Quantum Audit Logo

Is SomniaOFT Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

SomniaOFT SOMI
0xa961…266f
BNB Chain Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The SomniaOFT contract implements an Omnichain Fungible Token (OFT) utilizing LayerZero V2 technology and OpenZeppelin's Ownable access control. The contract itself is minimal, primarily inheriting and delegating functionality to the well-audited LayerZero OFT library. The primary security considerations revolve around the centralized control exercised by the owner multisig over critical LayerZero configurations, the inherent reliance on external LayerZero infrastructure, and the operational complexities associated with managing cross-chain parameters. The use of a 3/5 multisig for ownership is a strong security practice that mitigates some centralization risks.

1 High2 Medium1 Low
Volume 24h
$10.3K
Liquidity
$137.8K
Price
$0.113
Token Age
1y
Top 10 Holders
85.8%

Security Findings

1 High2 Med1 Low
High

Centralized Control over LayerZero Configurations

H-01The `Ownable` owner (a 3/5 multisig) has extensive control over critical LayerZero parameters within the `OFT` base contract. This includes the ability to set trusted remotes, message libraries, and various configuration parameters (e.g., `setTrustedRemote`, `setSendVersion`, `setReceiveVersion`, `setMinDstGas`). While a multisig mitigates some risk, a compromise or mismanagement of the multisig could lead to severe operational issues, such as disabling cross-chain transfers, routing messages through malicious endpoints, or causing funds to become stuck.
IssueThe `Ownable` owner (a 3/5 multisig) has extensive control over critical LayerZero parameters within the `OFT` base contract. This includes the ability to set trusted remotes, message libraries, and various configuration parameters (e.g., `setTrustedRemote`, `setSendVersion`, `setReceiveVersion`, `setMinDstGas`). While a multisig mitigates some risk, a compromise or mismanagement of the multisig could lead to severe operational issues, such as disabling cross-chain transfers, routing messages through malicious endpoints, or causing funds to become stuck.
FixImplement robust operational security procedures for the owner multisig, including strict key management, multi-factor authentication for signers, and clear governance processes for approving configuration changes. Regularly audit all LayerZero configurations and ensure that `trustedRemote` addresses correspond to legitimate and secure endpoints. Consider implementing time-locks or additional governance checks for highly sensitive configuration changes.
StatusUnresolved
Medium

Reliance on External LayerZero Infrastructure

M-01The core cross-chain functionality of the SomniaOFT token is entirely dependent on the security, availability, and correct operation of the LayerZero endpoint and its associated message libraries (7.6 External). Any vulnerability, outage, or malicious activity within the LayerZero network or its specific endpoint implementations could directly impact the ability to transfer SomniaOFT tokens across chains, potentially leading to asset loss or service disruption.
IssueThe core cross-chain functionality of the SomniaOFT token is entirely dependent on the security, availability, and correct operation of the LayerZero endpoint and its associated message libraries (7.6 External). Any vulnerability, outage, or malicious activity within the LayerZero network or its specific endpoint implementations could directly impact the ability to transfer SomniaOFT tokens across chains, potentially leading to asset loss or service disruption.
FixAcknowledge and monitor the inherent risks associated with relying on external bridge infrastructure. Implement robust monitoring for LayerZero endpoint health, transaction finality, and any security announcements from LayerZero. Develop contingency plans for scenarios involving LayerZero outages or security incidents, such as pausing cross-chain transfers if necessary.
StatusUnresolved
Medium

Operational Risk from LayerZero Configuration Errors

M-02The owner multisig is responsible for configuring various LayerZero parameters. Incorrect configuration, such as setting an invalid `trustedRemote` address, misconfiguring `minDstGas`, or setting incompatible message library versions, could lead to cross-chain transactions failing, tokens being stuck in transit, or unexpected fee consumption (7.8 Operations). These errors, while not necessarily security vulnerabilities, can significantly impact user experience and protocol functionality.
IssueThe owner multisig is responsible for configuring various LayerZero parameters. Incorrect configuration, such as setting an invalid `trustedRemote` address, misconfiguring `minDstGas`, or setting incompatible message library versions, could lead to cross-chain transactions failing, tokens being stuck in transit, or unexpected fee consumption (7.8 Operations). These errors, while not necessarily security vulnerabilities, can significantly impact user experience and protocol functionality.
FixEstablish a rigorous testing and verification process for all LayerZero configuration changes before deployment to production. Maintain clear documentation of all configuration parameters and their intended values. Implement automated checks or simulations where possible to validate the correctness of new configurations. Ensure that the team managing these configurations has a deep understanding of LayerZero's operational requirements.
StatusUnresolved
Low

Constructor Parameter `_delegate` Dual Role

L-01The `_delegate` address passed to the constructor is used to initialize both the `OFT` base contract and the `Ownable` base contract. This means the same address becomes the LayerZero delegate and the contract owner. While this is a common pattern and not a direct vulnerability, it consolidates significant control under a single entity (the multisig in this case).
IssueThe `_delegate` address passed to the constructor is used to initialize both the `OFT` base contract and the `Ownable` base contract. This means the same address becomes the LayerZero delegate and the contract owner. While this is a common pattern and not a direct vulnerability, it consolidates significant control under a single entity (the multisig in this case).
FixEnsure that the `_delegate` address is always a highly secure, multi-signature wallet or a well-governed contract. Confirm that the team understands the full scope of control granted to this address through both the `Ownable` and `OFT` roles. No code change is strictly necessary given the use of a multisig, but awareness is key.
StatusUnresolved

Category Ratings

TechnicalLow8/10

The SomniaOFT contract (7.1 Architecture) is a straightforward implementation, inheriting from the battle-tested OpenZeppelin Ownable and LayerZero OFT contracts. This approach leverages well-audited external libraries, reducing the attack surface of custom code. The contract uses Solidity 0.8.22, benefiting from default checked arithmetic (7.2 Code Security). However, the inherent complexity of cross-chain communication via LayerZero introduces a dependency on the security and correct functioning of external infrastructure (7.6 External). Misconfigurations of LayerZero parameters could lead to operational issues.

GovernanceHigh1/10

The contract's administrative functions are protected by OpenZeppelin's Ownable pattern, with ownership assigned to a 3/5 multisig address (7.3 Access Control). This distributed control significantly enhances security against single points of failure or compromise. However, the owner multisig retains extensive control over critical LayerZero configurations, such as setting trusted remotes, message libraries, and fees (7.5 Governance). This centralized control, while managed by a multisig, still represents a potential point of failure if the multisig itself were compromised or mismanaged, impacting the token's cross-chain functionality (7.4 Economic).

UpgradesLow7/10

The SomniaOFT contract is not designed as an upgradeable proxy (7.7 Upgrades). Its functionality is fixed upon deployment, meaning there are no direct upgrade safety concerns for this specific contract. Any future changes would require a new deployment and migration.

Security Checklist

3/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionPass
Liquidity LockedFail
Not a ProxyPass
HoneypotNoneBuy Tax0.0%Sell Tax0.0%

Holder Composition

85.8% in top 10
82.7% in wallets3.1% in contracts
Effective Concentration83.9%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$138.0K across 4 pairs
Pancakeswap v3USDCanalysed$137.8K99.9%Pancakeswap v3USDT$1360.1%UniswapUSDT$30.0%Pancakeswap v3USDT$20.0%

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

LP Distribution

Top-1 Unlocked Holder58.5%
Top-3 Unlocked99.1%

Key Addresses

5 addresses
Deployer
0xda1f…346b
Unlocked LP Held By
0x1931…10ef0x797d…eb550x7069…69fc0x8209…3a84

No privileged address appears among these holders: the unlocked liquidity sits with independent providers, not with the deployer.

What Raised This Score

8 factors
  • Ownership NOT renounced — strong Multisig (3-of-5)
  • Top-10 concentration > 70% (85.8% total → 83.9% effective; 82.7% in EOAs, 3.1% in contracts — extreme)
  • Liquidity not locked, but no owner/deployer address holds LP — market-depth risk, not rug risk
  • LP top1 unlocked holder = 58.5% (independent LP — depth risk, pool = 100% of DEX liquidity)
  • LP top3 unlocked holders = 99.1% (independent LP — depth risk, pool = 100% of DEX liquidity)
  • 1 High finding(s) from audit
  • 2 Medium finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Related Audits

6 more on the record
Pro Token (PRO)High RiskElonCoinHigh RiskSUMMERHigh RiskGoPlus Security (GPS)High RiskAsteroid Shiba (ASTEROID)High RiskCaldera (ERA)High Risk

Would You Like a More Detailed Audit of SomniaOFT?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit