Quantum Audit Logo

Is SEI Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

SEI SEI
0xbdf4…788b
Ethereum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

This audit was conducted on a partial codebase consisting solely of interfaces and two utility libraries (`AddressCast`, `OFTComposeMsgCodec`). The core contract, `OFTImplementation`, which would contain the primary business logic, state management, and access control mechanisms, was not provided. Consequently, a comprehensive security assessment of the protocol's functionality, economic model, and governance structure is not possible. The identified risks primarily relate to the inherent limitations of reviewing an incomplete system and potential complexities within the provided libraries.

1 Critical1 Medium1 Low2 Informational
Volume 24h
$615.4K
Liquidity
$2.30M
Price
$0.04858
Token Age
1y
Top 10 Holders
95.7%

Security Findings

1 Crit1 Med1 Low2 Info
Critical

Incomplete Codebase for Audit (Missing OFTImplementation)

C-01The primary contract, `OFTImplementation`, which is expected to contain the core business logic, state variables, and access control mechanisms for the Omnichain Fungible Token, was not provided for review. This prevents a comprehensive security assessment of the protocol's functionality, potential vulnerabilities (e.g., reentrancy, integer overflows, access control flaws), and overall system integrity. Without the implementation, the actual security posture of the protocol cannot be determined.
IssueThe primary contract, `OFTImplementation`, which is expected to contain the core business logic, state variables, and access control mechanisms for the Omnichain Fungible Token, was not provided for review. This prevents a comprehensive security assessment of the protocol's functionality, potential vulnerabilities (e.g., reentrancy, integer overflows, access control flaws), and overall system integrity. Without the implementation, the actual security posture of the protocol cannot be determined.
FixProvide the complete and verified source code for the `OFTImplementation` contract to enable a full and accurate security audit. This is essential for identifying and mitigating potential vulnerabilities before deployment or further integration.
StatusUnresolved
Medium

Potential for Misinterpretation with `abi.encodePacked` in `OFTComposeMsgCodec`

M-01The `OFTComposeMsgCodec` library utilizes `abi.encodePacked` for message encoding. While this is a common practice for cross-chain messaging, `abi.encodePacked` does not add padding and can lead to ambiguity or misinterpretation if the decoding logic on the receiving chain or within other parts of the protocol does not precisely match the encoding structure, especially when dealing with variable-length data (`bytes _composeMsg`). A mismatch could lead to incorrect parsing of message components like `nonce`, `srcEid`, or `amountLD`.
IssueThe `OFTComposeMsgCodec` library utilizes `abi.encodePacked` for message encoding. While this is a common practice for cross-chain messaging, `abi.encodePacked` does not add padding and can lead to ambiguity or misinterpretation if the decoding logic on the receiving chain or within other parts of the protocol does not precisely match the encoding structure, especially when dealing with variable-length data (`bytes _composeMsg`). A mismatch could lead to incorrect parsing of message components like `nonce`, `srcEid`, or `amountLD`.
FixEnsure that all decoding logic strictly adheres to the exact encoding structure defined in `OFTComposeMsgCodec`. Consider adding explicit length prefixes for variable-length data within the `_composeMsg` if not already handled by the underlying LayerZero messaging system, or use `abi.encode` for fixed-size encoding where possible to reduce ambiguity. Thorough cross-chain testing of message encoding and decoding is crucial.
StatusUnresolved
Low

Low-Level Assembly in `AddressCast.toBytes`

L-01The `AddressCast.toBytes` function employs inline assembly for byte manipulation. While the function includes size checks and appears to correctly handle the conversion, assembly code is inherently more complex and less readable than high-level Solidity. This increases the risk of subtle bugs, off-by-one errors, or unexpected behavior if not rigorously tested across all edge cases, potentially leading to incorrect address or byte array representations.
IssueThe `AddressCast.toBytes` function employs inline assembly for byte manipulation. While the function includes size checks and appears to correctly handle the conversion, assembly code is inherently more complex and less readable than high-level Solidity. This increases the risk of subtle bugs, off-by-one errors, or unexpected behavior if not rigorously tested across all edge cases, potentially leading to incorrect address or byte array representations.
FixThoroughly review and test the `AddressCast.toBytes` function with a wide range of inputs, including edge cases for `_size` (e.g., 1, 32) and `_addressBytes32` values. Consider adding comprehensive unit tests to ensure its correctness and resilience. If possible, explore alternative high-level Solidity constructs that achieve the same functionality to improve readability and reduce potential error surface.
StatusUnresolved
Info

Extensive Interface Definitions Indicate High System Complexity

I-01The provided codebase includes a significant number of interfaces (`IMessageLibManager`, `IMessagingChannel`, `IMessagingComposer`, `IPreCrime`, etc.). While this modular design promotes separation of concerns and reusability, a large number of interconnected interfaces suggests a highly complex system architecture. Increased complexity can lead to a larger attack surface, make it more challenging to reason about the overall system's security, and increase the potential for integration errors between different components.
IssueThe provided codebase includes a significant number of interfaces (`IMessageLibManager`, `IMessagingChannel`, `IMessagingComposer`, `IPreCrime`, etc.). While this modular design promotes separation of concerns and reusability, a large number of interconnected interfaces suggests a highly complex system architecture. Increased complexity can lead to a larger attack surface, make it more challenging to reason about the overall system's security, and increase the potential for integration errors between different components.
FixMaintain clear and comprehensive documentation for the entire system, detailing the responsibilities of each interface and how they interact. Implement robust integration testing to ensure seamless and secure communication between all components. Consider architectural reviews to identify and simplify any overly complex interdependencies.
StatusUnresolved
Info

Lack of Access Control Context in Interfaces

I-02Several functions defined within the interfaces (e.g., `registerLibrary`, `setDefaultSendLibrary`, `setEnforcedOptions` in `IMessageLibManager`, `setEnforcedOptions` in `IOAppOptionsType3`) imply privileged administrative actions. Without the concrete implementation of these interfaces, it is impossible to verify if robust access control mechanisms (e.g., `onlyOwner`, role-based access control, multi-signature wallets) are properly applied to prevent unauthorized users from invoking these critical functions and altering protocol parameters.
IssueSeveral functions defined within the interfaces (e.g., `registerLibrary`, `setDefaultSendLibrary`, `setEnforcedOptions` in `IMessageLibManager`, `setEnforcedOptions` in `IOAppOptionsType3`) imply privileged administrative actions. Without the concrete implementation of these interfaces, it is impossible to verify if robust access control mechanisms (e.g., `onlyOwner`, role-based access control, multi-signature wallets) are properly applied to prevent unauthorized users from invoking these critical functions and altering protocol parameters.
FixEnsure that all functions within the `OFTImplementation` that correspond to these privileged interface methods are protected by strong access control. Implement a multi-signature wallet for critical administrative roles to enhance security and decentralization. Clearly document the access control policies for each sensitive function.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The provided codebase consists of well-defined interfaces and two utility libraries, `AddressCast` and `OFTComposeMsgCodec`. The `AddressCast` library includes robust input validation for address conversions, such as checking `_addressBytes.length` before casting (7.2 Code Security). However, the core `OFTImplementation` contract is missing, preventing any assessment of the actual implementation's security, reentrancy, or integer overflow vulnerabilities (7.1 Architecture, 7.2 Code Security). The `OFTComposeMsgCodec` library utilizes `abi.encodePacked`, which, while common, requires strict adherence to decoding logic to avoid misinterpretation in cross-chain messages (7.2 Code Security).

GovernanceHigh2/10

Due to the absence of the `OFTImplementation` contract, it is impossible to assess the protocol's governance model, economic stability, or potential for oracle manipulation (7.4 Economic, 7.5 Governance). Interfaces like `IMessageLibManager` define functions such as `setDefaultSendLibrary` and `setEnforcedOptions`, which imply significant administrative control. Without the implementation, the robustness of access control mechanisms for these critical functions cannot be verified, posing a high risk of unauthorized actions (7.3 Access Control).

UpgradesMedium6/10

The provided information states `is_proxy: false`, suggesting the `OFTImplementation` might not be directly upgradeable via a proxy pattern. However, without the actual contract code, it's impossible to confirm this or assess any other upgrade mechanisms (7.7 Upgrades). The lack of the core contract also prevents an evaluation of potential upgrade safety issues, such as storage collisions or initialization logic, if an upgrade pattern were to be introduced later. Therefore, the upgrade safety and operational risks (7.8 Operations) remain unassessable.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass

Holder Composition

95.7% in top 10
34.8% in wallets60.9% in contracts
Effective Concentration59.1%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$2.30M

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder100.0%
Top-3 Unlocked100.0%

Key Addresses

4 addresses
Deployer
0x3554…5332
Unlocked LP Held By
0xb6cf…c5740x6708…93e40x5ca2…d75f

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

8 factors
  • Ownership NOT renounced — Multisig (2-of-3)
  • Top-10 concentration > 50% (95.7% total → 59.1% effective; 34.8% in EOAs, 60.9% in contracts — heavy)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 100.0% (independent LP — depth risk)
  • LP top3 unlocked holders = 100.0% (independent LP — depth risk)
  • 1 Critical finding(s) from audit
  • 1 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Dolomite (DOLO)High RiskRedstone (RED)High RiskPinLink (PIN)High RiskSPACE ID (ID)High RiskHarryPotterObamaSonic10Inu (BITCOIN)High RiskUSDS Stablecoin (USDS)High Risk

Would You Like a More Detailed Audit of SEI?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit