational stability (M-02). Governance (7.5) is limited to the multisig owner's decisions regarding LayerZero settings.

Upgrades7/10Low risk

The RoboToken contract is not designed with upgradeability mechanisms (7.7), meaning it is immutable once deployed. This eliminates risks associated with proxy patterns or upgrade logic but introduces inflexibility. Any future bug fixes or feature enhancements would necessitate a new contract deployment and a migration process (L-01).

Final RecommendationWhat to do about this score

Ensure that the multisig owner for the _delegate address is securely managed with robust operational procedures, as it holds significant control over the token's cross-chain functionality.

Thoroughly verify all constructor parameters, especially the LayerZero endpoint and the delegate address, before deployment, as these are immutable. Given the reliance on LayerZero, closely monitor LayerZero protocol updates and security advisories.

Contract & Record

1 audit on record
TypeRoboToken
NetworkBase
Token age5mo
Contract0x407a…6d6f
Deployer0x29ed…bcb2
Badge for your website
Robo Token security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Aug 15, 202646Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
aeonBase46MediumPlumbingBase46MediumELONBase46MediumBroker CatBROKER · Base46MediumDopplerXDP · Base46MediumNockchainNOCK · Base45Medium

Would You Like a More Detailed Audit of Robo Token?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page