Quantum Audit Logo
Launch App

On-chain security analysis — is it a scam or legit?

Is SomniaOFT Safe?

SOMIBNB Chain
Not verified This record has not gone through deep verification and is not being monitored. The score is a dated snapshot — the token’s risk can change at any time.Own this token? Put it under verification →
Last checked Sep 4, 2026 · 1 audit on record
Chart
Medium RiskHow is this score calculated?
How the score breaks downratings: 10 is safest
Technical8/10Governance1/10Upgrades7/10Checks passed5 of 7Findings1 High · 2 Medium · 1 Low4
SummaryAI Copilot

The SomniaOFT contract implements an Omnichain Fungible Token (OFT) utilizing LayerZero V2 technology and OpenZeppelin's Ownable access control.

Read the full analysis
What raised the score
  • Ownership not renounced — strong Multisig
  • Top-10 concentration > 70%
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 58.5%
  • LP top3 unlocked holders = 99.1%
  • 1 High finding(s) from audit
  • 2 Medium finding(s) from audit
  • 1 Low finding(s) from audit
Exact factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Top-10 concentration > 70% (85.8% total → 83.9% effective; 82.7% in EOAs, 3.1% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 58.5% (independent LP — depth risk, pool = 100% of DEX liquidity)
  • LP top3 unlocked holders = 99.1% (independent LP — depth risk, pool = 100% of DEX liquidity)
  • 1 High finding(s) from audit
  • 2 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Security Checklist

as of audit · Sep 45 of 7 checks passed
Contract verifiedVerified
OwnershipRetained
MintNo mint
Liquidity lockNot locked
UpgradeabilityFixed code
HoneypotNone found
Buy / sell tax0% / 0%

Holders

as of audit · Sep 4, 2026
3.1%82.7%Wallets14.2%Everyone else
3.1%82.7%Wallets14.2%Everyone else
ContractsWalletsEveryone elseBubble area = share of supply
85.8%of supply sits with the top 10 holders
  • Contractstreasury, vesting, bridge, staking3.1%
  • Walletsanonymous holders, free to sell82.7%
  • Everyone elsethe rest of the supply14.2%
Effective concentrationwhat the score reads83.9%
How holder types affect the score

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Holder balances as recorded by the audit of Sep 4, 2026

Liquidity

as of audit · Sep 4$138.0K across 4 pairs

The risk score reads depth across every pair.

LP tokensNot locked

The LP tokens of the analysed pool are not locked or burned, so whoever holds them can withdraw that liquidity.

Analysed pool$137.8KShare of depth99.9%
Top-1 Unlocked Holder58.5%
Top-3 Unlocked99.1%
Unlocked LP held by
0x1931…10ef0x797d…eb550x7069…69fc0x8209…3a84

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

Security Findings

1 High2 Medium1 Low
High

Centralized Control over LayerZero Configurations

The Ownable owner (a 3/5 multisig) has extensive control over critical LayerZero parameters within the OFT base contract. This includes the ability to set trusted remotes, message libraries, and various configuration parameters (e.g., setTrustedRemote, setSendVersion, setReceiveVersion, setMinDstGas). While a multisig mitigates some risk, a compromise or mismanagement of the multisig could lead to severe operational issues, such as disabling cross-chain transfers, routing messages through malicious endpoints, or causing funds to become stuck.H-01

Issue

The Ownable owner (a 3/5 multisig) has extensive control over critical LayerZero parameters within the OFT base contract. This includes the ability to set trusted remotes, message libraries, and various configuration parameters (e.g., setTrustedRemote, setSendVersion, setReceiveVersion, setMinDstGas). While a multisig mitigates some risk, a compromise or mismanagement of the multisig could lead to severe operational issues, such as disabling cross-chain transfers, routing messages through malicious endpoints, or causing funds to become stuck.

Fix

Implement robust operational security procedures for the owner multisig, including strict key management, multi-factor authentication for signers, and clear governance processes for approving configuration changes. Regularly audit all LayerZero configurations and ensure that trustedRemote addresses correspond to legitimate and secure endpoints. Consider implementing time-locks or additional governance checks for highly sensitive configuration changes.

Status

Unresolved

Medium

Reliance on External LayerZero Infrastructure

The core cross-chain functionality of the SomniaOFT token is entirely dependent on the security, availability, and correct operation of the LayerZero endpoint and its associated message libraries (7.6 External). Any vulnerability, outage, or malicious activity within the LayerZero network or its specific endpoint implementations could directly impact the ability to transfer SomniaOFT tokens across chains, potentially leading to asset loss or service disruption.M-01

Issue

The core cross-chain functionality of the SomniaOFT token is entirely dependent on the security, availability, and correct operation of the LayerZero endpoint and its associated message libraries (7.6 External). Any vulnerability, outage, or malicious activity within the LayerZero network or its specific endpoint implementations could directly impact the ability to transfer SomniaOFT tokens across chains, potentially leading to asset loss or service disruption.

Fix

Acknowledge and monitor the inherent risks associated with relying on external bridge infrastructure. Implement robust monitoring for LayerZero endpoint health, transaction finality, and any security announcements from LayerZero. Develop contingency plans for scenarios involving LayerZero outages or security incidents, such as pausing cross-chain transfers if necessary.

Status

Unresolved

Medium

Operational Risk from LayerZero Configuration Errors

The owner multisig is responsible for configuring various LayerZero parameters. Incorrect configuration, such as setting an invalid trustedRemote address, misconfiguring minDstGas, or setting incompatible message library versions, could lead to cross-chain transactions failing, tokens being stuck in transit, or unexpected fee consumption (7.8 Operations). These errors, while not necessarily security vulnerabilities, can significantly impact user experience and protocol functionality.M-02

Issue

The owner multisig is responsible for configuring various LayerZero parameters. Incorrect configuration, such as setting an invalid trustedRemote address, misconfiguring minDstGas, or setting incompatible message library versions, could lead to cross-chain transactions failing, tokens being stuck in transit, or unexpected fee consumption (7.8 Operations). These errors, while not necessarily security vulnerabilities, can significantly impact user experience and protocol functionality.

Fix

Establish a rigorous testing and verification process for all LayerZero configuration changes before deployment to production. Maintain clear documentation of all configuration parameters and their intended values. Implement automated checks or simulations where possible to validate the correctness of new configurations. Ensure that the team managing these configurations has a deep understanding of LayerZero's operational requirements.

Status

Unresolved

Low

Constructor Parameter _delegate Dual Role

The _delegate address passed to the constructor is used to initialize both the OFT base contract and the Ownable base contract. This means the same address becomes the LayerZero delegate and the contract owner. While this is a common pattern and not a direct vulnerability, it consolidates significant control under a single entity (the multisig in this case).L-01

Issue

The _delegate address passed to the constructor is used to initialize both the OFT base contract and the Ownable base contract. This means the same address becomes the LayerZero delegate and the contract owner. While this is a common pattern and not a direct vulnerability, it consolidates significant control under a single entity (the multisig in this case).

Fix

Ensure that the _delegate address is always a highly secure, multi-signature wallet or a well-governed contract. Confirm that the team understands the full scope of control granted to this address through both the Ownable and OFT roles. No code change is strictly necessary given the use of a multisig, but awareness is key.

Status

Unresolved

Analysis

AI Copilotas of audit · Sep 4
Executive SummaryWhat the contract is and what the review found

The SomniaOFT contract implements an Omnichain Fungible Token (OFT) utilizing LayerZero V2 technology and OpenZeppelin's Ownable access control. The contract itself is minimal, primarily inheriting and delegating functionality to the well-audited LayerZero OFT library. The primary security considerations revolve around the centralized control exercised by the owner multisig over critical LayerZero configurations, the inherent reliance on external LayerZero infrastructure, and the operational complexities associated with managing cross-chain parameters. The use of a 3/5 multisig for ownership is a strong security practice that mitigates some centralization risks.

Technical8/10Low risk

The SomniaOFT contract (7.1 Architecture) is a straightforward implementation, inheriting from the battle-tested OpenZeppelin Ownable and LayerZero OFT contracts. This approach leverages well-audited external libraries, reducing the attack surface of custom code. The contract uses Solidity 0.8.22, benefiting from default checked arithmetic (7.2 Code Security). However, the inherent complexity of cross-chain communication via LayerZero introduces a dependency on the security and correct functioning of external infrastructure (7.6 External). Misconfigurations of LayerZero parameters could lead to operational issues.

Governance1/10High risk

The contract's administrative functions are protected by OpenZeppelin's Ownable pattern, with ownership assigned to a 3/5 multisig address (7.3 Access Control). This distributed control significantly enhances security against single points of failure or compromise. However, the owner multisig retains extensive control over critical LayerZero configurations, such as setting trusted remotes, message libraries, and fees (7.5 Governance). This centralized control, while managed by a multisig, still represents a potential point of failure if the multisig itself were compromised or mismanaged, impacting the token's cross-chain functionality (7.4 Economic).

Upgrades7/10Low risk

The SomniaOFT contract is not designed as an upgradeable proxy (7.7 Upgrades). Its functionality is fixed upon deployment, meaning there are no direct upgrade safety concerns for this specific contract. Any future changes would require a new deployment and migration.

Final RecommendationWhat to do about this score

Ensure the multisig controlling the SomniaOFT contract is robustly secured, with strong operational procedures for key management and transaction signing.

Regularly review and audit all LayerZero configurations, especially trustedRemote and message library settings, to prevent misconfigurations that could lead to funds being stuck or cross-chain transactions failing. Establish comprehensive monitoring for LayerZero endpoint health and transaction statuses to quickly identify and respond to any issues.

Contract & Record

1 audit on record
TypeSolidity 0.8.22
NetworkBNB Chain
Token age1y
Contract0xa961…266f
Deployer0xda1f…346b
Badge for your website
SomniaOFT security record badge

Free for any token on the record. It links to this page and always shows the current score and the date it was checked.

Audit History
  1. Sep 1, 202664Medium

Score changes are recorded as dated snapshots — history is append-only and cannot be edited.

Related Audits

6 more on the recordAll audits
Pro TokenPRO · BNB Chain64MediumElonCoinBNB Chain64MediumSUMMERBNB Chain64MediumFourFORM · BNB Chain64Medium79AUBNB Chain64MediumGoPlus SecurityGPS · BNB Chain65High

Would You Like a More Detailed Audit of SomniaOFT?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit Is this your token? Publish your own audit on this page